0041f8bf199ea1c3db537dd2c2e7331dacc53ad39c7b6a3dd83ea31ef2743c8f

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbf3519e6094cf1fa0aae176a1c89606_JaffaCakes118.html
Size

62KB
MD5

dbf3519e6094cf1fa0aae176a1c89606
SHA1

8160c63710cbf875b8152dba35fecfd897ab2896
SHA256

0041f8bf199ea1c3db537dd2c2e7331dacc53ad39c7b6a3dd83ea31ef2743c8f
SHA512

842fa557a679016005821935587177f26a301160ae81d3dcfb531bb7b94f1c0fbefd230a19d9f5eab3e806bf5b2c9195434e23f0e007139ab74c9e293447c1e0
SSDEEP

768:rhy1StJi8FEwMrLtzcbzm9rA4I8XiNEdiM06U59nqjr8nvdIV41R29D357:VJi8FE76qdAJdNED8nm41K

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
1116	msedge.exe
1116	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4520	1116	msedge.exe	83
PID 1116 wrote to memory of 4520	1116	msedge.exe	83
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5060	1116	msedge.exe	84
PID 1116 wrote to memory of 5028	1116	msedge.exe	85
PID 1116 wrote to memory of 5028	1116	msedge.exe	85
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86
PID 1116 wrote to memory of 3976	1116	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbf3519e6094cf1fa0aae176a1c89606_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff88fe46f8,0x7fff88fe4708,0x7fff88fe4718
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15894690221577508859,15138098995407461827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
160e9cfabae4638bd9a39be2ed75c3e0

SHA1
af14f3a969ad53f7dbbd782d7e6a84b2dcafad0e

SHA256
c43831a41310664725c1ee89ce00bdf2d197ef8e411715ef7130b17f18430b59

SHA512
b9e9fb3c973868b27e448a53c669693ad6b01ba9a551f3eff7cbc0ea000a4bf375dfc26d00d8a3b94cea322a2abfb4b3df75af704e018387e08390543972ab25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
47eb9318cd127b2acb9432a36e77f6fa

SHA1
0358c3659af6a06b84a6362c2e6f237da04478b8

SHA256
7288c6dc5cc0d9e2dc2c9216ef79cd5b4c1682df623b0da0498691e986be2620

SHA512
3800610e8dc48cabb93aa1606f744584b516d68263d15b6d23977af562f17c49140e50dbca6a9621be8e0973e795d707fd22e3fb1bf43a00b680ea92ab5d44cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78a9040ae955bbc1489cf5c8854323f1

SHA1
b1cf458084d5e708fd690815b713daaaf05e6d86

SHA256
d9db8a933b835f58affd29e09a7d60247c8f5b4ce6f1ca7fd6cad67e1b651cfc

SHA512
be33682b05046c731c0e23e0e4e0b8f36343c953bff3ecebc442a255c2ef1ca2f53cf7d201e0175e56fbf28d289855c9ea8cc4d2bb1afd471c7ea1ecd0dddbae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d3e72f269245469d4bf466dfd87cfb7

SHA1
74c895075c0b2f06e214ab1ac405e027412bd793

SHA256
dc24bc2a2cd33f76a97b751254bb10ed8f32c6a546ab77c7a3a414bb9e4fed7f

SHA512
9b4bd2df1e132e9ec318aed549d3301844f72042fa464e0565f7afe0d56d543f6cd60828ecd8cbedec7a5162d059f68d9200f3df0ec62d18b7aa35074ee43688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
10c883eef2df5529b3a5f34faf924e11

SHA1
f57527c03ed50fe53a05139b095a6bd407e7b7a4

SHA256
463ac074f6e1ca3b5c12ce3bafc969123d55a1986286377edcd99f9e950572ea

SHA512
4b0fc4b9ee7beed6233750fd1a742b686eef124c1443043a01257a66dbe363a2e98bf2989c2da7c8159aed627a0a2c121fa785f8eb9cbb72746417648abd601f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f7802cb2f86d64f41b89118936e8f27

SHA1
0a5d6692a4f423733b0b3cf50d85469aa8f5c8aa

SHA256
dab99896378225141fff1e873181eb961b08625278d5b22079bd5d86d371b930

SHA512
7052ec35325e613c7d9cb7eea3198ad024256d85161063aaca1966e3fd6913cec4fc6de35981255aaaad6b29a0d815de5854374d412dfc7f9f5180651ce26f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b8d1b04b4b67728b6eca938bd361b0c8

SHA1
6f4bb92a03f78fb81eb97fed074e4ba40d16fa21

SHA256
cbd35783a5d9ad344f6b57895c5ee2b72d31ab4cc27ea723cb434eff4ac26382

SHA512
b6f3b99cbec46b38378cd7a6c5f79ef9edaf6ceaedd4466c94ddf3a097ff463ed22ecd11316c75e26e848367b5bf1ceb17a036caf866ef3e71c1971cadb0ae3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5820b2.TMP

Filesize
203B

MD5
7b3412c279f80318513460e963d1578c

SHA1
96e7096c209dda69af9be603889db74af33c65cd

SHA256
13e18479b61b078a43aff8e680542cfaa0f261484a7f6af9ad7f4922b30c2dbe

SHA512
3c169a078d7882367c9abd2c257b8d9f5ed02ff04492510dd9b41f8eca1ac71e72f8fd4039890dc7422e12b2e7d609fc99c125de4e3c015a896a0c30fbadb50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29ab6ff137e14925b14c1f7714796a68

SHA1
031aceda1aecc0598e98a13007b4796745f050ec

SHA256
2e0f49157d64742d862022c4c0a47250e568ca6dbd4f3b4c54d44df61e9404ac

SHA512
806107829b0f9f0eb801bc4ae248be4f3d04f66c8802dd2fb36eabb2039478b99b0f152f2b1f525ec5651faca3fa52163531fdfdfd257b1cba2cd408975b0f51

Download Submit