9f06e714e150be2794d4796efe1d110cf472f1c01eb6ff2fe4200c3a6d8964c1

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08444607ee3df7560779109f609cd67c_JaffaCakes118.html
Size

72KB
MD5

08444607ee3df7560779109f609cd67c
SHA1

a12d0908748b3587a8d9742c092968161fba8608
SHA256

9f06e714e150be2794d4796efe1d110cf472f1c01eb6ff2fe4200c3a6d8964c1
SHA512

ab49535b4321fd030eee948f637aaac5db7543019ba696f4476937341345dcd87faf7e3985da3ec8c304a50d327de5ddfbdaec60300d5c32bff72a974e382fcc
SSDEEP

1536:6YGD7inQWWUM/OOLleUKbnEj0OhKmjfdUKbnEj0Av32/K/JB2ylOo:0WnSeUyOh7dUywplOo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
1136	msedge.exe
1136	msedge.exe
1468	identity_helper.exe
1468	identity_helper.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 3624	1136	msedge.exe	84
PID 1136 wrote to memory of 3624	1136	msedge.exe	84
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 2976	1136	msedge.exe	85
PID 1136 wrote to memory of 4668	1136	msedge.exe	86
PID 1136 wrote to memory of 4668	1136	msedge.exe	86
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87
PID 1136 wrote to memory of 1984	1136	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08444607ee3df7560779109f609cd67c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0bef46f8,0x7ffc0bef4708,0x7ffc0bef4718
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3564212928521556356,8266227629728681891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
891795eba18ca329edd804fb6c7b3955

SHA1
9f03723e3d91975720613056ebef761cfedd7637

SHA256
da0cc3566cc1a02d23a31cf5099229ad15585d69590e8eef3972de865191cb91

SHA512
876509fb45084258f1909c3654460036bf7c3e4c202164cc17367185fb8dd0bd2387af52b53e8b337c057776fb17e4de8a2435b156f90f1e61343e174233dfbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
67c6ff36324e58747481d89ad4cf9ead

SHA1
8a78866e9a132108c897de8d94a2fb4272d9b22b

SHA256
e8f5c4ae42f6014d32d2615ad0d99cdeb5a43349240125c2c396a702301ed1ff

SHA512
0709372cf93b5203afcac4527ccb2d1054ef4b6141d967327d74fd04ad1adda1522616b13ed700fb7db96368d71ccdc7efe5bb76ac701d193d8d5356cf44c914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
33b46350c2a5e277188eb3ea758355bc

SHA1
9a3312e1e98d45ae4577dd03c628f268c2f87429

SHA256
86b147f4574dff3bcfe9ef01dba24a7c64d0f8d774c0fbe1ca3da39f28ced122

SHA512
9927fa04776f6c7916f01e5a4c882e841eb3a96cd2f2c0e67f793969ce432e89fc9ede609bf3af2bd1c7e15ace1f195b8da46151a5c37783cac3ec0fec9fc3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b6b9ed9003b81bb70166cd17d830ad61

SHA1
88b5c89379e0437520b557112c0795cb06533056

SHA256
de753eba9a88db516b2973dc73732aad3c8a23db337fd313694ad5ebd65e8a27

SHA512
11cf9334729ed482144e99d743f696d81908e75111000da856fdd2180c2dabe18727d11effdbd8febad38a99a0b5ea228d2017854019fa6bd069bcb41790a84e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2b0a806ce93437ea54b7e812b946567f

SHA1
4f7cdcfa981bd572e8f2a5105446ae4f51abb0fb

SHA256
fe1c7746f6b7f5a98aa4c1279dfeb2fef7e59ce13f1f1b1405a321ad878bad72

SHA512
c56da01b165ca1f39d160f21308f3feed87d4d5a2c2785459147da9a733c859ee2724418ff0ec4c8d4851bc13fa11d1f27b3a0ac3bb22fbc68f931d60e8931e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
37733259bfe850df2e09a2d2e29d6a9f

SHA1
6db2600461b9a82b5cff9d139761cff079f3e907

SHA256
2c1f314c7e9acf84788babc5f3394f299f57831211e9c023ca411c4ad2abb90e

SHA512
3626863995a9386ea6525a9b2b056a24073533c6e34e1bbc4f7c4aa155ba26c383524aa1a2ba500500a0b9d25ad43f1dad1ca1a577fa8f80c47d1d19ec83d21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47f390fb22624f4881812c97c1bbc862

SHA1
4687c8f7696d317e151bd9f402edc70e53a7aeb7

SHA256
727175228f9e402f9165a6d8b77a1153999bf6cf7ea1c053d278e4ef9bf5d762

SHA512
805cba08647e563be74a6d2352f3f545a43c59e4add17417f065f12087623529d17be234bcd0ac4457231f7013835c59f27ba1989e9a4fc2b731c4e618bbd2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
191d18be3fe4dc236773df07b44524bf

SHA1
65f249849666b601cbfa1cef6366fecd1ec18ceb

SHA256
66e51ef17ae22b8b0b415a0660b9452664ad4a3ea35a6074fdbc86ffebe6a015

SHA512
d868ed490e9b9cdca4447eb3be6336e9d66954c68ab360c3eaef1b1e4691a3f3dd07876ac86314b788ce4d29f92c563452a149740625e3b31437b226cd079454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3b7034c2c984793aa8ef744db65b28e2

SHA1
a0ca9e6cc7b946d85f6440a603a7f9025c6bc201

SHA256
c3ea5470a3cd4abb632c2ea7be2f7fa4d1428389201c39317e104820774013d9

SHA512
80069c1d74f472765ed653c37159da8aab9aa43ec6e5531df1f28ba31882a2bf955910fb4adfac3ac399fabf67f767ce616240ec8e1f32b075e5068864169621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d397.TMP

Filesize
538B

MD5
db36af61d19fb418fbdcddce9eb66a5b

SHA1
d966e6c506db480751809bed940a33bbefdcdedc

SHA256
228c00aab94a25808994ba61cf3a19fdba21d16a73d08a09f2f7205f5d2ebf26

SHA512
0c0edf776426517f7d22cb56b216eb6186a28246c19910070079a7156d521cc8104bd565753d369d01fb0767375de883b7c0865b40910b33d97eb5e7347a8756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4bd341b95a17ddc771d8bc101ce17d72

SHA1
a8be69524e33407d73fc0ad4451163755f5baef3

SHA256
bb5c14634bbb0b7c0ccd4cecea6d22d6e29a6cf1eff8589faa565e25da7404b4

SHA512
65253db5931a5feafa3103cfafcc737510f66ce94cf73c88a328e51a912db5a365fbaa83dfaba27ad0f3d6da42a671e118f2b2740c3dc9a9ec7e6069e5185b6c

Download Submit