9b2f1b114484a645ca073a81bea29801cfd67df59a0ec94ce6ebb0a102cef492

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95ed11fd121b3259f9cf293954615057_JaffaCakes118.html
Size

54KB
MD5

95ed11fd121b3259f9cf293954615057
SHA1

a211dfcf671e6d674ef06dfa466326548f1922f2
SHA256

9b2f1b114484a645ca073a81bea29801cfd67df59a0ec94ce6ebb0a102cef492
SHA512

e841a64abb6926f871b1eb09f04200724acf94ca94c6f71f8a60af21fc8489cc25882468a3f0a39986da8c282be77ae32f1acaaf0c6734f3074c6118b0a7caa9
SSDEEP

1536:7mvXvVysKoD7+dnui8ksbqua2taSaxpVdjbF/9F9eG3ihwsUU:qf2Dsu3EaS6FiUU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
1480	msedge.exe
1480	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2820	1480	msedge.exe	83
PID 1480 wrote to memory of 2820	1480	msedge.exe	83
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2068	1480	msedge.exe	84
PID 1480 wrote to memory of 2020	1480	msedge.exe	85
PID 1480 wrote to memory of 2020	1480	msedge.exe	85
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86
PID 1480 wrote to memory of 2536	1480	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\95ed11fd121b3259f9cf293954615057_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6dc846f8,0x7fff6dc84708,0x7fff6dc84718
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7293984254126336583,13784941141617890628,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
195a6649da2efb432a9ffbc9f5109f51

SHA1
a8d2ad51c75124b4901c60f02b9e0b829e132cbc

SHA256
dfa4b8c8e14d9f83c19970283c144902f2acb809e0e64da69bfa91a0c42847ed

SHA512
ac5d12c2b43166c554603e44caf0b6b7b93a59e53ce064504575dc697bccc01662f1c408bb145af8d206401a45c83479c687db9051a02b0dd40511926e540fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
11a8fb7d2d8c9cab81eb5a0193223a0f

SHA1
8497adb165f711de692b04baae8b1489150106cc

SHA256
cbe2b1bc97825a14f8cf98d234cce4017caa140797a1cac26e08d6fdf984142a

SHA512
cc2c8f060baaacc54f89daf9c33c084d75f6e7c0d6d81eff3cb9539382a22354f599050727d771b15769e084c2454d794f27273bb6738d1979ada65e2e2ef70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85b08297a2638f440dfdfda880a07bad

SHA1
707f4de8ed1572fc79ab6bca5b7afe3c01a0be84

SHA256
9f5bd85057b575cfdf981067da2e9c2300079d8c7ed652dca0f618b5f55b2e44

SHA512
b84dd796b83a24d3e457696f2c77d0d0e7822cdf6686d43bf8e01158b4a5ac40b2372e74c7de1e3f04d7ae9b9b84929bf681ccbce542414e96595d305ab535d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6aeb22cf017838096833bddcab7da56c

SHA1
c13849be9395b05713d5c178f51766053fffeeae

SHA256
f9661cd8e2fe93a49d8798e01d6cf4871cb3bfb7b2e4d61eec9c248218a2be54

SHA512
6c4ccb9cb786090cecd55cd40f9a59eb9034991eb96f699fab3526854eb905478a271de8c95fcf4d2f1d1c948e504a3566cd6819ad9813ba225d804b849ace69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ab4c401c975bb2c9aa98598de6a7dc8

SHA1
a1d7cf06a865b4a550495b402791f578566a23ac

SHA256
6a9fc0bebc73584554a2214d2fa837666086687265740121d296a63cfed66fed

SHA512
6b9b39911161efefe8248ea2b36dd63886a1fd03b3ef966d849dbf26f41d423ad475b143bdb927f9ee3f566d569d373bcbd65f6819a824a8cae3d365c6e3a922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21ad8936d738e6ae032b151e9ffb3410

SHA1
2777758c8da394a4c5965be6aa2749043289ac74

SHA256
cfad93fc8b3b443b4d4f31a9c5365bbded31a1f0caa5e716dfa124138fce149b

SHA512
2b65ddda0c6a62c7a5fad8aecb245370fdbcc604483b901c2e757f01872607a97df5a75def87126d3dd5b7e91014aecd9f8dece2f9aa16167d21b0b48104d96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c6da.TMP

Filesize
707B

MD5
9183751589708da8be9a547bfd0ba855

SHA1
52aece9549a2afc21ebfdf5e48c85186b7adf52f

SHA256
9b8eec771805efcace36d191034ccac764f11b79e344a7126437eddd905c3d52

SHA512
6a8c3d7e2e8bf754ffcff51b2f00d02652739ead60df122afc03994f1c4bd0c55f1bbdeb1982a2f78ab3e873655c4ada96c9f9e5e55a867e19577ec2bff54162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6c2e5121826549b3b51dc408b16770b

SHA1
7654d0299032fea42dc2ac90ab89d4d88a92fa4a

SHA256
231b248cc7edad7efaa5d2d5295bb5fe8646a905dce0fab92dec9b061d185e03

SHA512
7704911696efecc9fb4269552ffa216e7250d648ddf664853b9c14cb66ecc4591bb55de5aa990ac6c0648d36ba77dd0bb0dce34a9ad82791c17709f3a6c1a895

Download Submit