8bc572b55310a0647db0526cb872e73cd8681f46c170ea6e217c751af7db920c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

440494422197b8ffbc9d6278577b595d_JaffaCakes118.html
Size

108KB
MD5

440494422197b8ffbc9d6278577b595d
SHA1

352eae8dea2ceddf3dc3fe867fa216ca14267484
SHA256

8bc572b55310a0647db0526cb872e73cd8681f46c170ea6e217c751af7db920c
SHA512

4033ea038c4ac4fe0c2147239835031a4a2fd4d6035c9c3fb8cb9d15c1bb98b94acf3a56297a00fe1d14d03f1b31f79f52a0979d4890aabd4eb78d26880027b4
SSDEEP

1536:7tI5J/j5OoVrTF2rahPmayRoU0Ceyg7TjUF0vJw0/EPD/DkpI2Dtre:yYoVrTF2ojul0P7TjUF0vJw0/EzMDtre

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
3244	msedge.exe
3244	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 4092	3244	msedge.exe	84
PID 3244 wrote to memory of 4092	3244	msedge.exe	84
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 216	3244	msedge.exe	85
PID 3244 wrote to memory of 4384	3244	msedge.exe	86
PID 3244 wrote to memory of 4384	3244	msedge.exe	86
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87
PID 3244 wrote to memory of 4480	3244	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\440494422197b8ffbc9d6278577b595d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a5946f8,0x7ffa3a594708,0x7ffa3a594718
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13281801868181329458,11589049402991053576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
31c0f9ed6cce3041e9b1e2bfb9e30a76

SHA1
0a99691c81382a6fb9554fcf055a8994f03d3523

SHA256
cdd27664b2dd32199513a5f48523ae943b91d792bf84efb1caea5f47f4719943

SHA512
a40cce4836045250acf32fe22338e92a9d18cd0d393fbdbcfd8aadc2b348861bf13f3353863e94f409959434f1f1464c9a33c663700bd9c1e386d3fc807ce7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
acd1d3059bf4b96bb6e716a9df6c8eba

SHA1
c23b1c59e2221a4b851a5583cf33980235ed298e

SHA256
31c5c3abb0eb140278586f72df4618e8a4f9ebab3d1995dfe6eac65bee5d83e8

SHA512
d13d4e8fba120838022330344a2b79df98c799c6eff6f5a96b3408637851c6896e40cef5b9465e752ad1805414feb9546fd0e1bfe5bb51eb90400e08923f71da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
94788e85dc8a773e59f940934c512e04

SHA1
3963bbba448e4bf31cb09a2169129574e838711d

SHA256
67ea9e11bb0ed307304cd77e52d71ab5eb43d04b43afc8da07fc8eaa79d7ef93

SHA512
722e27c9de0aaeba391a573ee15e3196d4cfb2aafca01407e9b08dd802bef205e803ab5090969efc6faba6f2d9f371d8886345372e0c086f41c93c02386b72d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
637bf977985745676cf4f9167272d260

SHA1
787a09e208909b5a45623abcecdb90b138bc7bf5

SHA256
0f0606ec280130f5551e8abada235b6723011a7d8e760f880d70a279e6448788

SHA512
e0bb42bd0583f9583be6d4aa52fdb4b5eb15d9f7460a4d116170730431032429a33c70d52504c8e13b7666dac78ee1e5ae4813c2f043dae4b91e742af28c2863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4db5edd6d099c02cf74f8a43268bd077

SHA1
c2c684bc4b1b28e4de28ea8a5595d42d1709e561

SHA256
d010f5f7307b601afb47e61182b60b1a72fe713a0483c37f3032eb14bf96fc4d

SHA512
b0d0fb6d0513062f7123d6889177d61250af4f20145d2ef714714e86860948cf10dc5e6b4ef4b22e7a7f60cedac39eab8a1bafce5cbe90e9c79a3efcf2413163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e7485a5eabdc4e8896894b1868a28f0f

SHA1
0f843340ec78e950edfb32601a576c5191cfdb94

SHA256
1a152d088c219b3552159250fcce722818678be5e466624024bea8eb94fa9aa4

SHA512
861fc551fd423bd27e357752faf7dca8f51a2caf851383c97467271d2b3bd9d72603591f0db7909555ac675cf53b66ba099fd7fa6c3ffc1bbbd84db731b8468d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d97c3e49a8048284164fc2711bf8b90

SHA1
01c8fb6d9a709ceccdddf642551b706cc402ed03

SHA256
67c102319d7be10e153f3a0d39d0d240b8e3897991a02a9cf82dc7c7f005cd7f

SHA512
0615c440dfb531c563e7245febdc5685a339e3d72f7e3a3e8ec2c8fb417671daba01e8fbd67c15a3a77f4f6072f91cfd1095c2904801c215dc73774af1b14df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18a01065b5df1b69d4ecf976a6d8b19d

SHA1
c88932d6098afa9c4b47179b48bd0c84990a27cc

SHA256
b8d5fd48471be2f4090e4ca60e3b56522ab118cef2c7635c2be7430bd764c16b

SHA512
e38d0b41697f721573eb8098897191c97298078165db33a90c2026c82f1cd16d8ab2c443ebe3b0547247097cb9a578be30c53ee0b26a5ce2d4f064752d7a56f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
fd75d21d1d14db3d775acdb06f61945e

SHA1
ba41b156e1309b2262d1ed7489bba0faae2a7bed

SHA256
3b3ffaf7f5a450efb73d4f9c3fbe7a7ed86583314651398a0c73434a50c81a43

SHA512
306a823822617c5fef086800d3de3c8f82dbb6c52fba12cbebb6c3fb71a817f46c27f22afdb2a5c2411f1e4ae5305ebbb5d6df348ae5cf74b38ffde64e9a36de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ecf0.TMP

Filesize
370B

MD5
d80c9d552a506a9be402e3e02abaceab

SHA1
27e8d1ab4c5f29b772888392adb7aa538700dd91

SHA256
d649c0cf8cd59ed00e3996d334a3e5f54f685cd190e396b26e9aa668edb77954

SHA512
8bc62e0dd198f97ac35b387b451b8e4508fa177c309269590ab31e973323a80311e1b7955602d19869e881fa3d53cbca2c902e42498695b221a36ba452aedde2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ae83e7cfa51c1caca8f204c34375b27d

SHA1
8f4de527b01287d37bbec08148553a545d37190f

SHA256
6ccb055c6d46753edffb44569680813661298420bf168a7037e292e1f42b0ed4

SHA512
67d0ca277dff44845274da3df59a0a4b709296df7a729a495c32922226e9776991fafc6d084746f8c26adfaf93fbf00ccbe513e881cd94daeac06db4e8157e63

Download Submit