02f4d1308957119ae9eb25bb52eefc958ac83077920343fb7a4a0bfac55f6856

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45616d00f0217e8fa25600a32cf4ffbd_JaffaCakes118.html
Size

46KB
MD5

45616d00f0217e8fa25600a32cf4ffbd
SHA1

5faca3ad5e88a02b53c4b340170332b29af63ea4
SHA256

02f4d1308957119ae9eb25bb52eefc958ac83077920343fb7a4a0bfac55f6856
SHA512

79a7937c8ff27ecc81dc974ba306e52afa0b9e8d3f71ccd18641d40ca6347b4d7f840137734a457d0b67a307cc26013fbfdec018ec9e916bd058469c8ae4b261
SSDEEP

768:SXSpmernLSeHqbVoaP4ZwcP2PjPMP6RqZqUqrqmqJQoCX8dVEgWCEEGOuiqrdVED:SCpmernLSIeVr4ZbP2PjPMP6RqZqUqre

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878641211-696417878-3864914810-1000\{60DC4782-D7E9-4D13-8BC4-81D359A321A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
4744	msedge.exe
4744	msedge.exe
4004	msedge.exe
4004	msedge.exe
5028	identity_helper.exe
5028	identity_helper.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4840	4744	msedge.exe	84
PID 4744 wrote to memory of 4840	4744	msedge.exe	84
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 3060	4744	msedge.exe	85
PID 4744 wrote to memory of 684	4744	msedge.exe	86
PID 4744 wrote to memory of 684	4744	msedge.exe	86
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87
PID 4744 wrote to memory of 2880	4744	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45616d00f0217e8fa25600a32cf4ffbd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae5c746f8,0x7ffae5c74708,0x7ffae5c74718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1658810747160989900,2664610312583033911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
408B

MD5
ce6afe3b63aea56f7ee5782ce33b4921

SHA1
0bf04735135b4aacc4e48e00d3b629af1a3bfdb5

SHA256
3a390155522128b8db72fe6956967d8c46686e7d0fe6ebd1d558cdab500111ce

SHA512
5c9d0d373d0fdf13412f75242a3f4705ec3600b35f724165657c97e98f8b65a90651f1fa0ce4723d659f8bc887c5a1c8524aaec9f9ac5ede815fc03de0c385b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fa94450b2b58ecab245c1e10b33da7c4

SHA1
383ada2bbfa7338630e36d0e2c7117d25a812cd0

SHA256
92e3867f47d3e37fefd6df9383f1f3b504f2d8994aa643c007260db9c6d6088e

SHA512
c21354cbfe82d416c3cd17ea2961c370b24326cdb8e5d0c27823f1e0c307cdcd2ef59441c54d6507002220fa868ef6259904cb3601a90162696489e0d5a22965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34d3d17d576e16032d5ecafed0a66f10

SHA1
e4d6e74ad4b04d58a6374affcbd45c4f311a86fc

SHA256
c2f17923196b17112fe8a0055e563b450105e5257a825cd93ba4e544174a4d73

SHA512
d0137099c77cfb8af09aa8752eeebb7613ba6d48ae12f77f732bb0935f55421a395ddfce9cd8ca6fda8e9105352adb4b69adf2bff0ab2a8059926469aa2f164a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6a8c26af7aaae821122cb8361ec2e163

SHA1
65c774587136904201651cca217d38197d0ea1b2

SHA256
abc88445a9cee1aac502912f91d2e9e452d936856ec22ca58f0ba47c1efe325e

SHA512
efefc104937aa5f6cac78e356d266ad892ac1e52df436aa0f6c4e382935a267c861b757d6b1087922d5bd3552a26e4dddf218bf8af8398900d09daeb03201fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1296b89654c06baf45a621fa1b87a1e9

SHA1
badadab39f65554bcee889a3b93a015f2a0d835b

SHA256
88a786ee207659d6527124613539dd5724f8c5df17439571464740fea11ef7fd

SHA512
f2f6a194fc0697ce599898a73fdfc3421284b01fff28905652051f496897f0efc93e92b8550ffa4ab09005d58253b9ecf2ce52568ec30fe81b425ab26dc5021b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
876B

MD5
1173d826490d32f548f05d81c70bb115

SHA1
2289dd15d642a6b3a319dce857a3fd10192ee1b8

SHA256
e8580c823f4cf56512b1e41dbf5d25f0d4ddebe02f42b2cff557b9b262ec1cc5

SHA512
00feaaf9cf9b4eaa3ab78fd2405adc2c5e0c1082932bed96ad5c8e33eedb63d470ce042493f925eb4519fb883be203a32f3364463054bad73c1af8e0b839d678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5857b0.TMP

Filesize
876B

MD5
aabd22d989f483c8afcc355635668361

SHA1
8213e35254d544fecf484fa103531db6629fe0dc

SHA256
87460adb560ba37ca597ae82c123bc9ba23b320975734bf68236771337e60b8d

SHA512
57006ba3d92a72060fe3f4bed4fd62a7c1f6022ced6c8fca0b05d96103709f25a7c9811650d36669c47be77e0a925aa997611ac17f6277bada17613feb8d0343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
23ca7662332e98b9079d985083d91feb

SHA1
8b8311b0e16dc8b86d732d7b2f0e21e0e8ec3173

SHA256
76fd5dc49fa9f5fcf53c4249d79d4dab794c9328ef3c10b6c043317e39fe0bea

SHA512
141c0932518c69b3a0de675b28e9fd9f404efa1303f10db17ab60934fe1b359684993b74fa2b835f09d460d5e12447ca3aa5fdd650ae6044f6a83c701f1b2222

Download Submit