b7e48997ddd07202d049ba87bfa76512ba040d89d0dadbb4d0519c7d20d8794a

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabf193b0f29133df8842b695d1dee73_JaffaCakes118.html
Size

114KB
MD5

eabf193b0f29133df8842b695d1dee73
SHA1

558c9e62e55c6c9a67dca66a4f980d65aa0c90cb
SHA256

b7e48997ddd07202d049ba87bfa76512ba040d89d0dadbb4d0519c7d20d8794a
SHA512

86f486cdcdfe1c449e9b8b8d67403b19d40163028a897e756ef2024bc855108d94f2f88232e1f183698167a23ae2f8d2420fdfc5cb8beda313daa8adf51eaf39
SSDEEP

3072:4JG59dzB4armwQULt+qR8poQItytVJBp8o+Xg9eUQtWuKECZGj5oT/QiJhKtbghk:4WdzB4armwQULt+c8poQItytV3pJ+XgE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
2404	msedge.exe
2404	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2028	2404	msedge.exe	82
PID 2404 wrote to memory of 2028	2404	msedge.exe	82
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 2320	2404	msedge.exe	83
PID 2404 wrote to memory of 1412	2404	msedge.exe	84
PID 2404 wrote to memory of 1412	2404	msedge.exe	84
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85
PID 2404 wrote to memory of 4488	2404	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eabf193b0f29133df8842b695d1dee73_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc103f46f8,0x7ffc103f4708,0x7ffc103f4718
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14819308280362692309,279665317735624774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84f833cd-e760-4e09-8d17-b0f156fa28db.tmp

Filesize
705B

MD5
508b545fadb61ed8192c38ccd742fd38

SHA1
659cb30a8dff039db28c9bbe451d6dc543e3b0aa

SHA256
a14e95f6780a37da61cd64b78ee9483350599a88ea8fb7944adb7f5aac4f235f

SHA512
afd8ed9c545f173719554250e33a2f1bafc1ea38fa786773445c93bdd3e11e36f6ca8438fc33484cf1ebadf79385b3c357a22fc8ed6983da195069e25895b07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
240B

MD5
38e2cd3308b7674820ae20e610059d44

SHA1
fb3af72b4189a3bbe58f45d179aa288c003b473b

SHA256
bf7478d1628401d72010a84e6b4090b69a1bc55c45a1ce983d943b69fe80239d

SHA512
ce99434452374e711ed617709572b13e2402b4756a94134b6980f10093e0f72c35d27a9ac591f85a41435e7ccaa38365c06a63ade990ab443ce99f0cec44a45f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
817d3d1937f0da48b2358ac7874e69be

SHA1
6183ce9b09737937530c8960abe02deef2ba6ee4

SHA256
25d32e6146c4b68034fdd7a7d717063a51ad31443d38337db75fc6248f3214e2

SHA512
125a57eb69907f87f8d59a89c8b8b454fa08246c669916ec264af59678ee09ef9d54bf6583b76b3caea821b076905e1eb3c9abc6f8487b212de66258050e244b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
87d3727637131a522e3bb24c421cee3b

SHA1
94cf029b3301950e8807b870049ddbf0e096a636

SHA256
967729908cf785782096535fff296c561a00c404ed20eb4efebb556fc8c7b8fd

SHA512
338d657661a5b5c4987ca3df385ba63841098bcf1e0ceeb6b99d4cb32fd558a1c9c2eb1f1cb8d26d5cea34e65840f8a515f767e37c06ebef8fc12ea3e2302aa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
faf580f6b32f0e42c30d84a2db3eeaa1

SHA1
1ab7ad3ebcd3c767d921a532900d61288a4a5cb9

SHA256
5e0b8cd3e13a3242c83fc1979ace22ef8d8eb7e95f872cb603dc98fd2fb12a60

SHA512
a3180818fdacc922e12786a86481d59549e504f7c04cb45dd0301c2300fc33eb39753fe690470a69ed200ea6723ab8e8ac8cb1b38c2a5613d283a886ac5ca14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
096d79ad47c0b295ee7243676a6e62f4

SHA1
2d5e38945fb8ff1c6633dd73d3591a37d9106f17

SHA256
b2fd807484634de411d076184a9143c29df90af99732bcf3f06a36663dabcee6

SHA512
8650ed433e56ab6d06dfe62db02790deaca02f8501388cf33e07a30aabba01563f27326b2465037c60e45a96004f70b52135fd34a726fe810f1601a6c820d002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99b5a11609b1f3fee8076164453b5d8f

SHA1
eb02b01a70050d1ca2b0e82d720e9285d2976674

SHA256
98f9e7d2a6f0db36e0c30e814a45e9011f32145a54b6589cef7d5ab29b19a0a3

SHA512
185ff24c85a82152846dbbfe99ac89864f17a0340ca5eba0a8bf7bb062c73465e9af1fc9381bb48754ec94be67e30c6947b2b223f418d43ac50fb1b27be28434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c66369136cde06205eea94ed1ffbf8f4

SHA1
b9381f9b999b6789e979c9c8b53f445ca8e87a30

SHA256
46d40b7a48c2eb40126c8cd90eebe734d21d704e31314e67c78e4c9eadf3d5a3

SHA512
966e97f980a65ead0eaa50e504db036bd27e7d35a7750d4ad1f96e2728257e9255a166dc59b757723d81c91430838d4ac69803f082f34899629ea088c4c5d5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5803e3.TMP

Filesize
203B

MD5
01188bb8456d4364daa7a3f8a9cb3fd1

SHA1
2d5269ed801d18ac68d2f2d374efb12ea985d2e5

SHA256
ac3b618f67582b518baa3f0182a64e5e3d5571de377ce040b9e9171cb436d2f2

SHA512
d5819625813fcf4981f123a31537ddf213250ee3f5e1a76b36d74eeef31a94b5e8fcfe1fcdabe7d583f74728b29f349bcebfec27060b982e57a0e81c5a8bb293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cebcc6b964322896a367cccbe1293d01

SHA1
2bbd98e42fd24880333750dd0866ea45b3bcd8d3

SHA256
39ad24e4c3ded0110296d0cdc6b65c9b81ef42dc44ecaf3b7c5b940ec27a591c

SHA512
075f0aa6879fd79264f1f78af117be497eb5a73c3e1dea8bfa60467d26a6412f64232cc7448ff876d48ff2fbedc54438b3e32256959d3be41811c146c89cf6f0

Download Submit