0e1a0971da8d98b4aa308ad9e68b655dca2a99f404551409d2a8cafd8a771b51

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab11f67b0a25c576dc9b0dcb32b4789_JaffaCakes118.html
Size

107KB
MD5

eab11f67b0a25c576dc9b0dcb32b4789
SHA1

07347181450ed7e3508a708a4537a94d820dc29b
SHA256

0e1a0971da8d98b4aa308ad9e68b655dca2a99f404551409d2a8cafd8a771b51
SHA512

03e5770ab759df523d9a3cdd094f7f4cd5a6988570eb17c8a2dcaeafe38ad5edac52202deb2e22dbeccc777471ab4f2ba0fe57cfae785c9e2232e191be38820e
SSDEEP

1536:g9+m+2QUgbsjcXmNRS7ODG+3hZZFZ6ms+Jr99ESMet6hI7:JUcUcXmNRS7UZZT3sW99Enet6hI7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
3856	msedge.exe
3856	msedge.exe
5044	identity_helper.exe
5044	identity_helper.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4104	3856	msedge.exe	84
PID 3856 wrote to memory of 4104	3856	msedge.exe	84
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 3172	3856	msedge.exe	85
PID 3856 wrote to memory of 4632	3856	msedge.exe	86
PID 3856 wrote to memory of 4632	3856	msedge.exe	86
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87
PID 3856 wrote to memory of 2020	3856	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab11f67b0a25c576dc9b0dcb32b4789_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff969c346f8,0x7ff969c34708,0x7ff969c34718
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12236730847986293219,1721568147060678112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c9a691dfd67a749e07d6fa3098c3938e

SHA1
5ebbfff63b130fd4269f70de85adb30b991575d7

SHA256
8b4deb405ea84c84873eb7ad36ea6e1878f8fa0bc68724a4c45f3347bd8e258c

SHA512
02c079e2d8669916073a8ef3bdbdb67a16839762c4af69dcbd701f6c0420e2710a8ce7726b5a7108906ab914b4a159f9208f05a088b1ecde9137285ba73c3b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5d16f13ee604916f9678b83675961734

SHA1
00c92d23c13084916339afbb15fa0ee6ef99e438

SHA256
ddbec8a749fe6351f9643cc6d3e3645a5a8f7fa84721af0b6ccf8da16f6873b3

SHA512
8e8042c46cf9d458059e1f1e3ca9f2862a389a049cd26b2ff19b600750471798e948b86978d4189e57956f9635ee93349dffa8eef90c020aad2c22060cd7c6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
aa8552c70dc85774cbd029c575505880

SHA1
636c0fae5d4ac279f92f9f56e1c9363b369fea0c

SHA256
d9c96f4f3ce35970008660061255a8388a018e0b759ba4f56621d0ef92d21473

SHA512
cabd22dacd8e6c0aea06cf4c881ff74803ad963efc9e7dc295c1c73a32a752cb83d278851bec4c15804d835961b64e0e776deae0af009599b0a4e5da333833e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
12b89398bef11927c646e669e3e9eb6e

SHA1
c3714eef8bbba5668235c21d5556f419dd6f8d22

SHA256
720309f1746e38e19a95763bb26162b495b4d17a9bcb257a5ee1952e4ebac6de

SHA512
3f802378a41235dd1aec9e9c434cc4b4893fc07c4d6c87ecdd6e342d443c7b54b87368b16cb34d812085387d63fe87015c41266c6d85266b6ffcf83531853f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e714c7c6f75bf836daed7157273d073

SHA1
014045ef6d7d805cc8e7a4cb38ec574fe8a0986e

SHA256
896a05a0d2b8798fae92670e7d54e736451b25e9bc4fbb6a46a33acc5d9c886f

SHA512
22c24d9d764d762250832264debead4ae42fc2f6532d66c7979d8060045596e25ef80f68009c7742d035f986110d803dfecfc4a8712827ef4f02c8b0b2c597a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f30eb71fc707981602266685407dded2

SHA1
fb4df0caa16ac904d88669f86d120cb9cec55ae5

SHA256
c1bcba2cfef47911c1b7495ad160cf01912629e8467371351763d07c06410811

SHA512
131544f5f1d693846c863c916cabaaf7780f74071614b2b172475d123d01f7c415589c9dfcf6d366a30d3411deafe336fd093fe647910e59c65a79ea4e7ca062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a478cacdea6cb6845ba2cfec55e2b9c5

SHA1
3c9837343622376fd7c69dcd84dace8bd8782ebe

SHA256
0cc504608d7ebc80611a79666fc318d13957e7b83a0b61d707ac803c0ed1c487

SHA512
c6de6b049d4c755f17ac0487b41fea9b5849c2a201d1e2dff72328efd10ac870d740f615b0c249d9565d44063a7b9d29716b944eca1d58e79235f0ea389059de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ebbd4d2e343391b1afa46f11b47d157f

SHA1
f22154ba759cdbd2ddbafbd3426016f061ee587f

SHA256
015e40d23f44c5042056b0bb9016c89f67806605a8a6113ae324b9b7ad8381c6

SHA512
2d9e189cfbc89ae8d7f4bd0bfccc8eeb6c6b1d7f40e73f5f6371fe196178b91c383f4ad45845ccc404b83220dc09cff445bbab8fef1c355c0a98355017e083a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c5a16cb9b60e1395e3481911c0e525d

SHA1
1ef65056eaf7dc639bdf3506d0c7d42267e5cfcd

SHA256
bbfbee47d02f40e8859f087319a4e32888eed1ec70d20e01d0ba5182b6e037a2

SHA512
03b7ff400651caf393f929af80140c5e5cd7811e88ba5c033f9b155a516848b7d0a849434abb690ab041ab50320d6c5a00c6cbdce78e9683f9ef8e6d270e6253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c309c9cffe0aa9d73c7eab667c9d94c4

SHA1
5ca5bf5204cc2e29e20de9c1ad42c88c74c2f38d

SHA256
7f09ac9d318dca2f81f6d4e9e801c8f345cf22de2c10d6dc613ee58da174daf6

SHA512
047f7a25c5b921567e6f330394b391358087c0b4c1e4273d4d287d26f2dca2ea9e9581dcfca3c7773da7c3299aecb9b1a6b3281473a2307d584f39ae8f2ee459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582bce.TMP

Filesize
203B

MD5
cbd9fb3888cae7172b3197ed21922f4e

SHA1
1ce67b0f69f7aa4ef84c7b93d0fd7d6972b64581

SHA256
7099fa22e4f978390b8d59def66c6c7c5985d0025c14ae929e2e4e467070f1af

SHA512
6fce82304ae9d8e47bccb408b4471024dcc96f549ff2b2ee4cf994aed5b0a9f5d7995516ca73715f7d666d1a37d2a06ac7c3c688a43b8a3f41b1d5cc0081e185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca7dadfc3255a49333761bc6e0b5e77a

SHA1
7efea96ad19d1e8dedcd744c8822085ccc9a87fd

SHA256
d848f92ef9f1f3faaf546bf0202f2b8373e20c6498068af1e851334fccb8d85d

SHA512
d9cdf483f4f2d486f53d9e8dce26fe0c0c3e547f101993f3e522f2aeaa399b46a24fdce9499208bf7e05a5cf28a9df0b2eaecbc39efadc140b2f28a5cf2a69e6

Download Submit