bbb22fecde4dd599f978123200a42464a67afdfdad163f8a603ed4772da82061

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba6da66263fb40ee9ae37018f57a46b_JaffaCakes118.html
Size

72KB
MD5

3ba6da66263fb40ee9ae37018f57a46b
SHA1

721a87681bac864a6ba254ef04a56c1f89a94058
SHA256

bbb22fecde4dd599f978123200a42464a67afdfdad163f8a603ed4772da82061
SHA512

4726b129f4f49579578b7e4a782fd14dbfe6955fe596ed62d773a04b1913f628caed5abc0ddc742a32a7cabd7a538be85e19b93e40ad5d12801623529b7aa017
SSDEEP

1536:josgbRT+FvsUglQNk/kKp8CUglQ+x/+Kp8H/eYwJI:jubHQNA8EQ+j8H/edJI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
5036	msedge.exe
5036	msedge.exe
2816	identity_helper.exe
2816	identity_helper.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3764	5036	msedge.exe	83
PID 5036 wrote to memory of 3764	5036	msedge.exe	83
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 4212	5036	msedge.exe	84
PID 5036 wrote to memory of 3536	5036	msedge.exe	85
PID 5036 wrote to memory of 3536	5036	msedge.exe	85
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86
PID 5036 wrote to memory of 888	5036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ba6da66263fb40ee9ae37018f57a46b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed0a346f8,0x7ffed0a34708,0x7ffed0a34718
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2292,7858674162359305821,14672271972818742802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
029af8b030c482befa059b6c55678186

SHA1
7ab24dff489e75694a35d26e3445684103d96e98

SHA256
2996257786d487a778a8a6b9594917045bfc6925a24543e6d512d5bc6c481bd3

SHA512
6af6aecf66e75976ed54dba693dc4030d1917394a450c524260538352c1985d6c940f3c2a6d1947273bc84c101fb11904c27555e293f9a601d01513dda16e7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f4db0162409451902e42baabf8ff7177

SHA1
1c3a9460534b05e0ad68747fac666f1400315520

SHA256
f14a193d9fc7d8c9d6bb8de733af65ab82188dec692c7938d8564e9624d3e7d9

SHA512
bebf8a038afbab9e1a3b49773866e2a90ddafdce52738842ea8a85aa6b60ebbdca57975787f944b495052690d89eb7b65cc0752be3b008ba7095c81c46ed10dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
6d4e82d788029a441dbe8acebbade5c6

SHA1
a00cea1ae3c5ff2470999fbcaf75b8ab71df9e62

SHA256
19e566f2e3aece0e7ca01973755275e623b4d736ebfb01c9ce90c0e0989d1bd1

SHA512
29654b40d5a6f923ffdc7bb88c89e1b4c5185ab1772b76d69f0b52defbc00a894f8b79a064aefba05dbf19c3c381be140790d386dcc56b91ea66b87fb4b8c951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
643B

MD5
67593e0e450a12dbfbf880f2d1c85b6f

SHA1
2d0a7e272e6850fbffb73ade03187d9039a04638

SHA256
8642896e0324d56b107c1ed32482d1dde2fdb2d8f3ac0422ce286cbfa692e883

SHA512
28414328ef94d064bf916cd6377ff10001098a82774dd9ae550545fdb4619dce8fcc121f9b1bda7149751e0459e230c0abd1d48fef4a5f8c008266c11672562c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
716B

MD5
48dd2553cdf3471c715ddde8cc681062

SHA1
152f6fd1e10987075d0220245e9267614b5c758b

SHA256
7bb5736a94fbd5e04a0f2bea1502667ed4935bccd2fbdbc8d4a57e076eb0cef4

SHA512
f37ecaac25545ab4f8b128f2858ee27a3bde95ab13cb39a9d952e6be8a7bd7cc1f07df4e49666b383e0358debe20cfd220d40ec230a931a43be15ef6ec17103f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e298af0f690fb33e66af45af11dd7585

SHA1
aabb7d0f1d05bd458c20e56adbe7f015391e2486

SHA256
16a072f1099b5d4a1496e803a8e4fff4b5ace7d2be0c0e9b17cc458288b10669

SHA512
4c782780d94a7e3b18c5568245b8f37a5054a5d37dfe2b85eb54bd5c14fcef88573b0f41a0ab93cc2c66696a51acdb788fc2d07476909bb939104e1e2fd1d4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9ae8233438be5c64567be5dfee92fb5

