6a1c98422c3a781edcca8c7d58c3b0b05cb0cd35c2f96e6b28f44338252b0dbb

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82a3f1037fb33670cb27c00093b623ad_JaffaCakes118.html
Size

174KB
MD5

82a3f1037fb33670cb27c00093b623ad
SHA1

96e4d01c8f1d10640151757f8accef691b785618
SHA256

6a1c98422c3a781edcca8c7d58c3b0b05cb0cd35c2f96e6b28f44338252b0dbb
SHA512

2ee83cbd0c5f623d444724553acaac46ef8f026c1c505a604c167abd4dcaf737eaedd805b12ce6e805aba602bdf21f1e3bb76fdadcfbcdfd4059c3a46f717237
SSDEEP

3072:0F9Sc3z2UP13G4k5QhLpOatV3uw6qjDrn/fNbYaaLStRgcxWUu/v66sbsGon4G5m:gsK3G4k5QhL8atVzfTfNbYaaLStRxxWK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
376	msedge.exe
376	msedge.exe
1192	identity_helper.exe
1192	identity_helper.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1592	376	msedge.exe	84
PID 376 wrote to memory of 1592	376	msedge.exe	84
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 2348	376	msedge.exe	85
PID 376 wrote to memory of 3568	376	msedge.exe	86
PID 376 wrote to memory of 3568	376	msedge.exe	86
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87
PID 376 wrote to memory of 820	376	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82a3f1037fb33670cb27c00093b623ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912ed46f8,0x7ff912ed4708,0x7ff912ed4718
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12649771739606894361,9839493365777765178,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8e059d900dc4fc083254f444b1784b63

SHA1
0d10347714033bd18a4401efa9c41da2368d7152

SHA256
5e72b0f7c84da47f53c6f09240615f6fffdc80589201d1ecd906c0b00de8af94

SHA512
95a153f3b810e245973a1bc03827237ed2d9e133c440e8899e34e60d08bd92907031c9c3710b34cdf0a32e9f272ceb5a446fd24aeba82c3aa0818163320d9126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f39a7a04f2c0a80d53a1a3ffc4c8e29f

SHA1
b4524ae1d693cdee22a508690dffe44d6ed14d54

SHA256
624746ef74eb0fc92fc0561598909b8ca8fa19dabefc4418094e4684c50f7636

SHA512
242c741a827c24a5435bbbe34f55bd6bb6a7d6142e504a7ca15cd0ebe06b94b62d7ff7c781a4a6fd0bcf54e47661dcaaa57129b4b6f32e3b1c6d8b14ff2c9f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
eb84e8827a1cf37ca05ad1edffd7803f

SHA1
05e11f1e37fc3397104ae894f9d4abfc47cbfee3

SHA256
5c162efa67113e3cad7f041ccbf258d1b7f8e6c40684d7d9126b07565c9fa9f6

SHA512
71bc7caab0e08826281699204f3dc7aae1610e9bddd552c5a1eb1a530d79e63ec1a8e4b2c6fcb32e3ddd44fb96a44b46874d68f561b58ffda954f70b38586a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
75d51d4081176f7f3301fe1bbdaf2103

SHA1
731a69d8f32be0b184e5868952ec337a560d57cb

SHA256
853190c86681a055098be8c15693114d415aa0ce04d1f8722608a2647a578217

SHA512
51cfb2627bd6e39165c5784c54e7ae09218a47c73bec30363924aaa5c506618fc288e6af86ebe0b7a8360a60957c6d5c8afc7e801d36652ed85ec2dc8110f2b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
394755b1d5baf8e15886cd586bbd9ee1

SHA1
6281227cb4b5400014fce4ad378f04ed540f50b6

SHA256
3b56129029da6a2826c542f6b7fee92143775853194e103a30dbbe2f36164fcb

SHA512
4edb04b6fceb96e8ade4f1619dbabaa309481be13454738606edb9c3b65691305bc21516055294659eafc28fd7890379f4e68b6d70436aa4cbe3d766b997278b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c1309e47b27c347561213dc492b5360

SHA1
b89a756505ac4a2a817571adcd9b45b86da0c2e4

SHA256
4111385b0af6c5437c1f8b66c826c6c722bfcbed6a80c038adbd2907f6306ab6

SHA512
7897298b70e9864904bc2950e6abda180389bdc2980e2bc1f9a47bdbbe1b4605abafc0a7dcd1a88647114f772bfb160e69eb22158ade2838b0f560738b95adaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
45017ccd87b5e2553b36bd212cb38a81

SHA1
fbf28f1ed0cbea8f685d1037be4ba4ad95d68beb

SHA256
3ba16c44462e471ea779116a283078067ceb1c6ea82b29a7c9e610ab2a7f8998

SHA512
9a21eab4814bbc2ddd5565f39a7d375f39c4381ab029e601d00e88fdadd77c82e3064c95f5fbe7853d3f73f193aaf9d0c663c09335a5296928b3f078f918a8b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81eb61fbffefeebc5fa23baf4500453a

SHA1
c95aab9b680908302d6aeb1f6011a82bdbb51722

SHA256
e68ffc4d337765e62392b07081a53b88ee64bc715df3593afaf85488f8158dee

SHA512
df6996109df41632af39d7c5c3707e6bf176a67552478b74f0772c135a1ff8a1653c45c83d4cd7279fee20eefb6c248750a01cb0384886a3f22b271b21676592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e32bdd72b8d1be541cf3054b28fab71a

SHA1
b872023a2ab51150914ac6f6e29142b8c120ff75

SHA256
e668a394498ebe904354f4c9d1432b92a5d667cd88acd9d4ce5e7142b233782d

SHA512
2fc84d11f08ef7c1c4c6dcd2f9e6b09443334d279fab561ba74c69317bacf64d7955c277024e424b573b5b522872af036e6fa577596c546b77f7ad6a0f27defa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
785e4b8b80f6e4dddfb77bb00b7ffd8a

SHA1
152d98f436a4653aaf8c8312367373de902ad000

SHA256
1a5df70ee23f17380e62f1b6bfa0a427cbc2ba31121d156fcf7b939d9cc9b97e

SHA512
b9f5d2f54c13a9700eda70502e493da13ba43726afd0e3b3b7f746b2f0f6f5c4e0b90ef665ecc5d2101cfd53d385eb2011824e67ba8104a1965258d82debdd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589fd5.TMP

Filesize
370B

MD5
b5193575098207c105800ec62ee323ad

SHA1
e8d6976b5ca3c00783d0b952960b303daf3f7ad7

SHA256
986c4d4f7b17df6d2d5647333a63a1ad7d6ea59306b227aa587a774986597ca7

SHA512
6266c57abd07e766e775b24339bf576bcc2027402b3ecca968afc6d3b8b5c1a6014cc251c4e5ecf9372c2910bcfb3dff0f71150c7cc5b133f276419b5b198937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2ff09143d7255fc913a9601f4b42ba9b

SHA1
430332deca3c509fe4c7cc4bc0e3b67f9292c680

SHA256
75eb5adf0bf75a4941655ea69c3244896adb36fd25da20e5889d1757422d9530

SHA512
cd6a2b413637e06f60bfbab571fbd3f6bbd0e3bf3750e7e534542c3c99122e786f2d6e17fdd9468128103aa15ad8d515dc99f6ea0587bdfe72a9579488215872

Download Submit