020b41bd3e4b1d991facea3956f5b4b0d4e811a595e8e2d9ec65c130dec90591

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90e670b8f8f5766ad0c8874e83fd2fb1_JaffaCakes118.html
Size

304KB
MD5

90e670b8f8f5766ad0c8874e83fd2fb1
SHA1

7d399e516789394e03f96dae48a786ab2369d7e1
SHA256

020b41bd3e4b1d991facea3956f5b4b0d4e811a595e8e2d9ec65c130dec90591
SHA512

4568ffa6ca22add312a3d77944d4a94e76aa09fccacdcdd49a8cc7560331d3ec8b0879661017df1b43308ff8b9df88d7dc7ffa53a39aab42859b1c5e6d6d4d79
SSDEEP

1536:nD+SbTTF1SjT7ZNkltM/jVII3IbIre08/OmJ6ovLJLnvnt9d+d13l9dE6RCL5gFQ:D+SbTTFeZItCVI2WpMcDiTCH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
1392	msedge.exe
1392	msedge.exe
1784	identity_helper.exe
1784	identity_helper.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3664	1392	msedge.exe	82
PID 1392 wrote to memory of 3664	1392	msedge.exe	82
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 5072	1392	msedge.exe	83
PID 1392 wrote to memory of 2656	1392	msedge.exe	84
PID 1392 wrote to memory of 2656	1392	msedge.exe	84
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85
PID 1392 wrote to memory of 3712	1392	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\90e670b8f8f5766ad0c8874e83fd2fb1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99ca746f8,0x7ff99ca74708,0x7ff99ca74718
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14080143558544534712,3997018601746753367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a6dd2b9f5dc89cb2f695f2ca769dbf70

SHA1
23484a2b17c2b9e98552cd17e262ec7f5dbab5ec

SHA256
f006f77b9322df4e81ec91f0eb1512839d7047f3bbb991420225fb9f88bd43de

SHA512
b0d2091e284290dd09b29e75c673ec5cdacd0132859c3572bd7d155dbe38dec8b40466e318428010358e533644bb8f2a073c467c102470b0a4d63b335ee24534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
167df57f0284cbac3e7c3833ebac5367

SHA1
1be01f025da3d1f39fdde80a4ebc1db1319afe60

SHA256
7c50220daa051470173a1d8b08cae3dea50a4d825afcd8cc026c884ca1d8aad5

SHA512
034e8736a45ef2f85c55a2ba632ae134a295fa47ef1f0e7bc70229fe209be3379b986a2b707f7d1bf39da4758b26a03b19f1f442bed5c9cb1c39981b55bb5256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
83afcaf749ceaeb0620c8540431220a0

SHA1
ad7b4e493434468c4e4d5a24b529430e1490c22b

SHA256
ff9527fa0fe8a900fc03832b6f8bbacf90aa69d761c11e4ac90aa3d11a5c51d3

SHA512
2a83d1c4620748f6444811142d62ac01218b75898de40cc975816ee21f60bd874c787f4f6eacc0c0611ce566f1a7cd806f8e2b4fb461015892cf722fc1210dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4c7a606e1346999c2de85949153f626

SHA1
71e07103ac2ca65a6e281f5194060822648fe761

SHA256
b3e7e1685b0db9a925047b283bbf72fd834a775960631942985d3775494255d0

SHA512
c2c917331c2b57074180aace8060acf694c521ebbaf8de6cab310f17b385a605e81abf1bd1bf8c0b412cc82298eeec3db9dad10fff199760626709921ac0e483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37474770fff8fdc226eace8457cea5e9

SHA1
fe914a7df99da96f6a6cf96159d490b3e06d9e13

SHA256
a42c4109ffee594d8890eabf880d888eb6248772232304516875073cb6399e55

SHA512
b9035fa79fd3ee60f7c08fb08c07d86b291ca83162bcb25cc00b674141a8eeef5603d5466cfd75683e64a0e1addf6b3fadb9e74441c502c19b3c02d4759eb013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b1f22f71ea17c0bfe87f0f4e7c2d5ed

SHA1
a67cd7e47fe3d84c129be85de6adbf7d2cc75dfd

SHA256
ff914bc7a92d58d65b5be381c6806a64c09e5b95f9aa918bcdb777292f6fd723

SHA512
a41867f79a8c988e2a28a0c665df53bfc8719fabfb9f89a93ad6e48a5c652fa95cb549eb662d0fe99137695efa39b00e38ebe12885a2a12501b26ab07ca32ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc628cdd5a67b9a0f578d2fbab0480e5

SHA1
dade47c41d3b93641cfcdef9e24ed0b2ae52e322

SHA256
320539c48b18891c869c8fd2a7a2472599a10614718a525b1d74e92ff7af6e82

SHA512
d58daaa2c4303aaed4081f40579cd4df131e41f3dc2cdf4f1edcccebfbbb78979b93586d95da9d63b2b820aa4a605ecf94d151d4b876377db7571add5f7ae676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
700B

MD5
bcf61beed888b5d5f56a55deb8365752

SHA1
de33fb1b60ccf3252a65185de01ea1d4f7552d32

SHA256
8051425db5617b02564c3f18b35eb1ec5bd7f37e704941078861b4701c105f8c

SHA512
f22d82bfad44381becfb8b45523aaa5284a9e7a26b400f7be2fabd5d09a1c903915b79108649d67e288fce0f64fb027232047945c115ae37613ff133396848bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bfc6.TMP

Filesize
201B

MD5
c779e0ec9fe1f2035222af87c3502323

SHA1
f22c127d9cbe9db6e9ef31c650ae9ade572e77d1

SHA256
0f4f9fa6638fe6d0ca23a4ddc4eae27adf4c06dad27cdf413a921d915e682be4

SHA512
e391b15f927271adb8af4d8bf3e1a683f04a24d2ea9037b1655186c598ed3a639f0000b8192e22f3674c613da9ed75b9062ef09d992a7fcec09fd0811dcd93c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6c9f8578acee4a427ea043a10cb13d3

SHA1
f5ad3e250f68fe8d13cbf779396b4c8857f2dd58

SHA256
43483a06278e8f3ad17dbdaf2fcb0f1f20d62a719ef11190494982b2fc0f0bd6

SHA512
3c085ad07f5352b2e2667fe1b30b9d99fb7cc5d96f68c4a9b82c76d3786077bca788f418de2c06e186fb4fdefba3851c3f0448e7306efc824327d70765f99057

Download Submit