f3074466f0935b0ea3e3ac2a35a0858ea032b490f2aae69a12023b4dbc83a85f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d658e5b73da2fc484c9a740a33bbb73_JaffaCakes118.html
Size

131KB
MD5

2d658e5b73da2fc484c9a740a33bbb73
SHA1

afdee833372d9c0ef347df42904ec262862e74d0
SHA256

f3074466f0935b0ea3e3ac2a35a0858ea032b490f2aae69a12023b4dbc83a85f
SHA512

c0fb1e2fe9c8e29a1d95a9ee3fa3a47a125216ecf477a27e52893976ae2609a0f3d20d6df49813c58ef717671bab2dc0f1e925270d281fd435b162d6dd703742
SSDEEP

3072:DqLwvRZzSG3eGza5krCO0/V/8rnOL55ShutTmdzSmO20TdtFdnRLcV22wOoS/0IT:DqLaRZWr5krCO0/V/8rnOL55ShutT0SO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
5008	msedge.exe
5008	msedge.exe
808	identity_helper.exe
808	identity_helper.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4408	5008	msedge.exe	82
PID 5008 wrote to memory of 4408	5008	msedge.exe	82
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 4884	5008	msedge.exe	83
PID 5008 wrote to memory of 556	5008	msedge.exe	84
PID 5008 wrote to memory of 556	5008	msedge.exe	84
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85
PID 5008 wrote to memory of 3556	5008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d658e5b73da2fc484c9a740a33bbb73_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe7ed46f8,0x7fffe7ed4708,0x7fffe7ed4718
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e81c757cdb64c4fd5c91e6ade1a16308

SHA1
19dc7ff5e8551a2b08874131d962b697bb84ad9b

SHA256
82141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3

SHA512
ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2e57ec8bd99545e47a55d581964d0549

SHA1
bd7055ea7df7696298a94dedfc91136e3b530db8

SHA256
a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c

SHA512
6b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
21KB

MD5
549baced2c151db8a02c3419aa5c01be

SHA1
1f36a9716da201c5e45c1cc23c349bbaae44a3c9

SHA256
11938f83bd463e29316808f3e118440f718f1c7a0761bc860171255a96cbefca

SHA512
12c40a66af58d9436d7c3361de906077402cfeded97361c81d9900d69d405b5ab002ac36aad3f8152c6083e00755442bd1bcd1766af26c097638051dfe1aa9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
45KB

MD5
94019c00785285cd78d6da8a1bdeaf80

SHA1
33ba11bbe8c91eca17a84c3dcae4667638a61b57

SHA256
2ea5a487d117c082ab04c8b2d979adc04c18f496af90ef2caf9910d9902ef8a9

SHA512
b58d23d9333290e203ee3191cbcca4686ae1f9b4c135ee8a8e0f014e7db4efdcffe6aa82b502b2d8e63bde705895a04726d799a4c6b0e22783b6925b4d297d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f887df65a3675344174544fbed704c07

SHA1
726d6563ae033e55e6aaff172ffa2a347708d06d

SHA256
93322ec2f95aef9e0ea3486589b80b4d16e90d4aa89bfcc31df37721e1eb3bce

SHA512
9acbc169c0f776b740ef1800d3b45888699656b54ed741d81e60f219a67d5f55a04f5d7d4928314c63e53e73f565597e7aad42e9da79f37a4c2b1305d939bbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4a21a6d58ee7ee87e638d1d3e1dd7bad

SHA1
c44935f647d0415e7b4ccc666248fb436f323418

SHA256
b422a04db6b62a73f404319b3e509b5f763735c30692892ec70a260929fe468c

SHA512
737cc6855c531fb6d76defa2710669b77eb61c3dd81cb1ccf206605cb1e3331abef7853f7cfca25b0fc6fa27d0dcc45247f652ded3b96f1b99046c09b78703be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e7020f394b821137772d6541245428ca

