6ac1b5d0d4314fa6d856f94e9092d57aca8070afff716149b3126afff8162e9b

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96355e39a04cb18def20eca765f6c849_JaffaCakes118.html
Size

46KB
MD5

96355e39a04cb18def20eca765f6c849
SHA1

59532ac0c983490525032f1e99320890a63b3c18
SHA256

6ac1b5d0d4314fa6d856f94e9092d57aca8070afff716149b3126afff8162e9b
SHA512

edc072216d2abaa17c146948379f2e907ff65c13684d9be27dc452013b95fa0864d020f1e129b9fde9b1da2994b3a17a2d152a0bbdb2393112b428257dd4a6e4
SSDEEP

768:6DWFPMd/y/wxNK/doCqq6aJwIg3RIKj4I2G1L2q3bartfA29h4vZ:6DqPMd/yB/yCqq6aJy3RXbLf2tfU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
1020	msedge.exe
1020	msedge.exe
4548	identity_helper.exe
4548	identity_helper.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1412	1020	msedge.exe	83
PID 1020 wrote to memory of 1412	1020	msedge.exe	83
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 2876	1020	msedge.exe	84
PID 1020 wrote to memory of 5008	1020	msedge.exe	85
PID 1020 wrote to memory of 5008	1020	msedge.exe	85
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86
PID 1020 wrote to memory of 1664	1020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96355e39a04cb18def20eca765f6c849_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1107121361106068687,13179350495423597463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d51b33e-3147-48ac-a64d-b431b8538403.tmp

Filesize
2KB

MD5
ee986984af2ba7f4978fb991d6fba007

SHA1
8dd4ba265dce054b3616314ce6d1c74620d08da0

SHA256
d955cf7d2cf36fb21e0f7a1f6aeced951a6c74211dcf602c8c44ad311bd3092e

SHA512
23bc9578eb3cfd1d3583a46a6aa20962caba5f3cb257cbbe0eb1df70d2b20f69f3b548538bdca4d648128b74de7e831af9eab28a6c9627129932be20bd652907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
c32383c3afeb0e96e3b227ccc342a552

SHA1
ea91a40550af62bf568066eae886044dd57474f8

SHA256
00d491003687d4fa9df0c1f9ecf9aab878502097ef7d9f752a7ebd30df3a134d

SHA512
1133082c6f063c42156aa00f140b69d980533d68080320c2e56afa7d071c0dbfe0770fc784f319bb6bc990d00c81acbed44fe77d0c92657858810a59356308ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
6feb62ffdfd96e47d791adb05a9bae91

SHA1
3f49a184bbdc405830da3d769dc158f0b6a16ec2

SHA256
ed05f232ae69f48cfa2b955e9d7f43f7fbc1f8e89409491b762b3e646159a84f

SHA512
be2b90466f6c6fd98a4669610788ecbe4010c65075910ae6daf0bb55675dad7dcbeeba3161859d0ce53d6a44e6cafd5aae4740535a1d88037147972fe644d426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
80dd8fd30d23b0ed0d3e75af5313bf63

SHA1
2886b490e47f8376401e015e786d7f66ecf5c140

SHA256
980e6a3872507eb0876ce8170be08cdf8d1bba6b65cd1d254fcefff69e3c8214

SHA512
220a5904fd4e309b30599bd176988476d4b6a84875f137d2a21545a6c285dc233fc062a462c4191d3134e368661ea06b972fcf607308011b455dcfc0aa95b753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58f1e794d287db25dacbf282409e9deb

SHA1
60f9e95cf467a612e3a4bcb159705f7cd6c6b998

SHA256
7bfcfe612c5c8a93421ce2d379d5455c4a25036cac1ae66c76589547ea7ac537

SHA512
177cbc07cd6fab05465fa22663b1e40664c0d5e969be7e5d2c853b672fdceb8d6634ff9049b7d3b2fb1579104cef1af4d57f197aab8bd3df92be87276f20aaa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
affcdd7e6b3905ef5373dbb1c13e6101

SHA1
a2e7035550c0ed57241b8a34484fc1f773cd683e

SHA256
fe368aef711b9f41f0df691ef510a330aa1084ae9a651d826728a340e7ae76df

SHA512
e3dc52ad0a384f3ead530633c7aed5496197d9e717713761626d8fa74832f526c5bf5f00d978c8c2dfb773020c94caae553293dba00e852df79c8f343e728ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
539478f002bbdbd66483232809920f56

SHA1
316689a0d20f5ad54cd614f2cf311c11ba4157fc

SHA256
78f5ec145cea3ac1fe28fe782537d6eef513c3510b524e3122b2470a70761be4

SHA512
50b86ba62aad8a652e940cc0dfaa3f2047f3bf66907290ee5e8f391144bd37a3fe5bb6e5749230abe4f3a521d6a50131b991e7c766d3237e4f147393bd0e7666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92ff8e2afdd761071898a93eff6e281d

SHA1
5675542e41805be1c6e0addd374fc20dfa9ec476

SHA256
3f31063602021a89502b4d9f67b3eae553f86d038d083b6e4426542eeeeea399

SHA512
a076cbd16445977b90b25de681dd04ee102ee47f1a38baf18b85e1c470c6678b41b0da038cc9bcbb57b201b4691cf4b2296d50f52cead224a3bc432f32924de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb3f.TMP

Filesize
1KB

MD5
a81cdd2a9d840f557407a164be6b1d0c

SHA1
0fffbcc426e76b070c50ec9758ea1acea607b23c

SHA256
2f4fa171c227b30267e3e993c3282840d208bb621942ae5bcc35a641f7d9b630

SHA512
da639f9c15e8b4a0a7de08d0d21f13de978dfaeeebd6c051fb71de214d9937b1277b37e12f48d9c461a32745ba2bd73a70980a9091475a68a8773a8e69b9942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
675dd23fdace216333f54699c85218e8

SHA1
33720f9677ba4e0e49cc8c1aac879013e7896630

SHA256
c6c5518828b14ff5549f21438dc601eb4b349b6e3c79c587dee5a3e1db3d0a13

SHA512
04ff941271f635a7c3f3348933866a55a823c5b93a355c2b6f11fd07751b78ce424e1b7b581c3b98d8e24e64d23235dde5c95988b1c737c437792f9096f5c1ab

Download Submit