9f35661a0f355354d2a5ae383c7b9efedda18db512f0fdb72f4003dafcadb04c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8776246eb67a0b773366d57430a8f8ec_JaffaCakes118.html
Size

9KB
MD5

8776246eb67a0b773366d57430a8f8ec
SHA1

52eeac4b926032f7b61090fde6593745a7043d61
SHA256

9f35661a0f355354d2a5ae383c7b9efedda18db512f0fdb72f4003dafcadb04c
SHA512

6140595ac6b282aff12061d2328fca2d99fca7ea4553589e4b603fd799e705ea406bef4b35f187afccdd08621bb9f2cd860f81c5772cfadfebb6ee9c1569eafa
SSDEEP

192:ZNafZgCAKHNafZgCAKVMOCdUjJ0sAi0pZB0SdxloKp4w8Hn9H+KKKZKhHe8whwLH:im6Mm6iVdUjGBj/B0oxljdCnh+KKKZK3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3600	msedge.exe
3600	msedge.exe
4760	identity_helper.exe
4760	identity_helper.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 452	3600	msedge.exe	82
PID 3600 wrote to memory of 452	3600	msedge.exe	82
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3304	3600	msedge.exe	83
PID 3600 wrote to memory of 3504	3600	msedge.exe	84
PID 3600 wrote to memory of 3504	3600	msedge.exe	84
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85
PID 3600 wrote to memory of 2948	3600	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8776246eb67a0b773366d57430a8f8ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafda846f8,0x7ffafda84708,0x7ffafda84718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,4409827191373620739,6675185640689063335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2c2c35247df62357f25444f01bb1ec6d

SHA1
4f41be9b06356b7ba749e7ef45e686faed13b076

SHA256
d5cd04971d98d29cc1a2daeffd1aca452d5a0ff2c0624ae1e89483f35820cbf4

SHA512
b668d3229a5f93aa7852cca0fbea7ab8a53e919f120efc4a0807b37c83a00eaec6b29b25631978d075db28c2c121c9887a81e64a14ac33d2eef43a90891e4a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ba4f80b6049d693dfcb17999bbe951c4

SHA1
4a1cbf78c23d8224172aba72d4f5df04072c28fe

SHA256
cdeaa5e26b3ec12d6a6cc24b4ae17ae7d4571ad797970c2bee77a30779b01268

SHA512
76b5d5aaff8df56fe4203374548028045d58a1c1afb1d378e18cf3bd78d407df59248bb897d14adabaab6a81176e7064afb8c1dd916d92c16810bd784f120400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
68714e8a8aa5dd1c0547ce666a7dbd89

SHA1
51da3f527fd583a12d320584339b74f0c5d0ce80

SHA256
fd0d907a69015f3df40908e6e45179d3c3c7ee51cbfccc8a367d27565e088beb

SHA512
e9503148b45e8e7217628cf52a586ef85e87606fe387562e733c0bec17f16da543e926b8c4e29e8b17d1e8514bc8666363457d5a45a670732687054b61109d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e82cfb38e89ab5cd6751ebbec23f22c

SHA1
5c35737d0e1b82a07157a02696ff70138105934a

SHA256
318776292cd6a495dbda8f830da073ae9726fdbdbfced356ceb4606397b495a9

SHA512
f4319fb25a968eeabbe9344db7894a96789adbb4a11ff814e6f3048ab9b3da521c1ca5415ee2bcc65650c291961c43fa2dea3849787eb9fc5b929c25e330621d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7ada1713c00b5eb06e29f69b0228168

SHA1
9a30ff016db988c16476db2cb99a6f4cb78a8a7a

SHA256
1f0bf6c349612a4ca589d4f7d246ef9437f3aee165c042922dd8073388f0dcdf

SHA512
d17a16962cc7d3a5d291d0e27a9645cf403009a6b70e630f3c992b5122df47e4677ed833bf5c04a71e559f38f0495af1b9bd367fc6ac15de5cfa10f42c5910f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
514f491db4822836d35eb0f0a6630c16

SHA1
32b7f43c618ad708a92efd8ce6c21a354a8b2347

SHA256
ba52f71356bd194558b91ac78d64885f6ca2565bdb506752819ed65e8ab986ca

SHA512
8a18b0f5da2d14986b91a5cbad1161d67616efd017c5c8643fef7b7e71740e332dbf9410d609055716c601e987be3857aa87adacd1b1797e22bae1f2ff12ac98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
7091af2a1baa002d7244ae4754778a0d

SHA1
8584238f5e5177ccf31797dfa1333d1798236b22

SHA256
abde356f72d4f11e3d55c6f30cab59496c08d44b088e611cb4742f239a168cbb

SHA512
17d200f00dae2f6f870b6a6ceef2b3fc893af9aa844b50d1d792ba826d8c9d91dec8a1df6856702c3dbd6cbd2184b3a283536e8a48f41f4ca3de1c65d3b89565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58587b.TMP

Filesize
539B

MD5
835d6b7c1c35e9b67b58a66131c333be

SHA1
a62020964d0f6b00a615c5695995414f15e2541e

SHA256
33bd7c9f9673b4fd11bb930210996899cb8836d97827498cb9e13767e53f1de5

SHA512
ff7a770d94beef8b48b07e5f8f08470b741a858d3ff168115418c0c41914f4f59e2205d910e83d98a16b2d21c18683bf47de57c7756419b5aa9f2420b7c60cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c666dd67fa763d869cf004b87639f004

SHA1
2bf2f2daf3905c37a70a64ac73661136cdeeb054

SHA256
864e96f89c61fd9cd2cd4666e88568c404dd850af69ebd3248f47e66dad834d5

SHA512
5f2496ddeafc3bc87e6cb9b8a80eae8e33180a752ac079562d242a920deb000e0bd84d3224a0147c1ef8819e2269f053c6907945633a15ccd4e49baeab9df98a

Download Submit