ba35865a05d322608e82c79e3232c17b09e580845fcbb517bdc45d7c7711dd8c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

376ab45d4da90bd0fddb9374984a85d9_JaffaCakes118.html
Size

41KB
MD5

376ab45d4da90bd0fddb9374984a85d9
SHA1

214817bd601be2f1f3b93c18dfceaf7451bc8830
SHA256

ba35865a05d322608e82c79e3232c17b09e580845fcbb517bdc45d7c7711dd8c
SHA512

9b160dfdf2ab8a30c59d92597b8782e349e9f38f6da998911c41f35bde12c05a57802cd3e20b4bda302bd312fff74306e291fbf4d02068a4015d97826628149a
SSDEEP

768:Ccit1ggPO87C4YFrgxxLzIL4JJDDjMsv4X3qCp/jyYWDK0I6ICj/X:Ccit1ggPO87C4YFWxLzIL4JJDDjMsvKO

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
1040	msedge.exe
1040	msedge.exe
620	identity_helper.exe
620	identity_helper.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4764	1040	msedge.exe	83
PID 1040 wrote to memory of 4764	1040	msedge.exe	83
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2308	1040	msedge.exe	84
PID 1040 wrote to memory of 2864	1040	msedge.exe	85
PID 1040 wrote to memory of 2864	1040	msedge.exe	85
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86
PID 1040 wrote to memory of 4340	1040	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\376ab45d4da90bd0fddb9374984a85d9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb906b46f8,0x7ffb906b4708,0x7ffb906b4718
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5103564244371384604,806764278223833396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
859fdc6b832a146bbeb91105879a33ba

SHA1
547ae8f8329400b40f689b113ec291c96bbbd13a

SHA256
1740dc3c0aa763d6eab5b743e598171edc88bfaf1c656c09046415cca0c66d41

SHA512
7f29ed5766d2b056451463d2ba2f77888f45bf0071c90ca74b978a19d075d694b5f58e8293abb815644effb95aaa7caef039a473234083a73c7853d0aba7d8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c7aeb65ae6a43459a40ab75ee316c5fd

SHA1
d9f751add2ee7c20a6aa8f5e0186e9f1d4ac16ef

SHA256
dbb995f31e40ac296b4eb292065b6dd3c597ffb648ab03e9eb5af635e0a1aad5

SHA512
fd28aa8112f159d7da2e20ddedaf09cd24b85aaa6c978fda0d540a2cf12bb0eb46ef21ac1798da0799f51786149542c6ab3c32771a6114892dd5ea99211f7fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f71180f380c3aa4f48741f07938fd982

SHA1
279f268a67f720e8100929d57bcc2830b91ad83c

SHA256
f6aff3f0918c9487930cf5e1cad06bffea1196709b89da15e7220b407e3d1b47

SHA512
dccd422290c446f779cb6704b8e59e0b6c7e2ae816e046da23bc7b095c62889ac102d6dce4eea4f3a993d1151138498a4c11931e02b645f98d1a96c48aaff78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
79a7b41039bd3101786b47943e7cc43d

SHA1
6602f3ef65b982b0b87e296db70ed68a6576e23f

SHA256
fe38c50796e7cf1a034e00ad8b8ccbe48e028d9262e5489e6e364b10ee721e76

SHA512
16475f2eddf8e3306b7f73e7fb2572e11ef7dd41dab6308dc1b4325e6a4e0c756e7d8b18ae30462a95e409279b0338e906959ff16dddfc07e05087021fbf1ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b336c70b9948749b3bfbaaca713dab3

SHA1
647dbbf67f898036b701ef02c7e3550395960b96

SHA256
60df9565f48ab0d4cdecec2330f1a43e68d2e04cac1981b94d60ff3778680b0b

SHA512
1260ce04de9c15c2a51c36d022057e70575f22699d15b3bc15a7de1538b89dd57ad74491eb0ac56c3b2b86f5f45e7ea9ed6598bb5e4f22f1858fd4ca48501d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b76195f176a1a2cc6a3a549c432339e8

SHA1
9af0ea687f6fb04d40e14e8e1cbd46942c805cf4

SHA256
229004e3c6515701e6fd50bb56e356af2e2e534bbc037d969500a80b53fa403a

SHA512
02bb138439efa9975881dda0e1647d264f6917136a5a2ac4585157ca071daa3e449f23c71f1609b20a887456bbfd4066316cdf8b6988890102c5921cc759989f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7fba06eabf22189146a20f8ee15653d2

SHA1
71d1c4af0629701a58e386abab50382f01c14652

SHA256
31430af18c70d4bdf60702b0c7e94212275a5c3c2718ab3789172ca645fe53c0

SHA512
81665b0f48b54b893adc96935be89d6af8afeb5af8ad0ccbc3c442f6dcb8ff675494eea09e149b3791d0f15bfd732129fe38cd1b6f7e56aad42ecbaa80403dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
9ae069b88d4eb56cd61922edd6721e74

SHA1
2685324fe123a571f0ae6a80b46f89688a4e2ce3

SHA256
a2f6bc8ec0135328cfc34b367f30fc8adb3c29cbe294fad3841148b5550e101c

SHA512
bc732c8e35aaf614808d2fd815766000edd8799ce66e5bcfdf0ea697de47f907980a81a8c600778e19f787dcaef59c89212a61a8584f23e7a33b98b60b2bfbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583fd3.TMP

Filesize
203B

MD5
3c5244f5adf6fabd53bb70f845d56e09

SHA1
7d9f4f6b378b842f83c2ce8afc7eb627a83af4e7

SHA256
ee49255ebf4ca3bb583ef8d3d5bbc9dfe00a11150529c8d20f78c5ad95b49c27

SHA512
e959500b3882347bcd831bd1dd5e2b4e56183788fb893a546e73ca33408e2d93159b382086f412f5e35fb708b05d863c39bb0d954c9d3653bedcbf21cc6e1a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
69d52e9935699d86d1425423f6f1af0f

SHA1
d2bfe3ca9b7e006a707951d9715882bc56495c54

SHA256
2f26776ac939645cc1456a0da9c49a1b285bc08ac09d4bc1bab7fea1050f23b2

SHA512
46a923bf65a2ddf7db7592fa5d7752726857687f13a26acb05506cfd1b2c2bfd3aa71fcb8fd3931c6af6e9e413b72957debd3807783e1a8aa2afda66e02adc0d

Download Submit