7048fcdf0eb55fff244cf747a032176e40e60825289c63176b0603a8815fd4bc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2804dbee9b9f6ffe25ae75e87c5a0781_JaffaCakes118.html
Size

64KB
MD5

2804dbee9b9f6ffe25ae75e87c5a0781
SHA1

8170ae659a39e8a7133840ff58cff6fcacc1f80e
SHA256

7048fcdf0eb55fff244cf747a032176e40e60825289c63176b0603a8815fd4bc
SHA512

090a8f8e6e2ed56e6d805b9203fc492cb86e0d97aa7168c7e4b68a9feac08f383591b12f0311e7a9caf6e6d0164cfc32c0d5ad4a4528638587b38a120ae951ac
SSDEEP

1536:ghi2COnjTykB21y5YyY8eOq3U6AYlYS4RnCSNF:7OnjTykIskOq39AYl6CSNF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3912	msedge.exe
3912	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1280	3912	msedge.exe	83
PID 3912 wrote to memory of 1280	3912	msedge.exe	83
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 4660	3912	msedge.exe	84
PID 3912 wrote to memory of 3424	3912	msedge.exe	85
PID 3912 wrote to memory of 3424	3912	msedge.exe	85
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86
PID 3912 wrote to memory of 4112	3912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2804dbee9b9f6ffe25ae75e87c5a0781_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ed2946f8,0x7ff9ed294708,0x7ff9ed294718
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2351924025562774078,15494840869102691989,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
08d42ef0ccae3d83e9f1e71e6821e911

SHA1
5356f53491494d77dec6a8de86465f31a801e5a2

SHA256
1def7ce2574824d51f5bcd059bb2a3647c9423b108009fafd8e26b62d0801a20

SHA512
d88b0dda94a4f1771a30eb47920ec9952d19b8a631eaee15e01489cda72ce16dfb038d6fe9dacde98e95e31a87eaf9bffa1588bce813536d9e166e379fa45116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4be340ea314bdefaba5eac261e620adc

SHA1
3874bc736f1921ffd41011376a5970ac7a26e40f

SHA256
6fe53259c3b777c77caafca5240ab9b89e58cbf1b244bcfdb360f5c291169dc6

SHA512
ccf2fce5fffb7eab867362fe77954ef7b02179b75ca293811ca5014a23b43818b51481d6fb1824a4cbf95d2a535ab97f1a76763e5e93a6681ef0d877ab28a053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
27f0e52369a7c68b2bcbf493cd349a1b

SHA1
d2d418b24bbb797e3c8ee08b56445fe7d0da3337

SHA256
6161fca9cf70857d653c95c34de1cdc9df6e40c1c14121ae9dea2fa07486b9cb

SHA512
3e9622216d6cf4c8b0b04581df39c47bb16ece3f6d9186ed0849a5ed6111a7aff409aed45f0fd76947e9643e5171b89f137759e19f199941ab89d6df7e1453c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23162500b3969aa8f1bede1d780fb363

SHA1
8129a9980622126852b66f31b73ec9ca6d2b7cd0

SHA256
da243270c31adeb7bb960d43a96c001d1876b1216218f648dce09908ee2a120f

SHA512
047ed690296f6c9f988e6c986d5c41811c51fdc1dc39ba8637cc971b912c7f48a794a4b85d0d13f0ee29ed73bc0e0101c69b9200566b1771bd866cfd2da745c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46d7bc83229d09ef9a4c6518c09b15b3

SHA1
9a3b8fceb5108da69484f9419048a3a6f2a9a7bc

SHA256
e877623224ed9018e4cde1172f3d18c3c2e552ba6568ba9fc849a5abe979d7de

SHA512
30c740a7d40b0a59ce6213d8675aa6fb28a0c165811ff4d2ae41331f0219f5c2bb8f1ed8721205d292344ce1ac4607a8112f02cf2e728099c667204154e38c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1e1b3c17287b530a8601e7baa36c1324

SHA1
5464b63aed5ba7b544c353abcb5b82dc96ac8da7

SHA256
2e51ddc9b8a0f4058490c23d9298dccc11d9ea9c059dd33edce66851caaa4c02

SHA512
f917603881053f3fa6e37a34569b113ccd25762ed5a0e40effa65ab9531a76b79b8c2dfdc4b3aeaba7ecf2aa91e93584b80d056258a044c1fa889fcd12d11114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e14d0d6409d8804b3fca23e27023dd1

SHA1
083bcf86328805105db1d5521c31f2f5f563bfdc

SHA256
be5005cf7b2953fd884882b06c8639f21fa0480ceb70119b6d38a7dfd8955073

SHA512
12584fa25c642eeab10cab659dcd9f8dd092c310e03e2c19babbb6c980286215dee3e3ae5935546fa9987c418592150369b291698d3269260500f4d0d2ce6b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a0a796a1c937e9bc14d6d22547bd1b43

SHA1
b494553f28ff64dd7b2ac6d665acb309af8134cc

SHA256
6f5a65f74867ee21ee6fecbda7575c84be7a6fd0e23361334b79a7d9df4e352d

SHA512
f6f43f8aacfa2f9c662fb17330a76e708b8a2249cbf495933a43914cc45f7fc51b25446d773cfa120341f095e4bd9d69665dd17b2845337056e0127c2124a395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5800c6.TMP

Filesize
203B

MD5
ae2b144fcbae71c3bc7a029bb4f9691e

SHA1
67b78be761758f6028f9e65e8b629c572e5bafc1

SHA256
52f873c40faae5f5aec09639f335f8943f82a2dd7c00300a4d6c5d45de57dd41

SHA512
aeb006e99999087e708c6b8ad1c6ba08ef3e27fcadd18bc9dae951b637734e1887ed75df1117994f1b098a50dbd1368e6392122e699e04cd4e69305efeef9de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe81e98dd2d3830057ab739ea035bf9b

SHA1
9515e2192dbba99a5f0438b19bb7b606bc26dfec

SHA256
4c448208e23d46415b69d958edcb12cdd1a117f60e1b53f957357a0dcb105646

SHA512
8fc59b4c829982361a1a7c3ff071dfca10d8076c90f26afd965840f81ca98bacd108d8334596147f4b246a551cb76b26d0b8b4bdd2b5171fbb8559a43ce2cdbd

Download Submit