7a08abcf2bfb12033b1cae29828d34d6a37d272c6c1db429ce58c9fa3a27c1a7

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c6e67a4fbbc1a99f301558294bf4076_JaffaCakes118.html
Size

71KB
MD5

2c6e67a4fbbc1a99f301558294bf4076
SHA1

f1081377c1b2eefe866b7c212f0a8dd97deca9ac
SHA256

7a08abcf2bfb12033b1cae29828d34d6a37d272c6c1db429ce58c9fa3a27c1a7
SHA512

ab043bbaa2822eb401e61d706bb79129cdfc5e7877f49583aaf1dba9d69edd132ccaa3d1b280b1b99948836605fac0918f031c8eeccbadd74ab166724712a3a0
SSDEEP

1536:UTupBkyj64g+hVLwwMEodkhsNnM8aeBjXt9sr:lpBkye+hVLwlEodkhOMOBXt9sr

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
2428	msedge.exe
2428	msedge.exe
528	identity_helper.exe
528	identity_helper.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2876	2428	msedge.exe	83
PID 2428 wrote to memory of 2876	2428	msedge.exe	83
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 4860	2428	msedge.exe	85
PID 2428 wrote to memory of 3456	2428	msedge.exe	86
PID 2428 wrote to memory of 3456	2428	msedge.exe	86
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87
PID 2428 wrote to memory of 636	2428	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c6e67a4fbbc1a99f301558294bf4076_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd442b46f8,0x7ffd442b4708,0x7ffd442b4718
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14215225603217951065,9069291191006080641,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1bad1a332c4054bf31d9c5ee6d6aded1

SHA1
20eb7821999974b94860d924cc630c5d42fc7c78

SHA256
2fb4d9e6848f651e2cf24cf9dfd8cb92c312e5e3f01d09d8c275d6f3423a4332

SHA512
666840f20120a5f0614edb2b0b08614f5043c439078d5f4fd95b3e277f496e652f27fdc9808974f4a045bbe475fd7dc0fa0ad6edb9f60074919d1e8bdc58eba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
6226c2992f98e8a8b6e9ec4ba47cd6e8

SHA1
3ffb8133f9f0aab99d6d11585314b73a3152232e

SHA256
100bc403766695abf647ddd56f4a94bf6dc6d6ec12f9b052eaf580d2878b56e1

SHA512
77bc3200fd0ab4b05173e2a0f7ac70650dd0c8e51c02a6de4d2c0e558d96ff2c74b43c1b3d664e10854c74d913fc4110b264a0a189654fd1fba7a895675487ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
656d129e5f569aae296edeefb726a027

SHA1
efb4f1fffe64b0d3e0653e7b0b31dfe512f1d058

SHA256
6824a2420766e32b1de6c5d74d047f85528d028386858937381de0df64ded374

SHA512
473af41dfa70bc8a0efccca36537e09acc7a399c6a4aa9e6478ce14795370b30339de3c69cfb09cb2c72f35ee19a28b747f25cee88a8388b44f48601130e9054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1250e7018f6c01cb8ed3e6415d4ca17

SHA1
6363f24dc8c96a555a41dcca54d1b9c1a0b80f30

SHA256
74f0665e4e6beae7ca3e4a4de9f3820869f93e48507a062d11c883aca6b5ea04

SHA512
091c8a2bafc2156023b2f7c02cf5d1854518770e8580db45184bc056481a431f4543a827062590b9090c09c5aa3f71020a33a3aba5bc30314c198f80a990f52a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd8069fd134811f6553eb48337710f19

SHA1
7385cd8045618358127d0dc87aaece650370ac29

SHA256
6f33c61edefcb98aa884c65d1beaecc9a89edd44c5e74f35654b536ecf6c18ff

SHA512
11d55de618b2f5f73953bc2c443a45aafd2aae7e9e3668a54117653279ebcb25a66502b5604f8aad8e06eef9f96e8904b02bc5a89f889f125f60dff5eadb3b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f2444ef62a4e5c0cdf6d81b0dd88e17

SHA1
1da3a97a2441bd2384297407449f7f5af4de67da

SHA256
5fbd41a39833f3efa3c8f6ae6151ef2b3c48074e3fcd7f8b4c22c30c6bed0337

SHA512
bd7310f47d1d1ec5f05396f52115428209600f510d2b05df9a0950bd33d33b8fb44ee063335a1d110262026d94cf77c4382512c8c44e5a6130e90cb840e726c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c6ff2209dfe70eb0f98d6194cd2957f

SHA1
f930182243168f7401806d0ade0558e76a553bee

SHA256
fd53d0fb02c335182f865cb9970f885e00324c2421254258587345b0ff391f9f

SHA512
6fbbba607781bd29bb77d6fbe271e448bf8015ebd017e86db3891f6e81720a0bfe48bf6fdf2c6d4ec4c885903529a64b2f14c1e4ac42f7641d89038d24508153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
699B

MD5
c9cefabfe35a7bf9c20859dba410473c

SHA1
9f7f3091a1b10993bbc0a7a3a458db5b67c14f0e

SHA256
ccaf7ff8718eeaa72506d01fb69f1bc14fb23e26376e6b58087f79191ffdb2f0

SHA512
d00cba8357e6a535a845140b46b92b0410ab1ae4674de57ccf3a4276a9ded95abf35053acf62175dfc77e39cdfb7ac5f9eae783fda4cb1969d0723dea0ef3443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583c29.TMP

Filesize
534B

MD5
1caafb67f7181b022a0419a412d339b5

SHA1
919c7cb2eff33ed1c8aeaf9dbb4eacada032418d

SHA256
491ea7ff1252d30d7b47c190faa096fdbc48a2cac85186cfda07a4e86f8b20ee

SHA512
786b6ad202441e48199e7bfac829e38e628bc73799ef175e370df88a5cfc80f404b7bf1e190e7e1b489b8fe12992741f6dc295b87f9f25b53f84a0e9ca40f6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75d4c7c919e874bf3db74519bc24ebd8

SHA1
03d7f1c382626e4d114b5569a4282f693e329793

SHA256
5eaf96a9d4f076cf8a21eefba3db219784fe3efc97f3533f60161eba502d9d5c

SHA512
0ad4c9fdbfdee7c85c93551e92a2e6efdf52ceb2c75f965a7fd2523224cfbb914950f14841ac64966705ce1b04c054f2490e58c06ba5f519c587e95255e7e0be

Download Submit