d44fc77329d43a2045105c06117fc64506a97cb108654a4ee0ba2c7b99724dfe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b54f75dc637ad478e348f4bf2f571bd5_JaffaCakes118.html
Size

110KB
MD5

b54f75dc637ad478e348f4bf2f571bd5
SHA1

3141976fe7bc9515ebb6d645097b49a9827080d8
SHA256

d44fc77329d43a2045105c06117fc64506a97cb108654a4ee0ba2c7b99724dfe
SHA512

b964436273dea88451dc515b930cea193c21d3afade9b762b6a686e5b362438a0ef3ffcd97843da54202119cb7312b1d4afdb3bd65a4e2dbc6b1577f08f954d7
SSDEEP

1536:Siy/WvSFQv77W5w9Vh/6n9g9b9iP0E5IIaEK0HvtZYm39QIFGwvhhg8mzPCG0rBO:Siy/WvSFQv77W5w9Vh/6ss1hwzPC1x7w

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
2668	msedge.exe
2668	msedge.exe
1440	identity_helper.exe
1440	identity_helper.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4384	2668	msedge.exe	81
PID 2668 wrote to memory of 4384	2668	msedge.exe	81
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 2340	2668	msedge.exe	82
PID 2668 wrote to memory of 4440	2668	msedge.exe	83
PID 2668 wrote to memory of 4440	2668	msedge.exe	83
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84
PID 2668 wrote to memory of 2620	2668	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b54f75dc637ad478e348f4bf2f571bd5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfb3746f8,0x7ffcfb374708,0x7ffcfb374718
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11438555174173149220,17549337469345713153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
70822d76be9abd8520fc93ed20fdd8b3

SHA1
588e418b946e63489e3dcb80c06bde2b09705e0b

SHA256
08ef48e3b49991d35361868899004fcd78940e0ab5393be5e51c4f551f0b4271

SHA512
1b0f2d0dbbd7b5a2885339d2b3e653db22c1beb1a7a35d09a82cbb8825616fc016e357c2437146bfbd8fb2cfb62e557e536d6e97affa78f817292c7ca719ff40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
3a7e72598492936ef8e7b2da3603628f

SHA1
2a83e1063057e2cc496ac836bf77ba2a22a1fa14

SHA256
3a04095c0c3140e66b4b163ad7391ab4dedf0869493b821a11eee0b508a2762c

SHA512
35b98f2dce393f06fe108e470fd6e6963b1e190284434d9bf1bf210bc1c4747ec7b1fdf523a7e71ad5f739910fa12023a4e040462623669343c0aae5917de695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6c4961ca3bce47e073f5f80bdb83eabb

SHA1
f8abeee9e2c2f6dc1795ee62994581a9a8aadd87

SHA256
7c91759d93c30d2ae6d611f1b10750011d8001124c31862fdcdb1e574848f902

SHA512
85141d171209dddb47e22d06a158367e80e118263353aa50b4b822c3089f221e6dfe6946ae60b50eb707e4968413e58dfe2756a639eb7d0cd2d8eaeece67f228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0767c248f5f06403dfdc4a818e9b0227

SHA1
846378eba1f9c2ac19db06307783dfbd51277700

SHA256
dd33154ef1b67f425ee7a0209e1eaae62106b96f645145fd3b52513bc52686d3

SHA512
7cb8228447124bbc8c66dd5e4cb3fd5e1dc7f4e96fd34cf4e2b669e12a730a26588f4b4d25ddcdbed46361082f876fdeae9b1bafdefef58b32b9d26559fcebb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
182efa0904ab94278c514c9eb8d26dbf

SHA1
f9b3806ca209f8f100871e9160fed4a3bec362c3

SHA256
96973610ee2f5c57596e581628e9492e2ee1e73c32cd39d88a06526ebea8ef82

SHA512
0a1475dc017e731e7031d0c033e2fb486e958eb95695d7a0d60e59c28a265cd1bd031f158e0a0666c0ab15839d98a8008d1d54c82937717d70d67605253a83ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
79a9ce267a5a6fc922e9b39f5b6510d7

SHA1
c94f71d804d61f3ff9a6357a15556399e48b2065

SHA256
cf922eba7d9e0e0475c4fa4772050fb257f446664d8cd566556f3eca78918167

SHA512
bd408e5165e31df5a6318561c7fa7c9cd775ab554e7c81fc633b6dee22e837f56f6281cef55a875b28aba721ccd4ab4ef5cabd01ce772a946ea6f0524ed9c698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f1f94749883d7f8bdbcdcf3383816400

SHA1
303091fa3a0a94865a54066838a74f24d6bade63

SHA256
58b1937e6853314da3db776438e0dc67e5f4aa30bb82863fbd6f8f266d13fb91

SHA512
0f4e21c579f018bd74508970e93fa70be3a362aa20c9994da16783951245eeaf81d29ff72e9b0fa089603759a19722fbb551c89ce7cb06655a5c0a191b6190d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0d6934015b8d6e42223fe36b5a4e5a81

SHA1
008075ea55a341a1cb244c8e258e41ee1d990969

SHA256
067fd284dfc55a376dd9ba05546646374281ca84a38431b97b356dc7c3c2861d

SHA512
b03cb00694fd7301af6039ea2ab95e184addba64848845fef2a59be61b689f9bc7a7ba430fc41af2bb40594c4cb84dfc9ab94d20d56465d7fc87b7f2ca568e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9e57598e113d7cb57460d15d89d42b8a

SHA1
dfc454208024ba09fef8850aa1f20b3497a5aad1

SHA256
41ff067111cfe2b37a1167bca66661f0292a0adf0eae3fab270a192ed7986e16

SHA512
3b522f84402c2ade8046e21d2c3b70aff0249ef6d14173f5a4b545972240e195dcc943d60e40d2aba33abfe883b5d05c616d217a0e7f6e471db096c46f0b4164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc2c.TMP

Filesize
204B

MD5
83f35a86921b7a9053f01b581813a734

SHA1
bdabcdd3469713b7fcd14e00cecdc9e791a13125

SHA256
d23225c44c1f472b7b3b801f2f206b8b55af1bd39468259a0243b5800ee3300d

SHA512
440f2adbde1ed0f6c11e1b986c1108b3317470fb4ecf799706db219ec0a51c45c0b52c12113f098edab7e4212afb39eb677eb2199228415d6f038c3cb73950f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3647a703d95da264ce4c5ae7913bf226

SHA1
14d284e27b289db384fd03ca63ebc3da2d13409b

SHA256
3a3f5f03092eb4bab58a650a71b1c6c74b9f962220c6d6cb685a0adb631d7252

SHA512
8b9a3f1dd3c3744327c64109004c1a2f2762dbde88b8e3a51a7a7fbce5583ace847c790010404efdba1fc8a5b07068c432d85b556ef4c71d57e653b92ddfb05f

Download Submit