380d610353cdddfebe61aeaceaae1622e222c88b8a3352647053608895cd5c83

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf50c30371dba4571713598cd1991247_JaffaCakes118.html
Size

111KB
MD5

cf50c30371dba4571713598cd1991247
SHA1

b7970db415807f4b09a00aa3f3e9b12e8da5ad8d
SHA256

380d610353cdddfebe61aeaceaae1622e222c88b8a3352647053608895cd5c83
SHA512

d5377fe0672697b00287caa456c40809fbc6191f7a8d792ea0fe83559db2d5e869fb164127302092bfc76211b0fcbe3154736135b5c3811f1ce387bc95f421b7
SSDEEP

3072:gK5+vRSkUcjvG8rMUcXmNRSV4MVQksVD6MdSAGMHk7N0:8ZBGXmNRB2qX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
4804	msedge.exe
4804	msedge.exe
1408	identity_helper.exe
1408	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2332	4804	msedge.exe	83
PID 4804 wrote to memory of 2332	4804	msedge.exe	83
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 4128	4804	msedge.exe	84
PID 4804 wrote to memory of 3572	4804	msedge.exe	85
PID 4804 wrote to memory of 3572	4804	msedge.exe	85
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86
PID 4804 wrote to memory of 4796	4804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf50c30371dba4571713598cd1991247_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8e8a146f8,0x7ff8e8a14708,0x7ff8e8a14718
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6478231113625133539,6873705896964739149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b493519fadbf966a95f17d3d8d2f94b7

SHA1
545bc4680dce0b213f51889c37749acc22078b28

SHA256
788b8db55b6680384b8bcc31a30916d34c9e775dc112b2d57247dc5e95495966

SHA512
6dd8f6d9953573f2b260d0c5dd333e28b3f24e3bf5898590fb31233194d92b05645730eca5fae4a3174409e073d8ae3d1c4180a02cfcd5f63bf33839940789ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
24a6b7e716606da4dd1036578b180b72

SHA1
34e878a02909753f280703c2543c918cca28a40e

SHA256
42c4b543ab65be293570c1443d0850915afa6569771601320087987a012b1ace

SHA512
a148f06ad5c3f7716e92704d3bf38a824f650fc6c18e01779768872e2cbb076b74b48fe3195da655512cf8bcba06db9fa6e8ced60ba32159e09327662768a733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b3d1786b0b85b854e46b287a02ead36b

SHA1
5618f98c794ebdd3847d190e4d32cd7040a884ba

SHA256
f49346e363499356df693ac4875f4cd580c88250c17ea73251d48c0ef8adc5b5

SHA512
022d0707449b7b3b24ca20cdbecbf31b8525b5b3853d1e0a1ad5791e8f11e1c2f7f419a26494b3fad75588f1ba7de0047ea97451fcf01d7f8cb7e63aeb655d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
21ebbb03267d270a98a95e2ea9075f6a

SHA1
ca644d94a89e89a247c97caf43584b20a51ec8b7

SHA256
273089eb1284c8370be5e2bd55f6286d2fa5b8d10fe8cf9f9f8dc0707455e346

SHA512
e64ddbf95a2aa2109dae3f29b7fb9f883651d0c42a99951493f2dc2879d2dc14b4be3a26d6ca9a591def5781b1fb85c47eae1aae487036c324627de6d78989c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ddee801c3499464e2db8893ddfcbc78f

SHA1
9b7000967ddbbf9d773b61ba553205d94cb4f7ad

SHA256
abca954f114911fe837f9199bf8c9018bacafc455700ceb3b4d42a54cf248c9f

SHA512
55751836880ee5dbb43112406da30ec7ec65fd505ee4ab61c71a9672721d63e6b5620f90647cdfba142a253c1cd39975824e915ad3ec546b95af8af017e889c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4641c2635522039e0ae30e9e67048053

SHA1
7b256f83c13612c1e732fa3a7fa0e7c846ade286

SHA256
0f76bb4427e9364810687fc12bf6c4f8db5d844e75a2206cbfc2ffb4a69c1b3f

SHA512
8b1bf1f7bed4a4bc32826131eb9d835a445b799c1848fd6493e15ab87b4eeadbb92cbe76a5556722f2f12b3ddac6f11c47c224085fc473341d1e4bc7fd74c275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7ade4a37500122d25e187750299017ae

SHA1
473c133c14bd292a1fb41d9a94f4baf5be5df1a4

SHA256
68922fc59768b38b510bc5357b85f3c17b0bd0910e576cfa2922bae5f1f9775f

SHA512
8836aa85f109ba334140903dac177ee8750fc3e6e45dadf21f6648e94e40ac6184a23bdf077153624d2183e6aba4414a24c2819ef0c85ba773855ffc8ce90831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
7c13310498f141f35e54dd728ebc62b3

SHA1
ff14103f9ea62b15cfb5d1cd7d11e6f1234ec5d0

SHA256
bf6f67f7999c5bd32d5a1cbe0528d31409b34bd6bdf24213daf7905171b3f663

SHA512
b916cd7e65b1bbeb8cf3011761539de61d837f62c522b5fd33ad2869142b6abb53d54da0a3fbafe32104db1a7bee7d51f6f0843891e7c535e7b0bc4d54a23d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5871a1.TMP

Filesize
539B

MD5
7e7ae0893dfad8c5b1e04fb8776adc8c

SHA1
99cb8ed30568c506c7a59e6bfb56ba1ca0ed3974

SHA256
f1bce0c1295d420176aa23aefdd32cf17930a37b4b6236d343d1db4fad838629

SHA512
2f1e64cb777556c9b6d862850d40debb4fb1235923c6d2f1be8ded0e2fc0b6863d3c4d9337581634e33bca90d5ed6b37a5b07b92384b669768c420deb9bacc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba52700dbdf1f5df202e963c0e62479b

SHA1
8d737a9f2cb9434e2ea0706f17a33337338845e9

SHA256
85731b3dbe0515dccd7b8e24c4d8e9d39a723833a825dedcf8ea3be2ba817427

SHA512
29a810ef7b0f1f9987e1554d19611bfda63cdc47d7ca895b47d9388eaf8c2b3df6de689226494a3c9f090ee2a5b4bddf2392ba5bfca74edcc52bce62deaa6e73

Download Submit