9328279e759ec9b3106b9b117c734ca0b6587fa1dbe2a2c104f3622037ae11d8

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9268a81e8ac51478ae786210a46055cd_JaffaCakes118.html
Size

157KB
MD5

9268a81e8ac51478ae786210a46055cd
SHA1

25b065643fbb0eefc80785157e0536db0137ec5b
SHA256

9328279e759ec9b3106b9b117c734ca0b6587fa1dbe2a2c104f3622037ae11d8
SHA512

4cfb42ad7a2586ed85c0c21be012caf8e7e6697ce4c483d21996743e505bd002ac891c7f001684943528136685e0e91539d31195c033495d2e357401fd9d2336
SSDEEP

3072:jIylBZeCzqrN6uztDRQBmLUhNYWtfIbromZ98aO1KCk1tCxX1u:rlBZFdsLMNWZ/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1624	msedge.exe
1624	msedge.exe
4152	identity_helper.exe
4152	identity_helper.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 652	1624	msedge.exe	81
PID 1624 wrote to memory of 652	1624	msedge.exe	81
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 976	1624	msedge.exe	82
PID 1624 wrote to memory of 1392	1624	msedge.exe	83
PID 1624 wrote to memory of 1392	1624	msedge.exe	83
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84
PID 1624 wrote to memory of 452	1624	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9268a81e8ac51478ae786210a46055cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeec7246f8,0x7ffeec724708,0x7ffeec724718
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11886333191940027523,15586394716051710467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
553adda423b1142f6642870c3e58d6c6

SHA1
ca43219549b6ecb8909691ece91019fb32ef9f83

SHA256
574e370495aea8450540906d19af99378854ffd72218b21081d86b922c8ec382

SHA512
975858438192c287ceca09d1b86800688e99ced6088aa0ad7d6aa3f978b8ee1598aeba12adb8b245f0ae7400af22eb3dc623c5b341089bdea5d0a1a8c00d9608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
fdab5f654a72fc5eb9a770ad1084d2ee

SHA1
3856462cc04d3ed6d222c816820c99782e739aec

SHA256
4927d952aadd897090afab33cecbd904537fe47ce567ee713a5ebc533f0d5701

SHA512
8f6a49c6b7eb4df76eb8ddb6e2f81b235e3101baf34da6f66d394f66852118d73c43de58f8d3c6ce541a2d99b95442f00e19b5741aadcaa27d1425fece5fb33a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7bb9efd3d95d6a8d7751723cb8d86cf5

SHA1
a5d3dbd16009071bad73043b5770e86100f75174

SHA256
7f723e29737aef37afdbc507c1c5d8432e113e6127e4945feb1a7a5c636e6f50

SHA512
66f7a7b9b3f715379406e7e6128414490b178bbbed5ed7a82d5845cff61e08bd0d9fe0ffdfa1e22400c1bd735d85c87224b35b4758b95cdc5ccacfbb8572c2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13a54bfd2fc96d43a6c88eadeb085cc8

SHA1
2338f0bb6b727b12ba8a4f89e9ceed63da8968bd

SHA256
ae2efdd816cfd443462820361a0b8d1a3b9f91f6ce078598808ef81627e64d73

SHA512
2cbec2551c1089a68f855b6172ab227b8f9ca40780d27b73c1372e05846503b5e2a5e2af4530e7df632b03ec446843c69edd667fd009cec8e01e7d6259c8837d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56947762b3557a1113919a6f7309f2e2

SHA1
6f306da352354446a59ccd6ba3ee42ca051023f2

SHA256
1d3b2fb71515977d55c7cc62ff2add9e451ba34203d0e1b81df44f6542365621

SHA512
519f376837ff4630d7867434d2479f5bd6474b697ed185ede2bbe11512170d7aaa1e190cd2fe33b7779093ea4446dec985c8e89c32da2481458ea740b532e481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdab7436b522bd1a39ee35cd6f492f0f

SHA1
d00c6a15196e6cbd269f068f3ee8de8017be082c

SHA256
4f93e170341d6a8a29178f1a65e69bc17e3a46ea8e356f7395c96b429480dc70

SHA512
1d44d211534f0a7cd30291038ffe0bdbc53d6c9090bf1cbca220776b3e3fa0fda8658b056cba4de892973a4590e2a3e69f93c21ee24ea544094872aaef34e091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f6f2d456c097d01d0386a460a4726f3f

SHA1
a7ea8cd65113726755a2e1418995eee9ee482784

SHA256
b0fdd8067f68b7f4e7c39e357d3897fc26efdb7582aca57aa19fd061b786c02d

SHA512
50f88accc13a75cadc10066c2301a4f98bd826d0b61ca55d8a89b9df68854560007a106a567ee2052a15d1a7c4c9f8882670105c3f513478921fd2caa3b1935c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47aea1a22ed6638411edd067e60ee310

SHA1
a0e8eb36072416cb62496c6bc872931468d5098d

SHA256
f0ddf98abd1b12ffae77261758fb4ed21b88b4c11de506ffaf33f76979b465db

SHA512
45abb8e130c2013279619863940aac243c1fad1cc18a0e869d9fb4d2bae722f6cccc83454fb80c8eadd1e143d77e614d4090d80b5ae9af5d0c3bab4e2eac998e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f657321d674266b1239ed3a6ed360c77

SHA1
b35c705d208618629e1bbca7b6a75195794b06a2

SHA256
094598febd31cdc10b29dc5850ea07a176b2083c957791091b41fe937fac861c

SHA512
d6bf252ceead065ece6bcfeb3b0789a64feacad71833d48e89d965a9eeade62b4525e2c07dad7d6243b98ce7fc43e07101f5bfa838fb874c8744ea5592b1abb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b92e.TMP

Filesize
705B

MD5
cb1b15f4fc9311e825dc2df74fff641f

SHA1
baae81fc0e439552e547fcacd1a0c52ed034c8f7

SHA256
8a3dba38a2e2ab8ca26d0fbed51eaf0f7998980fb669da59026e6b8cb33dfaba

SHA512
81e5b4b7922eea5cc49ef5a83839e6bed6d2d6f28ac42b079cdb22e634cb66ac12186476222c79bbe7785fb2b86428ae62999d7792fb2d7fb3abcbafafe0840d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
273ffba0efabb2379e1b84ba891d8895

SHA1
961bec2035d8e4319a15103dc8744b7060451490

SHA256
716f29761a41faf1f9e74485400e7255f9c025f365615429eb0d8d2254cc2046

SHA512
0eae57819eda9ce90ac2f3296753efe394bf71cc321c01faee3efbcb1fcaccf76af7da0289dc7d94475a183331d735f6e2b45065fc79a8ec0e11104eb0f07130

Download Submit