2963f5900343e76bc8630e4d7f507197071adf3f054dbb90ed3ac5079d041d84

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85ab2f230ce349c9ea0a686429731ad8_JaffaCakes118.html
Size

36KB
MD5

85ab2f230ce349c9ea0a686429731ad8
SHA1

2f2f0c4914f8f88ce4721e9582c4869e39679c52
SHA256

2963f5900343e76bc8630e4d7f507197071adf3f054dbb90ed3ac5079d041d84
SHA512

30525e7fd21696e9c360d9dda4ef5aecd209635748fec6983f286b1c6c02e62b5758e00d3e6e13be0d40d1e879fe95fc930b9d379618514f8a01317651d34169
SSDEEP

768:aSxI4YLqYDe//t+AUaYU6PcA2yEa+i0pE9cS+Q+tkoQ5bvb7UnXCrukV115Pqn3Z:aSxI4YLqYDe//t+AUaYU6PcA2yEa+i0B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
2252	msedge.exe
2252	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4036	2252	msedge.exe	81
PID 2252 wrote to memory of 4036	2252	msedge.exe	81
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4124	2252	msedge.exe	82
PID 2252 wrote to memory of 4500	2252	msedge.exe	83
PID 2252 wrote to memory of 4500	2252	msedge.exe	83
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84
PID 2252 wrote to memory of 4308	2252	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85ab2f230ce349c9ea0a686429731ad8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6f0146f8,0x7ffc6f014708,0x7ffc6f014718
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12852572345345735287,15841940780710050396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
3ee9790cff9e716fffb462c09762d7e5

SHA1
2d83df7b7e2e3f3c13a67e63b1bf4d6b801e3338

SHA256
cdeb23e8bf48535412c51986f5ee9eda9a705437a153277d4e379ed90977cc1b

SHA512
71e837dc81f6fd5caff8fc54d0c782a1ac1eccbc2a7594e5868bd8d7f7f61ebf967339d940b79892ce5d2e64bee31c6d9bc0f774b0b22ff77d4ad14a705d312e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
3d718b91a77800118c487f4e66560058

SHA1
b007fd0e8d195f225af9e45d8f77e02afbb25f0b

SHA256
0ac5b38e03feed328a87a18c21847d671e598c3987b7d2340d7537f8ef2e2bb4

SHA512
5e8455be2256de7953e9eab30fc3671f929970064cb78e3fafab3063d36a7207ad8f8bc06e9089edd1f13e697f07999bf808a834dd44d103f18531a74d1d12f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
734B

MD5
d3b0896b16353dbb20115158cc14a10d

SHA1
7b86ffcda875d2384e82b8f8a08a835d882d16b5

SHA256
5ea1ac91d9982c6483c66ff49d7dbd1007e491cb28de8dd2f721cf2057a2bf6e

SHA512
9a3b058a9b6f58332dccffa5a179faedd76065f77e38da31194d4f86038479ed5a05f6f89a8e8577cead86d5f08f5ff834b23d51348fb927d16dcc635531d25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b18c8b94d8c8cc0e4608097eca03d780

SHA1
131e98e6b2f40d0f9a667eac0796d396b0317945

SHA256
f048749b0ce7f031fed879c98a6bed20aae4ca72ca27c89889591b22e79b6d40

SHA512
aa05da2a6ebd04631fec11a77504d3b868f2ad24189ba4643b0979ce75cfc1a6b404fcb2554c7dabc478a71b339fac840fde72aa56506ab7ea4b2bd0fe4104e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2417d8ef8684bc96dfcaeaaa6a3f7e39

SHA1
1ce19ceb7c1bb1e8a8122b5951c53315db0b12fe

SHA256
a72cf7c58dfc658868e808a1db3eb2356772c74d34fc2a4dc99d18a6f3e42524

SHA512
5acc19a09ff889f9197578951a99fe5e43135e6892a140c81de05978799f32c47b17b6f21a1aaa4b64191aef51df6b99e7e745c0510730c821ef8c258856b7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a22e9370cb3981f64cd9a58ff4750d0

SHA1
8cb82ad0139c84be811f276efcf877fd7729d0c5

SHA256
ef1f070531bcbcdd791a17ce94d2367bf81ae9d9c58ef674ca58001478a19910

SHA512
1a5c636e1554eb4344a207e39b285659c5858e67161bef493b73a1474b82fd96f10ef44820b8977bdeef945e3f1a7e85c469da09999754ec9387eb758fae10c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
10e7e806323c728406123955483225d9

SHA1
0651c42bf8ea2864b8eb302f81b1ccae1e5b667a

SHA256
64684519b47d351a968baa80d1be6a500ebae8e8d951cc92b3f38a30d5f8b546

SHA512
9408c69de82a2ddfe2c0fc8bbae236ac9307f37d45fd22a237424c571c57fa06aaf8207cedf911ee5125ae2667c43798d82ab789327e6ceef2313baedc7430f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a9670731cc97b7519f39853b4cd29c6

SHA1
69653cca2ac8613789bd3d7d4830d3375f89a68f

SHA256
daf02d769639343be6852f8d1fe6513b56aac1a4525b6ccfd19c94f510d56ca5

SHA512
16e54ecfbfc7afbff6808f1f54c8605be35a88accd33b5dab4d7880d7c137cb5018f64ab148343871efbe4b896eed00ef640f0b3fc1d0c5b073a2ebacd5d8ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
344b849848eefd4d6ad5e5f6178b8b5a

SHA1
cd8fc87448f9e51c0064d4b5f551d0fbe1cb7ba3

SHA256
1a3b0c5180ac53365d87847452ec1c5e235937758f4dccb1f1a84a5bbe140add

SHA512
1d66d494766268a1253fbcf934389e19c210e1abd9ddb6217e6a5913715406876a170093c9af0156bdcd566476bd9b3c159b42bb16828d11d9d036f6d30a9543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
2c6f6a8e49adb0d874a72a021809e842

SHA1
beb8a6531235d8b35aeca07e9cf8a6677ba5d4e5

SHA256
0b8f29b4cf3c404f1a04f4da83a3a88f06ab6a9ec4eecc4f0ed84d22b59e13a7

SHA512
262ddad252b7f6175c9315ee32e0467644313b6cabcdef0699092d6b0b0cef064c7f6950f50a4ff791266bcbc026d9c7b3f6203b4531b5055572a199c0b4fa3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a78.TMP

Filesize
203B

MD5
d64a67888295dc695c9de82f39e4468c

SHA1
aa775717591043e5438a44428e19cb08d120ea30

SHA256
f1ba04aa8743b0db33e96302dc5a0336f746d9a102154a175a4eb8ab09dc1fd5

SHA512
5d6c4e9923ab33aa2c7097ba4829db9e99b0d69e719316d758480d6ac4a00372db9d341a7ade643e45fbaf896643d9d48cb82b9308959bccb5d8cad24bf6d8a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af45def32a4af840b08beb782f017bab

SHA1
9ecb90d99ed8096f7a662b17601ade26e9fcd1cc

SHA256
f75ac2eccce77b6be6e321f110d8a81f64abe956b8a3dee1107a7c39c6325a85

SHA512
8da54890d3c77638a852dd0d4a5c5bb90ec3bf46cd19d9b07aa01dcf70d6a99d94bb705aa9fa987a6b85763f618409748edec65a4f46a70ffae98ee7fa561a5e

Download Submit