620334b4fa16c7ccd2887f6be07b80659cf5a9925be73b8c8879362f6f5f7245

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b5210650d81a4d2caa7c388c3f5700a_JaffaCakes118.html
Size

55KB
MD5

4b5210650d81a4d2caa7c388c3f5700a
SHA1

0645b208f44ad580a5410a7f3f1325702bb1b898
SHA256

620334b4fa16c7ccd2887f6be07b80659cf5a9925be73b8c8879362f6f5f7245
SHA512

a3d9dbea78b5ae5827a36ef2b92cc963158d59520c6c8ea2c4a1c55915291d60818bd7daa063c93356a93f7bc42aaeb1d81e2b94b60767379960a35d50c56f9b
SSDEEP

768:SCvkrpFxShREQBwQCYG4gL4Z0QIbu4GZgYD68CgeHiTjp:SCIpFxShunQCagEKQIbu4GZd9EHi3p

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5004	msedge.exe
5004	msedge.exe
3760	identity_helper.exe
3760	identity_helper.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 5344	5004	msedge.exe	84
PID 5004 wrote to memory of 5344	5004	msedge.exe	84
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 4984	5004	msedge.exe	86
PID 5004 wrote to memory of 5112	5004	msedge.exe	87
PID 5004 wrote to memory of 5112	5004	msedge.exe	87
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88
PID 5004 wrote to memory of 2980	5004	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b5210650d81a4d2caa7c388c3f5700a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5e6c46f8,0x7ffa5e6c4708,0x7ffa5e6c4718
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9945738795842455992,13047845095614333526,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35469bcc-f737-4b83-bc6a-e7bcf1428504.tmp

Filesize
6KB

MD5
e01ccd74b29db18c54e42ae86cf5bb71

SHA1
7a35ebdcb20c77b02bae649b8f152a5d04a7b866

SHA256
889f2ab33a4918fe5c8dc7879173406d8700ede8a6d8bae8c09e51663e2d3486

SHA512
19f545d8cf8285f34583689d0b6ab9a5dffae34be8f17220b5adb78185322b7c9d25bb9d700f08b5d3affd7cb80df86dce27dbad15d125595495b384fb32a211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
df14665f460474a948ef6f3ca958f319

SHA1
78acca6b4ca9499ba20a2341060e9e62d1365a0c

SHA256
e1351a972cfc2b3cee94b36da7a2d25d94e86166685a084a7f8fc1f3e578270e

SHA512
8a6bbf19d0a305b4617604e34491fea97b0d5d88b6bc7ed635daa1fd7c580fe5aaa799eaa298c949bf4cb69d8d415c0e823b6128476008e527c130a26cf59cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
acb1fdd509c2aab0bf5242f315df107b

SHA1
7fcc81c37d7f1eda0bcfe95bcee2e33749ad82cd

SHA256
13e8a587288320daccb5f2daef3ae24a0930663aa16e4f18edaf62a67d472e2f

SHA512
b9d3bfdf478c2cd7abb4260bab22fe79db72697a29b2d6d345561057acab183e13f5af1dd06f5fc0b8549ae78a2a72676c7a3c0927d3dc9df6d5e97a6d33b84d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4de6203253c2dc70343f30c5776da0ed

SHA1
02129a7be1f4ad8c36689937a8a2c6214cd9d86c

SHA256
ffea486bc6b37e5175ac737a23c08898e33acac0c06a09fb94f63046e02b630c

SHA512
6966c79328c411b61cea060f663d2d3f97946d546ec6ad5a9dd360d9d8773d1f4639a25ec178ed2fa8ed0c083bef2c3f06014a78f8df42a45b3f9ed0c2793581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ea9be17a47456bb9e28966bd77f34d7e

SHA1
951229d4edf64422578280156b2fcd89cbc63186

SHA256
7147eae102cbf3d000d72b977cdbdedc29569e352eb426bd75d06ccb789fd79d

SHA512
2e18a9bcb54e6ea13d2252a831cb281b987d2552b6e365c3b9d3bf06820287db8b4b5c926358391ca36cdc283287d0a3b9c549e30643c38c4a330251b5b41410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e9424c08a65a60fdee85039506ad51c3

SHA1
f85fe169ff1c0f799dda96b25dce4a6d1b4851c2

SHA256
923893b4016de8495ff33704f2d08915cb04f68c90fe4a53fb54d8b63c3a9d77

SHA512
58c580b116851d2bdc414d73f33d7ff9bf9382a6f0b71e31f23e4dcdd5901703b44706bca9ae64205f12f57ce002615c812572dbce92b8b33a8e4608c1b1de6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f0f65e9d6f91447972db138970cf44a

SHA1
194278a3e7ecbe327b68f7bdb55b6734c238e402

SHA256
83945d9749e5b7381801ad7932c485322559cd05de147704a8cbe3c4f2d966d5

SHA512
21bde76f958d42064d625fcb2c97efc8d791a9551fc82ee337e9b0f7fdcce52e1e021c876b90d2ce313bd7e9b5fab16a8a0d945bc89cd089ee91a4a47c9eea6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cf842b56a03fec725160f1b6c531a26a

SHA1
b08c77fce3844d54fcf3ff2ea67368d7755e1e27

SHA256
a500796504e58158fc5c4987ebb2dfc789b7c89b08662deffa3ee4f9098ec0cb

SHA512
69d4b315dc91e721c660174a8f0695cb11fc797393f6bb28ca91aa4335de0611f68b2d8ae83dbfe38cd64fca99107a70d1f5a69115db0c361b1b6c2e796d9aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
45b6bb817ba198c6eb5d0190a3281c72

SHA1
19e82021841459dc41411c4f6280597fcded58c5

SHA256
4a13a44d3f8e17258c8c628d89930612978950ccad05a8c46a000b8756c62a6d

SHA512
a4aa2077445cf7bec739289d2b90da640eefe91856fef1017814fa899fc6b187990a5bc25b3f573ef255dcf76fe99daa5ebe4f9efe0002ac0ee64a99437e7d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
696B

MD5
e08fd7c76dc45bce7ccd0aa51d7e977e

SHA1
ca1b11a8aedb09d39a321179860f20ee127cccdf

SHA256
2f42bbf046bf4a946e1c8b683400095c86d67b124fb6240935a1bcdc6ca72d3d

SHA512
4e057aa17e0fa966f1d19c776a2984653b89af4480e0e1ffcd99b15fbd908826db6a2fd9115ea2cb44d067e0ac320e8f1bc4003e920f776a5fe4131fed1fbf67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588f0c.TMP

Filesize
696B

MD5
de7403cc076c73ff370854727bdae2ba

SHA1
9f366941e41023c457c94be59ea734894f84a689

SHA256
a2f27ae6bd6f3f4b0bc98813d8e6a4ad5ca41ada1546bbfeadcb41ab5746f0f4

SHA512
1c4d2d81b84b2aa79b6afdd39efaed7e8548a1b8aea0904662b64dbb0e19714b3c07906794021242cf4c2f5ff461dcd3e3d04ca66a8fda516f3b399807b8e504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9badd0d639446b71476d71ce9eb6a7f

SHA1
58c4f1ae6850fadcbc60a344361341e28b08ddde

SHA256
04c96be015c5c4dcc6d6b9688779a606aa05112cb86163f1f95afa8f4ff3d67b

SHA512
64345dc512ff3c76875db7bcabcd571fc5b815f6adb1d0c9750636c70ec8243774aacc86262e4d4259f7bda787060ade36973e9b77eb5c66bd586d2cfe92ba6f

Download Submit