b435934a6cf26b69de6730c37a6d1f859eab97424c2dbddfabaed988d5812dbb

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f2541ca4061ffd0fc79ed50406794f7_JaffaCakes118.html
Size

76KB
MD5

4f2541ca4061ffd0fc79ed50406794f7
SHA1

42f8bfd49d2d24cfec60e425b8bafc1ecd0a0e74
SHA256

b435934a6cf26b69de6730c37a6d1f859eab97424c2dbddfabaed988d5812dbb
SHA512

c5ef9250b3c94fbf7568d379aec7cc395df5df3549bbc8b614da93787db517c3b759d2f1ccf898e33ff81abfb9280ce858bc208ae89c5682cee4c9bb2ad149a2
SSDEEP

768:IuVC+slagbgOriWNMayokqrcAL5fxZ7sw1vOZnSX7ZJjYNYm3i5NqmX+kJS29GS2:IuVC3lagExqRxZ7sw1vOZS7jYNPiykJe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
2884	msedge.exe
2884	msedge.exe
4228	identity_helper.exe
4228	identity_helper.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 404	2884	msedge.exe	83
PID 2884 wrote to memory of 404	2884	msedge.exe	83
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 1020	2884	msedge.exe	84
PID 2884 wrote to memory of 4788	2884	msedge.exe	85
PID 2884 wrote to memory of 4788	2884	msedge.exe	85
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86
PID 2884 wrote to memory of 1424	2884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4f2541ca4061ffd0fc79ed50406794f7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c14718
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9028079366218522076,10052672154420075271,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
53833c5309168f7e8b98ad682f7db375

SHA1
74c717eaebd7541498d143401769b7ee0b0ed928

SHA256
533b7198b6e12c50a1fdc69195234664d4bd7a40b64527ec09fb6022dad03b7d

SHA512
daf3b6d05449335dd4ca70d13cf576e4eb9fc45e625a0b9822db987ee84e2ef256918b3cec2847e1fbd4136d34c3b7b61c34233c3e4e1afca24846d01fa8b236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
5fd93e6b8b3503caf5f79527c1ea8630

SHA1
df684e38b665c0edc1b48cb4013b2be45746246f

SHA256
c15e40c2e4f3b2401aef81fe0414f87907a0aab675ac766df9dab9ec7b137355

SHA512
faa319b4d110a72e26c3f8edddddcbf9eb240a741d37e257c2e70d898bb8e242d1ba19d8a1766c9ecef872448640945bb7246534cc46ce488bb319e32bcf6dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
907adf3eb785d2045619d4d50c873abd

SHA1
787c0afea34f005b991589648fd000946be618ff

SHA256
6674237ea0f8e22084df9498de18a2f4f365ddb7bbb7e6e15c77283bca47dc3d

SHA512
4b083ed96ba45cedffd4fda11a5069227f5f593051ddbb7317b93972a51144eb6eaf96965e98944c5487bbe6bec1a3106c3dd694d03f990ff8de973308d2584c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6fb3a3d34a0424add54c936e37b5d47f

SHA1
ccb7b7043dc3ded7b0ae45310634425898222f14

SHA256
5c9e776ade7ac5219db6145ee7c65798b9bd55c8d7fc2f2bd19b21b175687db3

SHA512
3d725e47b7d5bc332226417ff88876071e92b751c414c1c302a76df497f69869ec44fb9011c73f3935cdbed5b41e8d78cc2a772bff11fad5abf15f385043ce0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab07e4a650f56dd7a1349d07a647bc83

SHA1
80723fb5ce2170b8b239a77be554c48d9f4e0213

SHA256
71cefaf5701d51046f22ff3dd8123407cde71ec7511e176f4927a05be1519068

SHA512
497e0fad7d97d08fcd53087a45cb6b71a88e7763678a6b1cb6bad72a3b67358bf3807bd8f2357cbfc5d2da1c63e69eaad6d0b2a2b1cfb0066d68c2c7c785e923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91e7daa929f890c749d12e9641608c92

SHA1
0c943641af2ef02d6cf417a37daabc2f04059de4

SHA256
5e75d6eb436ce51080cd470a1d3e0986fbf8ee5d24a5b27a8c7119e60e2c4b51

SHA512
38a39b06aae5fec287dca95c798fde69a88a77375dd650178bf565796f5ed355492a86a6242013d6f634ee6e0e02417b6a39f5dbcb5794495cc11c3148b57e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa35d014f8a9db7c080390d2c3ee7b09

SHA1
6f67f81430168295190641e18ba022c073067605

SHA256
8620662b4bde3d35ca3d94819a8080e1accd7dc6457700b2d9c6e12e49c28380

SHA512
dd95107785003f3edcb810d10c32c534d0505eb751b515d1822022a9df41dd0134df1e2ec6e213eaed1e6a8761dcec209f52dfa39d746a1c8672e605153b16e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
37d3edaf386f6a05be8f5ce0b6df6518

SHA1
02fa74bdb445b27d0ba306d14a27b523f5b98ced

SHA256
5d428d2db70b4a5af8b8ef27def4fef3dc837759c2b59ccaa673895f4c640dad

SHA512
89bbe215871a2800027c1011b23c60fe9c8e51f400e27f270ae36ecdc45bcd19775dee8398eab0722813649aff31ab082a203eb60c2b201d070cc6df2f3ff4f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
fb7126a62e7ba917acb4f77de00334d9

SHA1
629e9a47cf6fa619f7b67a8898ad130527adf6f7

SHA256
01885e29e2cd8eab3fbbc8fbcefed8b17d2d0ccdc009aeba9e9ee920c9abee44

SHA512
3c65b498098f79a0a5c577984e2416f7b89f2e91c01853687a5864a1051cbbab4fbc62e785b46b42ae725d2d4bd62f1cd631419a9c26ba767983694ac2742b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4df.TMP

Filesize
372B

MD5
d94296b6204322ad3ae0b151c1dd64bd

SHA1
a0cdda718bff5adc98f7c0d069378b18e0b1d239

SHA256
02ca806787e5a3d17fbbaa74955fa6d1577622bc5c563387a619b832e83d9f1e

SHA512
feee6cd7b4b9a438d401b5acc11909e46736595a4f85725e91ea7662db31cf439f71bcd2212837b2dbb9a8874942bc1f11a9b1dcf7e59a06dac4978f04bcda55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2ba07f1c6656a9534c323db47f7459cb

SHA1
8bc87fbc6b29dd2b318f7bfbe35fe21219c127f1

SHA256
d35d06d3aa6617b512ff195d9f9becfd1071e15696daf0698734400e1787c058

SHA512
c51d0696a45ec28263c29e946cf6508f57a62c395465f60c6c2889610c850892f4bbbe134930e902214cfe69958f6bbd7653e102fa231862048ff20eb42f2d9c

Download Submit