6b7d8c9137222685fb4bede042d5c22220a3e547b585506e48c98a9f9bcd3c41

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa91914dcb224c1ab692d33659a68759_JaffaCakes118.html
Size

256KB
MD5

fa91914dcb224c1ab692d33659a68759
SHA1

577b7d10db4af86e71412eb7f641374cefe495ac
SHA256

6b7d8c9137222685fb4bede042d5c22220a3e547b585506e48c98a9f9bcd3c41
SHA512

8243e8cf4b136462b232fbf60f5f9c2a9926529cbdf1de093ff22c77c0721fa2eadfd82b7b61c2539191e503234896060305588048760cb1b851c391496f592a
SSDEEP

3072:O5WJRA4Gkm5WRdxU2L2L/E4vVVSvKWTBXMMw0vFBiupuMvNoURArGEpU:fYLJbMt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
3016	msedge.exe
3016	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe
696	msedge.exe
696	msedge.exe
696	msedge.exe
696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2612	3016	msedge.exe	82
PID 3016 wrote to memory of 2612	3016	msedge.exe	82
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 4988	3016	msedge.exe	83
PID 3016 wrote to memory of 2504	3016	msedge.exe	84
PID 3016 wrote to memory of 2504	3016	msedge.exe	84
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85
PID 3016 wrote to memory of 4008	3016	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa91914dcb224c1ab692d33659a68759_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f8c46f8,0x7ffa2f8c4708,0x7ffa2f8c4718
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16449590807945372020,10725639202467241216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4505f7dc97624c373429c9d50486ed87

SHA1
21cc8c462174948c7a60c251beec988432eeeab4

SHA256
57cccf41a7f1a6bb1088d158e87470c53364736d1ce9ede777a2e3895721bc54

SHA512
d8ee38075e968280ccc8cb2aad2d7c5a9ac5587a84d4f0d73d7e567b7d21e2c8b74225b22dd76af38c88e7910950ca40e963fbe755e383b0156a8101eb0c5916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
5a74e1e357caf2c3f9508cacd11a5ce2

SHA1
9f7d3154dfb8ef745bd4ab6d53a3f94f6599fae5

SHA256
f1cd247dc281bcfa5f8626e71f34c7a6a5a1437885d870b06f56a79aa8470562

SHA512
99b553179abffe6754638fbb6992839d2965b1d861b8e7da729308f54be89e5e41fcb3c89f15cf46d4e72ba058dbe0ac987145f50e407047918d100d545e1c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
001dfbe5bd0f296a5e8666e8f86b3fab

SHA1
d4cef0e13af57c99d52779d8ef99ad4dd6cfef94

SHA256
9f452d6c83b8ccbedea43f4e78ced9cd955e6dbeaee318d6db937f28c92d965c

SHA512
c5b779d673ce5fa015e7c75cf35981cde30a7e10630ac731813ece8a3a9c18caffd93b81e455927a4fa97fb63e51948ef34ac551a59fc637e9fad5df31a9b944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
759add465957e311583ec270a87c03f9

SHA1
2eae06f52c09fe1a30fb657744af5404ac03fe6d

SHA256
c2820170b900e5da2f2f0c8c2b706a7a2eea58e1c09cd37766111ceadef25791

SHA512
950f6cee859ab7e0a7f673e7e665e7941debff0af392f11d97be1ed7f89dcef3c12987bf0fcf03a31bfd0e4b2c2dd1338b01bf7ac17d596a814874ecd242872f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
121a30826cfecb3f5e954015083c7a7e

SHA1
88bb11ccce4a9f3d348025695cb541b61acfd505

SHA256
18cf5940c5b83d1d2986b130ef588ad27f04ddbf58262f83a8ca6e19932203ff

SHA512
bc2c1daf06b2253b9ad9413876b20c69ff00e61857de6148fa8c1813670e215c0fa6e53a545b8133416c085d46e9ab54a24ce9e3e27c9a3786fd98b5ba10f720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72e8956b4626882539059cd4f259e529

SHA1
e470b01d4baef413f61323ab65dd48f2dee41d6a

SHA256
b568d8d24a631b78c69dfce0fe31eba3d3635e25d6ea606f070b7ad1f65a5ad7

SHA512
70c4aea10c0be5f26c8e5dc50b89a52425c0d1479161ec707f498cb853952394566cf737274fd33bafc80a698efead5c30954a38a4b1a97f238b3a21fc2cde2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
109fab1cf34d9308f4810dcc55ed2d10

SHA1
11debb69c858ac7f8eed560e539a5c6bfcd832be

SHA256
7dc4efb8f152b9cdd8ed48815571adf80aa3006c5b3ee262cb2b7cce6cb09c7f

SHA512
c2350388e9c8cf886f6457a721a61c2778b57b39295de3e55942839c06b0345fbbda69d51f70cfecb61b2bf08d2a030ac2d4bd38a0fd3f4784621ef967d1252c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2725143f16f68e01ccc65fcedaf186aa

SHA1
ebed245028ec4e5edd98d9704479acd2569582d4

SHA256
917355332dd5aa64434b6c1bea2a4c8605a135ace31ee19370b837dbf09faab6

SHA512
1d04ab57115c4314ec2b77e523e15b4749d262254b9331b5b004d40bd371e3e508f4b9af70a1ec5691f524f74537bddf05de7de6c1464e8035e2efad82fbb5d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
4040092ae885936284454f22f6e542ca

SHA1
3eb96f0d215298167cf919753d286d3e3ccbb894

SHA256
7e62c282518b27b20b4916ae72ae78ad160b2dd1af27ad946563941a90dbcaf0

SHA512
895b226853c528faacf4116c3a37fc0f2fc2a425bbcd303a8518b9af13e454d0f2cfe043a409a4beba923e707777a99e1655f98ab935fa2f04397fbb4990174d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f472.TMP

Filesize
370B

MD5
0772de5cca730d4ceade57a7ce4e4c68

SHA1
d772408a519dc16f673a8bc1a8d63c0451d0edac

SHA256
ac4629cb639dea2bb72a6f092423bcea14a1a9205610ee79555ca1ad929c7d6e

SHA512
bdbeb8e3b24fe7583655341603109a6420e41d35bc44a316cf951d3a8282a6229b713852d15bddbdcaab0412d4979cb368db326f6f03a81ed17f9997efa9b06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ff0e9878ee90542f6bc4fdbbbc72787

SHA1
09e5038a7b2a68715944eccaa3d729c215229f2f

SHA256
875949a452083f6df841ea6c15521f8bb2c15f7a543b938ff1276f4f993d34bd

SHA512
4c5df95e9a70b90a129b23e34df3efb1eaf92faf742e72a670c5da06a3af6c19a52261a30b3ee47193b0219df5aa8103fa649960bd81f982b6b2aac4dba8e38d

Download Submit