0bd2951145bc7ce61ad94ba4d698dfed39cd89e3b506f1db7dc8be45c4026ff8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beaa135f299869c4f1056bca1586cfad_JaffaCakes118.html
Size

29KB
MD5

beaa135f299869c4f1056bca1586cfad
SHA1

d78faa37cfbbb258f86b02019327d0213a4b7056
SHA256

0bd2951145bc7ce61ad94ba4d698dfed39cd89e3b506f1db7dc8be45c4026ff8
SHA512

ce696d47cb9fd40d653b46906629e1ae83d7e1fb67b481f6841f0c35db4db43037459f7ade390b270aeaec8e8bb4819f5c3f539edfdd1b66be2f4249e5f2f77a
SSDEEP

768:Wxrqvdohhim6e59KnqVShQeUGt9ieF7VjOEOyUdxGS:WxyohYm39UQeUGt9D9OEtUdxGS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
4788	msedge.exe
4788	msedge.exe
3084	identity_helper.exe
3084	identity_helper.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2444	4788	msedge.exe	84
PID 4788 wrote to memory of 2444	4788	msedge.exe	84
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 3232	4788	msedge.exe	85
PID 4788 wrote to memory of 1180	4788	msedge.exe	86
PID 4788 wrote to memory of 1180	4788	msedge.exe	86
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87
PID 4788 wrote to memory of 5024	4788	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\beaa135f299869c4f1056bca1586cfad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5f9846f8,0x7ffe5f984708,0x7ffe5f984718
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18312983537323521646,6387541395861196553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
36ad5ca2ad8c3cbb4bff55a91dd1f036

SHA1
a5915ad2ea8d6478b290ae835eaa55034485f2df

SHA256
71c13c99ffed4b29cbe362d6468e66fb0a786e44f0db03ee1d3623a2c02949fc

SHA512
21264589f9d7e67768f308d539c70a2fc025a0137df79443370e40552a74d91afe81d06c202ebfe1c543735f9becd2d3705d9dd053d78fa11c5297db4fdaddf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
851737f961358a6e49669b416dc06eba

SHA1
f88e83d842afd21ad9c5b184e9116be28df80f73

SHA256
1391698e934c52a020ac59e7400f4a218ed46702617e2de779be1a3e10142c75

SHA512
2c681f5c1ec88358b3e94ecd21510aaeb82ce7ea52e4d0e261838d07a8d732c546dc2bbeeff2671a27c9f51c8a734b9725d61fab39bff7d61897a339b5a3308e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c10ff16b73ff5b4f1cd7fd45b2365d66

SHA1
9a841dac77a3134b37c59263aafbd79c5185812b

SHA256
3b22dae97cf762b3a703b2622ea6639bb77e43564d39bb2a5bd51ef49144be42

SHA512
89e6c352dcee53e765755b2bd76c0b9e83624c715646c58d7be77245519c087f1d4ac59184b64ba1a8c5d6658a54cbfb57c33a2f562adda8c5b4fd0d3711470e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b849ed3119d5215c01275fea0b42fa6c

SHA1
9fb4485943483a6a64992138963313ec09a393d6

SHA256
7d1394a41c22bdbb6f8af70cd68ff2cd68b4183751b96fed17531a1a1490337f

SHA512
b3be28d9c273c59968adfb593b305fdd56f8341b87b46a176809c688fa7e8d2e876af0b6806e7c8d51db4816a1249107fd5e2d2b786870b0a2582f25823db530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec448674388ace683b22df5001095c25

SHA1
8a493c0529daccec3a9075e757c9d3604bc1323c

SHA256
bae3ff100bd5f186cf8d80434b5580160b6296d57eb9dd38a1b86d16699a382f

SHA512
bb0deeb3025803acc9c6bfc30bb67fac11c258edd5716d6fed22e9ef9ff3f968fb184a58d8889de2de1938a3cf81de99e59a217773b3b03331bd82ba291ccc6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
284b28b49b4031bf4b69da2fb198f485