SHA1
cef1eb2fbdafee9d4d89c84b2c92e2a818007f1c

SHA256
c4eab851734073f481b84876f6cdeeb67f5c0fb14e81976b4e6d6babda9b207b

SHA512
bef13f1190659143a745649d396accdf65fdefe23241fdd4aeafb054f3705f7075de9f1adc95e808185e9ed48c3aa7dda005abaf4a824272c6c38dcbf1d7d7ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7419a1e3088f67858d04f7b96b36a3a3

SHA1
a9a69827546fefae129a91604513c0d73b7b5adb

SHA256
2a899b7a21142dcf358f672bf66e995748e1078debe5db8ff84cc027f56f8ebc

SHA512
addb5ca93e116c84b119790424476d03d8115f2427d057f1a4e00b17a65ae78e54cf04a80d95288237ec30dffa726a40cdc418e49ce2fc04521e9dae77f5ec1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa5c7fde7221487e11dccb81d545b302

SHA1
a7d61a70b43d4ba3655669025622ec9e4fbe1568

SHA256
2ef106b4b22474bc6323df5cbc932d7518c2f7830f7f0c592f80adbca717a587

SHA512
4d2a1d9fe05b3b3258cd6fd3f6f40611eeec49b85bf70ffa9b45aa13255a4649062205e26b9eadc7b27cbdbebe206893689203d8d24369fcfc29ab4001278c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9523dd654dc6c2552b7b1053874aa31

SHA1
54d74a6505cb6b65bacbe623c388dd26aaf22177

SHA256
d52b79ebc86f44a6e81bf981e71ddecc8b3f461a817ffcf654c9877321c31b80

SHA512
2e912ee663ad8dbdfc80e6a1ee4e876f09043831bfc313f5b33f03a1a38f8e76f261050421d61807b52352a227aeb69aebb82d6ab9ecf88b84253f75441e3657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f159990aa92fced23f2ac06691bd2c58

SHA1
4bff1bf71426b368569df82c59097e8430bd8f37

SHA256
6e776c46abe14c9578f6b6b782600fbd00dfdebac266559cf938a0437dfd2607

SHA512
4d73566d298d2e04588425c8a2402bf48c25e1caa15dad39b5fc6f5073dd94a0de7a9d697d6c5240b413f2e3162321270a35a7d5bb125d536596c6bd52f31d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
51d04326f8f40fdcc2af4bc0700da6c6

SHA1
64736f2dac0e16219accf4ddf51bd92ec7905c0d

SHA256
3253b8c085a5e8e84b11b2b91bb1c6c7c99cc8bf1e8eeff379a1677d1c3f36c6

SHA512
021339de355d24d122f29e17af0768b4b0eb301755cf5519172f2db7b2ca3c28dc2d0d5694cfb3bcbc2b4280ec3528541e353ca690db19207565d176e180e8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d7cd.TMP

Filesize
203B

MD5
bb5372951d8d931788b9035cc98ca6bc

SHA1
b2c2d162f93f09c15785aa9045ea39aa5e5521f7

SHA256
5bcbeada0f17cbbce8cc3937f94991ff371311b1f833b8b26800a5a1ad5dac79

SHA512
6d3a9d2571cab8e5798f72f561ff5237f0a8945f618906e95d7edf415bf0ac2fc118679d1e929658d8ef01a5f00ff45cfff783a515310ee03362f8d5f9fc9a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
34fbd9a2617141298ebb8ed92427ce8d

SHA1
9cbf5a9443fd48313c637a4b968193a4234f598f

SHA256
13eb1f81be408dbfc46c3fcd03bbc07ecb944d8ff89cc850f5a8452ec1786537

SHA512
fbb2451032349fad0529726d30aed8d603726f1976b9a20df759661ff3b1189dda8230cddb0d460453ee4bcbfb89e9885f66d0c78a46217b065e4c0012d624ef

Download Submit