aeba38859c0910b7f170495c5c371cbf4a180886f3c80da2c226857badb4ae6c

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fabecdb2cf76392b3ebd746f22f1fefb_JaffaCakes118.html
Size

166KB
MD5

fabecdb2cf76392b3ebd746f22f1fefb
SHA1

438ec48af9614f74706199f87c5f9a5be8264e6c
SHA256

aeba38859c0910b7f170495c5c371cbf4a180886f3c80da2c226857badb4ae6c
SHA512

710f53070352e71e1fbb39a23b3ca92d32b3dfdbfe823379282ae1356e39fa2fbb34479de3d8f93b1f2270f8bd3a5acffd98edbda5e40e0e67f2b601719aa5ed
SSDEEP

3072:x6BK1yZ7z1WAmuRzbTKi3MRGG9lE/sMfrmBRt4T4C++D:qCnSP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
4876	msedge.exe
4876	msedge.exe
3152	identity_helper.exe
3152	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1124	4876	msedge.exe	82
PID 4876 wrote to memory of 1124	4876	msedge.exe	82
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 4176	4876	msedge.exe	83
PID 4876 wrote to memory of 3392	4876	msedge.exe	84
PID 4876 wrote to memory of 3392	4876	msedge.exe	84
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85
PID 4876 wrote to memory of 3628	4876	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fabecdb2cf76392b3ebd746f22f1fefb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed10146f8,0x7ffed1014708,0x7ffed1014718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5165076439593787106,3765085054589464667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
240B

MD5
7742e34ebc587b12be991341237bc677

SHA1
bb10bf6dc64a3f7bcf8e946294a01541c870f7db

SHA256
db56cd7ab251331db1959b16151af0543f8b7a0e0886fe2e1996430849c201f0

SHA512
634d5a028d74db21abb3ecbcf96b11da42a166c27e91bd83fdbb62cd98bd6fccf46ccb8b9d44dec3b6545e54e9b0a28bf4d02f75f295d8b6a3328105c1886d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7d113dfa65ff3f312e8690f09d97001c

SHA1
d70d95e5f703d2c94acf2044d27642fd22cf5d19

SHA256
a396229b1c29004236cd046102f868af9c0ba517229dc3dce36dca52e8bbae67

SHA512
5ae21a78ae268ba766681568907431ee910e774c2a8656045b6941dced0ce1bc45a7707d4ef8494dec2cf8c2081d8b6d586fa9f3c7546171011fb1882abd9862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
58a17f66eb89eb880459174555fc6059

SHA1
a0d523d7789639aed1c9ccd2531cf1d3cb211710

SHA256
8cf979cfcd932b61b2901a045f62fd7995ef2faf3bcc2fbd48bca98164e042d9

SHA512
bde76071da8d8d06ce4cdd595a40e64b3be4337ba6d9d345e15c052fb55f8f50eec83110fe78d6cc227db1bb5a1d5bf86e3c20d9fa9090132cc5a62c1bcaa800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7dd8aa764391567c3f876e50473697d6

SHA1
edba3e08953cd3942b74d5fff0f3c104aa3854e1

SHA256
981364092311c5ddaf8bfad22f2ebded737060cdef2ecc8ab5e3d8cc0d29adfa

SHA512
76b412909b2b4f780d085d273be9b496f3e164213821aa36c6a0f7beeb47eb08b8c19c78d50fa3da5f47f389e241d8c2fcfb023154c0604f49f82ed657b6476b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
215e8a320667bbc14bb64f413d98647b

SHA1
24eadec4b55e35ffe532cbce0613ae9f8b0992cf

SHA256
127267d433ebceed34d5d835da268ae47f41603ac75f6faeaf39c049d1c7f6bf

SHA512
f67ff4c8e2dfdd34f62df7900036b6bf874d0f61b8e3f9cc3918e18918fb5eb467d3948578bac9dd2a2d6184e3fd1ad2286e1f993efdea238c2c6b56f848624a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8601075c6a098c7901e304e4037e2295

SHA1
56b600d5f84318bf845a3de8944ab1c203b244f6

SHA256
7096f5e6670ab4bbbbfd6e7217d6a9b7746470433449b604652368fa529be5a9

SHA512
7bdb0c1f3f2984071f0cc5ca05a2713d840414a89f5490a2b434d6cb05b2ba7ef5d35fc8b7198d1614429381d473e3667ca861fec378aa6c83e44ff3ea4c20f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
438b0131bc76ddc6365549ab806d25dd

SHA1
3115cad627b465734d78969d2588bbbfd0a6331f

SHA256
26b5a2b0c1e10f7a2fa12c17d837377d19c6534e69bf5af4435f3b4beb7210e8

SHA512
b4e2af62ab82594eb8c49dc499b87904c308bf8ecc5be321a707c61ca74757ece14c1d016e59f3a44e960aad3b784bfc295502a601fcdbd6501510be21fc4ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
535a1a17106ae838efa22f952c53c721

SHA1
d05dfc5db40e1efbbbe8d1e43f5fc41d112aa9f2

SHA256
9e844376062bff1b263e5949d51bb041423bb123773e4cf92fa3c885ea6a7155

SHA512
a17cee909d200771bc7b236cc4800fba5058e41574f311a2d83a008bcac515b1eb2601c5d43cfc1abe2cbb21b1955c97b3eb9a26bb13c2242846c68043a6d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585bc7.TMP

Filesize
537B

MD5
8a9008449b0b4f794b929f9913ac6b28

SHA1
b5e448bb82158ef0b9197eaba2c0196694ae2904

SHA256
6824a31537d9ebfa39cd74cd2943b802bd368591bf6ea3a3e1daeda4953712c7

SHA512
fea32952e5565c1c4dd04ce37b6a9cc062e6079fe675ec27645468ee5b558d8033ece2734c668923e783b182112d32c6ce1255f80d48fbab3d3cd603680fb80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e782ad42cfbe3f5c0e33b40de5f0e3fa

SHA1
9b9fc75e1ff0abfa6cab8f6d37a3577739064cd6

SHA256
0b260aead184b5920b206d821738397abc88c98f5c5c66c96f31ddf7304801a0

SHA512
6039748de845c124e96be93f67d3df153da4983cb263ace0c98cfd931fd5b696f1e465ae48792645f07829178c262af362bd7b08ac01fe477860cddccb6edd6e

Download Submit