SHA1
aff4bd3e2973a330f7cfdc737fde82f6be834215

SHA256
be83b4a78eaf2b77710491fc7ce402efe2eb08f48c462802c41186b0cbf56adc

SHA512
d5b1c173161acb2df5d6a8fd2bc0d6af095de6ab8b890bf4191f3e4522c1dec0420e467f372a455b47d645804f147cf4a7437ea858d86a516d5c0cb8dba0eae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a73e0d97667e4ce3ce60acf253a79d90

SHA1
f74484cfcecf6e1709101505c0e97ba3f35e1b56

SHA256
340aa60687e71df4adbd1980606edc3c76a019afb94a8b3f58aa15ed6164677b

SHA512
551231b61205d4c7681a538faedc5c8df215b47ca627e67779d4f174c4cbd6b19d05438a2df1368bed0478bd6ddb4aa1ccf52191ff75a0fb8d0d6f62eb2bd636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa9adfe8e8280cdb8a44d0ab9c245a79

SHA1
893cd1a34ba0f3c191ba2771ecc6ac6d2e533fea

SHA256
09b3bf47f8818259ff1eb79ea986751c3a710c48a10c95bcb980f17d6d561738

SHA512
fe565f11acd17cea0ec426a472a9782cb150b87e6eac60763b8e2c899193e2f6df47be78cfb759361aaa76fcc0ba4eb438f9eee727b81e23ae953b816698cc1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0a75434bb58ca3feb2350c1a246a8d6

SHA1
958584a0e55071c507111fc035bbc1d79099876f

SHA256
f45082cd62f3b58657a847108ddec0bc56bf4d19cbdfd302c37a0d3691e9a859

SHA512
dcec287e95baba6c4a8cb0c3cebc32bb97d3ba3c1c6e3fcf9e73b8514f217a381dc761d6d07f7a45dd58ddcb85430eb2c52073a304178fad72003de5938ecc17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7154cfd7f0930e12b2fe03eea4259796

SHA1
499a3c8880665c941676fa4ee504a9e85ab80df3

SHA256
11f4830d8182658d18634ac93a018008a561b8f9d00506f288cdbea449e63033

SHA512
08c1099fa2af6d9f523986d0028b0f28901001321da70a163823c7e501e958202921795e034f60719d737c223a5a16becae5a0522600b820662df36092008b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
836c6c7b66941427f53a3ac7c4591cc2

SHA1
3f80b3bbe74ddf53425de11982c2caa876a4bb2a

SHA256
3bb4a38b6dda068b507f44854d3c0346bac506243f5574db49a220a01edd7b8d

SHA512
9d3c700c30823f5cbfe4b0d621b6198da0efd16ba512e505486187091842b156711b7d8512f66a1170ad25e251703b849aeb9d5f389c9a9dc4b2a497a277b87e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06ad76da2be22f03f165ab650d2f0ee7

SHA1
547b7653be764ed8667cc59fcffc66452ceb3192

SHA256
56fb2ba9c2acc036df06bb335e8d16a8f3ae8776e732f34cab07553b8917848e

SHA512
46d77118e384c3604eee6ca823eee776a79d157f0f7e4d1508a142dd2dd561fe6dc0a90c6a82928637797b09f05ad0577eb175c4867a4a6067290b3dbd7148e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02a1ed380710c34a16ba1efe24f158e0

SHA1
f07fd07df33bdca2e0dfff75f89503aee5c88160

SHA256
8032dd4486902287727b5d2fd9058d802f285a56b1777dbe535eb9d83e96b165

SHA512
f54012d772fff1717e08455ccbf876c72041c203ce5c1a46613f5e1cd7f6ba4b083c07c5cf52e55138a017b27bf783c27b5d0c06fd160f3c939c2e6e4f3d76db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e966.TMP

Filesize
1KB

MD5
40eaafd7748c2006192aa70c4277de39

SHA1
1a96a172f0d796a809effcb557badd7394efbf60

SHA256
c73b0430adc056b986d235017f42bc1e739030c347c5304779f3f91e8cf20f48

SHA512
59182cfeb71f3dc6f552a5232b42156f134fe121a4591994ab48a711e416160968fbe0250b8f3e5eaa755745130138d3595b7ac0ebbc18e421d834a6a807b96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17b0ff1240ddc009da662f76d50f1d25

SHA1
db76a3837939e7ee80a899d01686f136d574f7ce

SHA256
3f94d8082dba62c3c7f7f7bd80846c9097e772e528c151bdfbafd306e2cbafb0

SHA512
e81ad22949babbef270275e8a41ffc3a194f17c83152e6ee1137d5fdd55e8d22b623f8841e2051714ed50561bc653f134dabc03c9d155d51469c8890ddf481e1

Download Submit