cfe0d9d1efddbb6550f50c05038782ec60defe30538624a8bd9f2064548dff33

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d05f61fbe966e5269c6a5f5a435a5f88_JaffaCakes118.html
Size

165KB
MD5

d05f61fbe966e5269c6a5f5a435a5f88
SHA1

6f4309108f4ccfbc7e6b6ab5a454cb45307e977c
SHA256

cfe0d9d1efddbb6550f50c05038782ec60defe30538624a8bd9f2064548dff33
SHA512

45d5cd66684df531705f18237cbf951800e5421688b6043e8f106a19b76c0875bc069b7a3b453f9920fbb0c1fd28b603355b439d42bb74a8d6691258ed2c8998
SSDEEP

3072:v8Or0KwdjOw8bCdC/VUhoLF05fGA0Ach7NrHl5ZBgt7W:EaFUhq0GAc48

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4860	msedge.exe
4860	msedge.exe
3144	identity_helper.exe
3144	identity_helper.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4744	4860	msedge.exe	83
PID 4860 wrote to memory of 4744	4860	msedge.exe	83
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 924	4860	msedge.exe	84
PID 4860 wrote to memory of 4488	4860	msedge.exe	85
PID 4860 wrote to memory of 4488	4860	msedge.exe	85
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86
PID 4860 wrote to memory of 1084	4860	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d05f61fbe966e5269c6a5f5a435a5f88_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1723539411735906617,9496473780875572791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
eb62d542c45e325d9c66a831b55a21ec

SHA1
69e6cd9c8e01b6c956a22b77a0d2ff7b7225f9a0

SHA256
272f9e931bc30a55a475986f67697818b60f2be4ae7f793dc0d35fd2d8e94d7c

SHA512
7ab32019900d1f600d14667c2733a066168d199c39fec68a2297d2d3073e21ba125dbbdb3b379e6a774dc3c719cd4de6fba8282a52f805d1f5552b43a5922b41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
26f5caba528def15bb153b2d55252c49

SHA1
c00f0c9785d02d0f4fc3ee61bc3579293807ba5a

SHA256
1aaef3b5b31fe6ba00809d7a3556ca14274f8ce018d108714f2944608044d91c

SHA512
c32f0950684e3a4839b5269150e543c3df50d6ae33404b0562ee84e2a3b6789ef4c662b5233f9cdbca110f04dcc13c92682e66d58db11583cf77bb70ebd8d5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dd1d3af6c09d57cd3119d0b9eeb82b48

SHA1
15d7a172bcf48de170b5779d521ae593ca18241f

SHA256
c954e9d7f33cffd0dc07e0cc0856106a2b42724d3c41804f8992422e5a3fa651

SHA512
2f4c52f9a134b2258f13873df5c48294d36785a34c213d8d0b7e8b2d2105dd8fad2b60dd4a3ca3c7c7ab3919228525aa8a3c493f7c333bd97b15292d955265ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
29d41eac0d959eb03621ba81a97fd592

SHA1
bdc2ff917f617e43094dae1656d8440339882d50

SHA256
7529ea0ac169fac8ffef89de006df0501bcebf83428ae88883fbded599910714

SHA512
46f6b8cb469a80e9cf3a7486aef357abf1582357d91f5b34c3487fc3e254faa76e2cee0f23b7834e981e61eab3014e97bb60e7ae4b177dd39f63abcb0f4b093b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6107bd1b7b94fc8dd64cddd4cf9b470e

SHA1
96335c137e54dd7f94494139ae65fb38bfdb6f3a

SHA256
83de0b5b46b58fbf838173ab3dace2878a9d46d1bd0aa7975743a73774ed366f

SHA512
bca46d765d786e38e5ee73af1d24d551a200bb67a423e9c220806338e7ea9385971a656a2e32d3ec3cbe57ff3165b878026aeee55a0536fbf4c8ca698949918d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78fe819ace7c05df8034bb506efbb898

SHA1
e3a559bca96e83a7a81cfeead3cd37e034baed1c

SHA256
b24021e6e9bce440bb24d10a195b3bfa8d7605309f75af4eae431d36fa7e319f

SHA512
d4eb3065af2564b3a5e888d82760297376d82f471a92e2f73992873e6af3bd710222df1c34f8609a774f1c88c1a53ad8331bfda69e22ba0110f9c8db56b2c6bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2e589447c757160e558b8f61be9ec32

SHA1
1e4a649051269317902fbaec3589a71e55e4699b

SHA256
62162e03d02c5d58965957bd130083409d8c1a8e99cfe2312b5d0dba26f34fde

SHA512
e71d998398efaaeeaaaaeaee5655d4af96fb1360be400dfd5953013ee2aac6c7f1b0528b586cd8d6c95fe9d88e16326687bb363e3a6ca92e58ba26b1376cb366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e856274e485f0f78b1680a09a5c430ac

SHA1
081cd977d0f86c5b75e2607115d04d7986c2b79f

SHA256
c5859abb628e92042ca9177208aad8eabbe95b9617c696d54918767edd13bc5a

SHA512
0d74fcc2f904b565cf5496e6f3fff3c7c84877038e22f0157cf3fdbadac11c1ffc4d4f0e8900c2109b7972d6eff45b3afbd34e0444b8a07c8c6c55aee95d5dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
be4293cdb149bb1bc5d6865b4d29e995

SHA1
008dd17290766e1470befdc9b974f09ca178009f

SHA256
cbfcdef693934e499076532b2fe4a98d6e4b143b2e5ee47be464b752f51e609d

SHA512
05a9fb4c5f65df3a3fc4308cd89c0f598007d8dee0391ff18213a62d2cb9ae9d1f56c4f27b063f5e1cdba783ac0aad838494b13c5561c4276d5bea5577b13b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
79ff82bf8060cc57d34a790ad0dd5ea3

SHA1
cc0e40c9272376b27c2dbcad7245120de7139235

SHA256
4a968111d15039bedcf365c219a30cdf24736f7bf21a5b1e1bd74ad0a5930045

SHA512
7546e96bf21abbe30f4efa78b3e2c84ccc63acfecc84e53355968eb0f00c7cddc5b90346a158f568e4ceaf843840e821e66bc78a81481cc27ccb0ada78717fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ea31.TMP

Filesize
370B

MD5
a1bfd063cd854f3f134eda5ca9daf337

SHA1
b256fa78afd8dc6d1f788b4200d60050763646a0

SHA256
5e031d5b00ba7393d3f60c18d697a4923f06f241e0b27680a52ea7cec7c9dacd

SHA512
c32d76007678c4c07a546000b7c04a510d5d46d3d426ad4937be09fff691f2298df3af53e55b0fd666f4f3fb740e79027e7db25fda068e30a77bfb8729223559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4bcf33d39f8c4f3827945ac6182e6ed0

SHA1
9fba2565f3a82fe70436d67b5a69917d65b1397d

SHA256
8cc402f6b771a701e3fcf64b0a3958990a874dc949ceece5f8410484d53a987e

SHA512
ff10497971d9248c27fcd7154f4005f4e03905bd48952a120fa104a05a78b19e929450e7d35935b1b855909b4e86fdc27701d8ac83900f18751aabd680ed6d40

Download Submit