3878b25a3d5929f7d10d37d4bfe68b3376fc7b33f6829744fa90fac25eb1ce3d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9dab06b61be6b2a35796857f493b1067_JaffaCakes118.html
Size

369KB
MD5

9dab06b61be6b2a35796857f493b1067
SHA1

9c20fa10b3a277f2cc070e82456cfb801bad7ef6
SHA256

3878b25a3d5929f7d10d37d4bfe68b3376fc7b33f6829744fa90fac25eb1ce3d
SHA512

508d7443e25ec0121b464018a139a6a6c25b357d13e5ebe9362d80ce3f62fd3355f54361c46e4568a0eb5f738633c9169f8afe66420aedc157738c85a835456d
SSDEEP

3072:cXRvowEKNtExioSoHIGLhkV9TGAy/ubhag5dz:8RvowEKNtExioSVGlw6cP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
4868	msedge.exe
4868	msedge.exe
4156	identity_helper.exe
4156	identity_helper.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4656	4868	msedge.exe	82
PID 4868 wrote to memory of 4656	4868	msedge.exe	82
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 4612	4868	msedge.exe	83
PID 4868 wrote to memory of 372	4868	msedge.exe	84
PID 4868 wrote to memory of 372	4868	msedge.exe	84
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85
PID 4868 wrote to memory of 3224	4868	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9dab06b61be6b2a35796857f493b1067_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e4f46f8,0x7ffa1e4f4708,0x7ffa1e4f4718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,2165881352707447638,10560709374477195934,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
32ce8bf1d40263a4bcfd3ec125508bbe

SHA1
e20059ec9aad2d8e66fa4b88b845c4c1146d950f

SHA256
a8b833f19c903d724c73e988b54c4ad4295bf5b6c324ef0a65736da0ccd2091e

SHA512
52f578c5a1f43deecc6a93a6c7006988ae577d492723558ee3bf908312e7b8b4920dddf6e711e25c7dee456a3251fc97cc908be50e5cfc026d28179264fbd021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f29d8663f660566d0016b0e77bc6eaaf

SHA1
4ad923e9db018d392f338a27c3ce1ac48d89b765

SHA256
3a67c9b3813ba08e6a2e3492b8a2c359182950a1583a1749e390eaa807e2d34e

SHA512
40da354f57abf339069e5b579d74d96c6a0176c8c430589646b4a7e43445c8593e9e673885cd4337c3757f32206fb71ad636c92361891e1510ebc802a21bab92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e0428f8a32107d066620cb40c46669ea

SHA1
c539e78915e55c1d9800b03877f2a8423a626493

SHA256
1584940e5712cf97e67d529ac3619174754b42d3931ebdf701201c506e338427

SHA512
7047632de1ff3225bdc235e704e1197f63573bd04546825eb19ffd3a1ce80385d3cf1dcef1ebb745058d6a27f2865c2075aa397579014817dd627b1a5f825fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
fddd0966b8b8b1cf500936393c138d8d

SHA1
fb50e2d8a9879742ef3b7968cc6c514c961431e7

SHA256
5ae740641df9a792f6cb73286ef7329a83232653c1c2df64dbc67d9e8a5b8384

SHA512
ca72b87cb1de6de2e8b2775167f1b55be994d98d0a7cc12a831e99ef918fc92c9767193114738ec984ea5006da79e34b9e7fb21ea34f33d59f56aaf5d6065741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03b94517759f6298cb7c744b1fd329cd

SHA1
b5d044a778d195fa7e562bade891cdfdc70be4e1

SHA256
b0398f74ce52d1371f71fd8ba1dcfd75d1bb61b85268028f16f1530bc319645b

SHA512
882018fcf56e88290fc10f26ee977ac0a50cbff8a9ab7154d725e7f35f7086f601897aecae9361cea86354979eaa998ff91c6d19707fc92042b4734053cc4d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4dfdfad5119f772d784c8baa4247cc5a

SHA1
a4043013bd0a68d125eeb77a09f7d15e328c8f1d

SHA256
0e842f45a3974a3bbbaa967971f0872d26a931446c6c92cfa439778fc09d547c

SHA512
cbe957ea9ea8b7a80c9c7382545a5486dd46737c94ef89acb0c3c758eddaf40a44d5da782926cd197535d8d9b8d5f506ef36bf1822903b2296a33412fe36de1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b934876db8bd8a4f2efe22460c35694

SHA1
00ed93be15bd079379995974fc33bfa5d60aa326

SHA256
cb6d16a9904c674f61de675ae29eb408fdafa848d39460961211d244086eaa6f

SHA512
d7c0f6282a123689fb78667b2775b0d2d14daf01104fb854207f9d6d7cde6b860395b4ed9e07e4bf51c77ea99b8f3809664c20f8c1e1568b8a57d648ef339e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aefa63afdf704f80dfea4a46cfb6b0bf

SHA1
2107aaf8d923b669833ef7f12a6d9c669df56869

SHA256
c8cd22976406dc503c3acfc383edc057de6e8e304dfc4b0042907faf6950334e

SHA512
884923f62ae0bb70253db9ee6d8c3b6f2bd334fe3e87ab2df2e5c01071762f02153e854200dc0506985243d02f9743055b6b0d29d9e1080cb44d787baa1c4bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
502378a7dec080c8b337e1a661df1bac

SHA1
4ef1c805251517c004daa4caf1ce500599a40e0c

SHA256
ddfabe67c302d02e44309d0a94216487dacca94bb381f713992588e27ee0bae7

SHA512
6994471f97b6771604148e48a0e68cfa76e06621b45ca3eb9fe10fd151ae8ca4914f16baa883b18870fb17499aff7f87209937cd901fe64fdc7d2bd5d632524d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580a4c.TMP

Filesize
540B

MD5
98dfd3859ee491fa525b12598465a004

SHA1
b061229f6d1ab6a1658e05450be4f9ae5a734722

SHA256
2c69dc3e9edfbf676477269e2625c2398f2d9b55b27d019fc7e79127b5de7cd2

SHA512
353a3affe3cea4a04ad68a0084053e5d5c71c6a7265119b9c104430704c39e220685e8a3b8c0a808dd61c8937500a6a17cde98e6331694e071d1295390974e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3ad1953e8f84884c04340e1da67ad50

SHA1
5cf49fa2d6678e4b7738e0ea71f523c5a987ec03

SHA256
2a94ba650b15d7d6c3569aa2f46fd6b1aebdd59666bdbc1587f09968f3105f73

SHA512
e81b36a5490daa9748fd33aa63833d5c76f7db6ee61a252e24d346249cd7806539f48658af24470a3f905567c678195d8624ebff668b4d949659ab4b864bc274

Download Submit