414d71de72ddc9fd90bf45c0c9452369ba61d9004442fbbba4ac8d5cab3227d8

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbf70c9a11923909f6f43535dd5f45c4_JaffaCakes118.html
Size

89KB
MD5

dbf70c9a11923909f6f43535dd5f45c4
SHA1

a4095cf49751a416b943e676132772d4bb7642f6
SHA256

414d71de72ddc9fd90bf45c0c9452369ba61d9004442fbbba4ac8d5cab3227d8
SHA512

97f60842f8c397351e2145d56169ff0b0375865b014d08f39dc52127171871152648237996e5bef20c724b7841d995c07f76ae78e72865332838846fa392f0b3
SSDEEP

1536:SZ18SPat0b/pRZh1IagXiq1kh0xQNDkwEeJHEI:SZ1cET

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
3856	msedge.exe
3856	msedge.exe
740	identity_helper.exe
740	identity_helper.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2340	3856	msedge.exe	86
PID 3856 wrote to memory of 2340	3856	msedge.exe	86
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 748	3856	msedge.exe	87
PID 3856 wrote to memory of 836	3856	msedge.exe	88
PID 3856 wrote to memory of 836	3856	msedge.exe	88
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89
PID 3856 wrote to memory of 1388	3856	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbf70c9a11923909f6f43535dd5f45c4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5645989890489545017,15046231972010310629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
2a9ce353c6b8d5994e29e5afcd411210

SHA1
684a6ddada75f0d13855d1d03a268d9efe3588e3

SHA256
69e926bd264479672a791172b9fdd0548d6fa53e072aada5091086363d3a6e58

SHA512
c6d244c4667a88608638a45990931ef77d5b6e0f6bab59cac9be9527d5a1e59b243140d848129a02d0b2f2aa5a78fb8e1adc078ba883259d45d1719794cf0c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
933B

MD5
53fd002a52b15b47e1fb51e531a1d11e

SHA1
ecf2c953de0bd7dea5509e96c1b1c01ad57c0822

SHA256
eb1a16abfe56620c3abcebd56861c6d6e10689ab7d88d541d1c631356f052bfb

SHA512
61e387d8fb34366d2012e53b7f7d41dfbe811b2cb8c693cfd27d14eeaaf1550bd3ed4ea8c9cababfa75c89118b815dcf5e2e527d0240b314c42a7a79e2bc907f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85ce3cc63bd942add3f41b193f19463c

SHA1
b123e5fee7c443cc33f5e89803477d9dd9816ce4

SHA256
3e8a1ac5b295969c993a8c2a48b0ee197055f4a2212d2579d90755d0cbc71b2a

SHA512
702fed586293b6e12f011c27b2029ba4fdeb5e43490991f235f53440cd9188dac065e1152c149e7568aaf145d9aa8f1ce0ae1ec152a742584c3f32053024d3d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1fc1fb5c9fe079dcac45858a5bb40862

SHA1
a3d95e850ba64ea998fe76663140e41fb96a2b0e

SHA256
d6e674bbec1dd01c8ceee766726abe1c8555366462c33b25749c1de84656512a

SHA512
56c7f5fce20af98c243319597fe7fbcf492a4a9187ec9fb682c0fffef86f8b8decc4aa5c86c9fb001c338bafecf0cfba58e6fed2cb755a4dde8e3724a35a8540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04471e75572e8d12cf4459a16fc749a2

SHA1
303022d426f59ac41ebd713280bf8bd1c9addb65

SHA256
dd162f345aa4e60a03ca54cecdcba1be4d072ea1a0827b65a7a044868ecf05e6

SHA512
7c06f21c1804887ffdd45eaebefd923d8779ba1cf1f1d7bcf22b4407d4187eec0750a3ae004886898012b9ebdea586e1adf052da5bf7562eb138d66a2907ef2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
9a3740e7fd88819ac2e4da1304674a7e

SHA1
2bb76da003be50b88b08f95f6e046a2df4c51ae6

SHA256
11cf0ee62eb2770b5b0584f044f16bcd8110f075d32be4cde0cbf0e090c839ef

SHA512
a14f011617f832a3d709134a0d362a0057f4f29c3db81ed2d8655e46bf947b88885b1cd6ba20bcc729c66bad3deda2e4a15effc7064c0c88f202ba9bdcd6ddf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58505d.TMP

Filesize
203B

MD5
a8f55f7d530e2e2bf341fb9e8abf3cd7

SHA1
01c17600919a97830f28636d2886b4671260dae6

SHA256
8f63aa32ea5f3a597c540789e687ac6b733f7c6b8cd4526b08d13f069c6aebc1

SHA512
73d9aa8afc2ead2d1db2176677c859b32af89df9c28c8a2328052d3717f90a0bd50cb5d8f12452d469cb4ddcd83c399dc80d76c4f34e7522ae48214447a90350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a79b9b365028eddfadf5717e1db4aa78

SHA1
3ea197c537e46f7082e09e8b78e5c6672a67cfe0

SHA256
2cd50712c0de4bbb3295814da8ed81f7482f03bfc07d9ae5beba3c62f23c852c

SHA512
666b8722db4f1ceb830efbfbd33d78a6709e2cd79a4ffd0fd6f26a1a96e0c3d36df25a2cf75157f1197734b495824a46d0987e6abc5032f97875f6b49885e8c1

Download Submit