a6c867bd5d579e569518014675fc10fe0f7dd097ca138931387f2139e4aa3986

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9769a4d753e4945aba835a851ec50184_JaffaCakes118.html
Size

58KB
MD5

9769a4d753e4945aba835a851ec50184
SHA1

ff53943a9ba728453d84f6bc71747dbcdb95eb68
SHA256

a6c867bd5d579e569518014675fc10fe0f7dd097ca138931387f2139e4aa3986
SHA512

5d542563dc943e44e5992a5bc736c240c7944fcb3db76b01357a200016955f35fa4d8afb55fa02fc7a4f44de1a26c4440b1297ae65b7db88ea6db420fbcf5d66
SSDEEP

768:Pacp2X7xJnV55fF1iUYbpi/+PJCbu3WkBee1reslIQzg29la:Cc4XVZ1iUYbpiM3WkBeelese+G

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
540	msedge.exe
540	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2468	540	msedge.exe	86
PID 540 wrote to memory of 2468	540	msedge.exe	86
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 4604	540	msedge.exe	87
PID 540 wrote to memory of 3684	540	msedge.exe	88
PID 540 wrote to memory of 3684	540	msedge.exe	88
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89
PID 540 wrote to memory of 4424	540	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9769a4d753e4945aba835a851ec50184_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6127557617526731181,7431680386263184743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9088ee65269b6c13abbb961b032cbcad

SHA1
4e871fba4c3873d37e01f146967c94632aa132d8

SHA256
9534c3f0b06d6d34ed8fd4cbc05aa6898cc967e2354c21536bebf8d3285c1622

SHA512
88b8f76e3c73f00e8bc1cb97de7bfcfebd615a72e46c547e410074614c58bff24dbf944cfdf44d862ff5ad5b40fc76cfe5602f61891f51f1b72b96b749888c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
72803232a63b6396afc76e2eef3ad543

SHA1
fe24b202e860e50a6c0e48f5cdc37686616f5671

SHA256
8ac76696c6d133134dab074ac26abe0a956b88bdbb269598c0a312175a300434

SHA512
8547c87de59cf890fc46483307a1658182cb32ba4644f984c4b0bbccd12c1e92ebc9fcbda180cc18e5834c321ebd5a03ebd3a90156fe91136e40c5d9da09754c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
42cb2ea5d5d843c3faf787fef8da90eb

SHA1
d7de7aa17e91270ca396a6c63fbffe1862f0dd5a

SHA256
92c3c904f72eb551b3c3e190430c85a6c9f7c20db39328f347ad5d097d459a6d

SHA512
dcffcb91df1ccc9a378f89faaef31a413554ca1707a3400d37e34b8261ece18b91319bbefb82502e84ef72268a6432c1bb52119bb29e156937f13271b486f207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
96876d4132e0841687fde2fd96c5b1d4

SHA1
79e4ca0408d6ab854c2e1b4d3222bb53e1d9c408

SHA256
456acaf56afcae92a96f8f950847909499cde921b3c55e380e5ae85640e9da01

SHA512
1453843e4ee7dd789d4261271c0f6df574bcf535b5101a353148397d89642ddc2d398bc6dc425f313fa73522670c37e9369f2f32a1050ed9605a40134992a206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
297db3b1d50227eaa33d631f4e50195a

SHA1
ae61eb1031cc3b36d86f275637f57a15da4aa22f

SHA256
cfbaf14a4dd26c919a72687fd0d57e8eb3d79498f586c7018d4f35aa341aa331

SHA512
ec666923a29746faa916ee7a3bcd8486fa88bec584a96b2c40ffaf50de4342390d00b5971d230e99dc466e8c63d69e7f4b0dd5558b6bc8418fac23d067649348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dca7b87278f83f3130be422f856b4c0b

SHA1
b5f3f82111400b991f02228bf19404df8195df4f

SHA256
6a4c48bd1907383f5a038e3aa7383fa561e73042d6a26bf8c1d9d53f5a298601

SHA512
746c76dd1a274b777e56fc7f6e69f1f94e7ebd9eb55a7031972e5720ac1234a2c0fb82a2a6721122792aca87459505807a2bd3a2b43cf293ebc546e566e3856c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8fe3190b1feafa6faa9dff8fc288195f

SHA1
280b0a97f2e2c2182e8f5df1e785cf5884c21d5e

SHA256
6e5d0c643cb801659e75751b85f11fc554d127c27d194907eed746d3e7d940dd

SHA512
c14617df302f05dd5569f8e312aecec66289dcec866aa3ba9238a2fdd8ede05a26ef8cf65510b3988139f82cb2c73ba15399d44abe7015fbd2e016ba349d0221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5a3f48274ad239b36184e495593f42e

SHA1
237f2784d80e81cc689b9b8d70475cf2877682bc

SHA256
f90b4838b358a99beb408900db761b1f39defe1b9a714b7392d0037507b1a5d9

SHA512
98b29fa3a16274c612107e0b4419368f9799221927ad1b9bdc098a85c095ebdb9f64adde1ab83e1314c8370bada8313d24d06e25643979bea8d325cc0e8546ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d31941c5fe1c5d207bad7720ff4b788a

SHA1
aa04e0272818e15c9e5ecd72d34ef15769ba8647

SHA256
575a358ec12df95e386a0f89207835d60058d8dc28c0d4441fd2aad2068a259b

SHA512
05cd038e991db97d33fc56588beb11c85bf2e9285e016c5ca09549dd14855f73e9b05b70d648d9d2b653d691cd865ca5005fa8a09e7f00ebc5c63cc3b22d3ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
18bc7d9ac8657b641e463cca15ef12f3

SHA1
ed309626754c2c73c1be5d111db500c4ad35c5d1

SHA256
81bcaab02fe80d4536820f2f0e8d60158b52a9b20db472ae0feef1937894730e

SHA512
09211309259f6c7b598333b4e4be8e73a0d52894cd51f8bb6d7fbf1ce53b15b2c1146b5d048e98ff438444fae0f2979179662d36ce9493af4d5bf1461e8986bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583014.TMP

Filesize
204B

MD5
c12922e7b74c05a19868e9005a127852

SHA1
fda3440ba3c53abcd80f03a751dd926aa6f97bcd

SHA256
8af1d456b9e940e2679e873a91816c02b6261a125bc566af0831667b8c652366

SHA512
188efb1439861a0af620e4e8b2c993281fea2c567fc0c59e72bfa8eef348b55347bde40a7f0201241cc875dd2cae8279896db57dd9dea572a4ad354e9b2fc1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
19108432e858b1cc2086c75e95a1e1fb

SHA1
021b3d9161ac24bacbbd44515405e1571fa8f055

SHA256
6c26c1b34507d3bc493008e3252d10f0524d6819b593dccbfa255267cb5cb4d7

SHA512
90a6f50552ac78e05af7c3ffd26f54e13069ad3ab41ddc32e98ec0224d9196833750c33bab092719d3574b8261160dfe3001df7bf7b41dee6161df3af040e1ec

Download Submit