5075ec5e4d1039c75a5104b9f556d85bf78edc5d961b3ed3d15ff2fce6e0150b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

233dc250f25687f53ee5b3ad6f46d07f_JaffaCakes118.html
Size

43KB
MD5

233dc250f25687f53ee5b3ad6f46d07f
SHA1

bede63007112d9e0d73c2bac5ef516c572d30f27
SHA256

5075ec5e4d1039c75a5104b9f556d85bf78edc5d961b3ed3d15ff2fce6e0150b
SHA512

7c1e8ee8f81cc0e0187803054adffd4d4d6fc387bad49ee94748d0792d7be41d9cd803cd7bc29fa3b5164504d28e4178b32285cfb680df9744c929e10613d942
SSDEEP

768:S/od+0Edi4xsjYA7geGWz2ANW5OfFfeshaPIQwnqGad69DC/BcEeQkpvX9:S/i+0Edi4xsjYA7geGWz2ANW5EJeshOE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
4828	msedge.exe
4828	msedge.exe
2492	identity_helper.exe
2492	identity_helper.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4680	4828	msedge.exe	81
PID 4828 wrote to memory of 4680	4828	msedge.exe	81
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 3976	4828	msedge.exe	82
PID 4828 wrote to memory of 2156	4828	msedge.exe	83
PID 4828 wrote to memory of 2156	4828	msedge.exe	83
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84
PID 4828 wrote to memory of 3096	4828	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\233dc250f25687f53ee5b3ad6f46d07f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4343977076947040628,13115201275527454493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
df14665f460474a948ef6f3ca958f319

SHA1
78acca6b4ca9499ba20a2341060e9e62d1365a0c

SHA256
e1351a972cfc2b3cee94b36da7a2d25d94e86166685a084a7f8fc1f3e578270e

SHA512
8a6bbf19d0a305b4617604e34491fea97b0d5d88b6bc7ed635daa1fd7c580fe5aaa799eaa298c949bf4cb69d8d415c0e823b6128476008e527c130a26cf59cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e3f3b6c2d300b418861ea1ade35b340d

SHA1
ade84d1026a691e7c2c9faf27a951a6fa1efff8b

SHA256
5e7218175948f005e2cf489033bb7a62ebb01ab965db6bca1343387aa4a6760f

SHA512
52b377c5993ae8f6b376132e600dbe232ecf20dbb6600dadaed0907ba4d1ecce7bfaf961688a4498967f988ffc0a876e8769443c99556ba2564e310d51582fa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
32e27922c69c47b82106b5f32e8096a4

SHA1
1045efbfca8fbedcaf5b23ede842ee19c8ebe1f6

SHA256
80b4053f3595dffdaab95c88e96f4e0ab9c0d2c8cf59acdea3cbb05cc4a60625

SHA512
9ac5b8283dbd24a666cf9c929314a51bced9f91cc409504ae403ef23bd2492fb5ba16b4f54232d9f0a4fc00984f129a286b1ee758b25fc8b91ab3488b56bd99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8fcd69acedb656b6f78953c109d3bad3

SHA1
576eed2c3469f5de70617d3d182998585a249543

SHA256
22851b4d1d3372f61e51bec0e46b1f40f5407c0bda1d96ee3de5226f45c64b2a

SHA512
04bac55eb8d442caab82b525b54eddf5620bd7f8c16330e01af93b2a5c4eb302d71edc4aa3c98a6d38cad621bc57b5244d6752adccb7c1e1f18efb32d2b8906b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
342a2199fe000db5466ce418df863c8f

SHA1
32b7ad8e217bb3f25fbf513ac89452b236e7fa5f

SHA256
48710d48e3b42637685c6a364a223235a0f016814e7b7b9bd2b48739763981c1

SHA512
442776ceaf21ae0fefd49aa248da0b4defd18b9e6ec04976a509a2e4a3404d1d96c620ecdccc0df55a89f2761332d1a01792e3bb0f688ad68dd3c6406d9761ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e78ad1eb6d7e348218e7fd13a5e1ca65

SHA1
cd8e3ee96352b55a4be0fd1f3feee608ffe2467e

SHA256
686516038d4b317ac738af50c94c710f1c644b62bff1d725edf6969b76497a0a

SHA512
58cf93db3111b8772892e82ca37a8fffd202d188a4328219a051a771cb89fe80feb9aa5fe8c3510aacf5ca5d6e3210fbfea2960eb7cf8d8c057d0bee20b2ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa21fcbd846ef01e3f451e64cbe8488f

SHA1
14d7cdc93be083111eb2123796b4b6555ce1d680

SHA256
94777fae317b853c630abd346a9c1ed12b429fd8708d92a519a2685e931b480d

SHA512
acd614d9f564837d47c6bb8f3f514956ee074ce143ce492f99f47394516e910daa1694ec68999a6242561edb8115ba9115b7d80d9cc26ea849582c0c0991a61e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c8db50d13dcce3e6418bc841f39464f

SHA1
161ee916d88fdf07fd7c250fa4795867caf4e131

SHA256
ee0d8a346220338ab9f18f36973f683188a81a061e58b2522af1db0b600676c1

SHA512
201e256cfa985e967ea9732a8c6fe6ea59b5296e1d67ceb3a3f5aeb6c4438c32fceacfe54486bcc4bef9309ea3c6a897ecfa04f72816cd7fb768879f408ecf12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
085da9459f2e0ba3a41c89e996fe4b5b

SHA1
e2dfb9076a20a2e354173e32c829c3f432116ff8

SHA256
31c9b1912fcc446abc10385337e15097ee5ae5fa3ef92c26f6c56c5d645fceb4

SHA512
59f9ee873d029033c2293ee861d3ae084dcbf3a00d27794fb8ec397a9b832ef23a142a3629631e95624a288880a81aa635c50114403a0f095615e428aa8e208d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6e7.TMP

Filesize
371B

MD5
b15fcdcc9ddcb82d6b130ccccf986691

SHA1
dad631e40a822ab13d974c01a3a6f31031c38025

SHA256
604a55567c8176c096affbe23beb1dcae23bf1b14e8be7a1cb38995f5ef08659

SHA512
0454fd5695434b3699516b5fa6db5baf72de63ecc6cb6b1bdedea9c69fb5b946cf4ac78d4f2494f76fd69ec98b7190214ee1f905b28bccec07616a53bb9f5168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4568a6f8211b4e38b1a433f13d8249cb

SHA1
776da64e256208376d13f89c231c60b150a7b5c1

SHA256
f56b5941ce043bb219bf94f85454aa4950e85d22bf5ce77232fe3d4d7ef13640

SHA512
630178079039355ca2300296f36e587136042be0dcd7d5222ddc2511a129a38864d953990354d766618afffef8c085783ae17d60d31c5def1bc7fb94df0901c2

Download Submit