SHA1
6ac0bd8c1e69234100c2838da7f3317ba097f06d

SHA256
1d56386576469917fce3de204a5ebbe135d49fa7c8aa326c755219d48eb5d02f

SHA512
1f40b75876382afaf18acb7fedb606fc6502368211a4426b295de18bac1122aa345c69f58704dc6c6cfc38712c66f8944e743fe5ede2bbd6af0812d126f58982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3970b848efb3f93e531384c7b978a16b

SHA1
613c84615b7d88c795d95aafb5ecf0b72f1929a5

SHA256
fa9d2a00711b741edc5c06eead5117d78aff9bff75cc33d09ba8dec0c3d039d9

SHA512
e67d7bc92d8ece63816fe4c59eed2f9933e4e3af79986aa8097ee4bc8b7b36620986b911fab661ce03178e44a442fe5d36bcc9c5b34c18f8255acd935f531fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e217c0a3cbc0f83560ca48e5d3998e4d

SHA1
33005e1f3e4913e1f32ff76a25191eac5a19edbd

SHA256
833ffa16418e1c0fc2ec5861de3561233d1c5c3e5102e6af1c36db012b0050b1

SHA512
b51aab262a4b72847b5de6712bd0f3397fd9362fbb99ae35e3d3a6c2b241ce0fb9b2f23191a519bebb54e11821a29da4b80ab2dcb5df0f3ad1aee4ef19fc2dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
9dd22ad84b9dedc763bcd8411f2d0d2a

SHA1
4520e0fdc0de336131a89be032870e02f85caf95

SHA256
fe25f9974a0019571fe0021022cc2524ee847f92e0fa76b1d886587a28cfbf39

SHA512
578119e050f0272ea9b9fe76e65c6df40c34bd9c24db64140f8f6c1d5fee702f03b4eb2b527ebd6e10d4119302a096858f9878e0abc69d3b94048acb96b036f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
8b29017129823419446c827ad1240b5b

SHA1
bcfdb79e4a717c0708912d2d7e294e1df2826b94

SHA256
7ccac119ea3aad3b7b8e7004c5d9eac5f3ed25a457308d34438e964c1c954237

SHA512
052f3d1453a53671bb511ac690d41bc9956a8e5a3000a7c5757459969d60a1757f61f7d9dc0af052929c11c59a9a3148097183cbeccf9c92e5da5fe948d9b711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2f4a7bfe15606df8e8c41d72bc6357fc

SHA1
df190958967457c79ab2fde32f9b7df5e97da3b4

SHA256
aa74c2b16bc97239c8eab54b6fab4fc01ee43667a0939d5d873bbda12fedb596

SHA512
7b7c5469bdc01befe9ca208b61b62e7d00b966ff4c58677ea271059776018a5e35ef1caa0e1debf8819bf395fee12217dde088668a96d541f73d18cd93aa8ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
8e9ad4ab02f0051817eaf6e33f926d45

SHA1
a4402152fa4c653aceab765be2587963166439d8

SHA256
279d5421cd2d74a3961c19346f10f9a11ed2800fe82170955b0a08e94e8a80cf

SHA512
7ca73ba3466e74d02a7e0c6fac2064d30c7202475a25b5d5a3210b0e866349e0763c263a071d23b570987198fd98d9eb93b6185c10ee65fb011fcbd0b0efd232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d169.TMP

Filesize
372B

MD5
b643b587e8f87ba3ce70361e1e4196f7

SHA1
26cb201f5d17bb54d478bc35b20fc28a4214828d

SHA256
178d8725ca53810e8fe1398c1eeef1e31ae602eebfb14617200132bcb6051557

SHA512
23f8385e36cf67f6854f1bd6c2b7f2b6c8d65b825618e5aca580930af3c8cc83d6ff31d416d76dff5d0dc3dbed0025c57e0c1117a64dc7385e7c8896ed2e0039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a90fc324121ac100ed6abe56648124a

SHA1
30f1abd05ae53858fb416591c774bcd89f63a3b5

SHA256
e25dc0971e3333b7135082fa2e142332c2207e1e3d808babfe3584ecaa237e92

SHA512
b546001174346b848b647fe9212d00e58f81451b45910ad953ea0bc712a692c257feea757733e373e2aa43a3d09d27000a04f914476262709add56ace610478b

Download Submit