d2f1520f1242fb832c7cc371e985cbe2713500a5a07ce28ee1ea515e441cd696

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53e9703b9dd2a6a2d3a44df18e32edf7_JaffaCakes118.html
Size

72KB
MD5

53e9703b9dd2a6a2d3a44df18e32edf7
SHA1

508ef616afb4ce122a08247484080b2bf6a87bca
SHA256

d2f1520f1242fb832c7cc371e985cbe2713500a5a07ce28ee1ea515e441cd696
SHA512

1c0f1441c353672906ee259235ac2a142bbf117eb426d83930a95ec303bbc10f5c155e8ca47c716590596732ba1f86ac6e532798b3eb70df91b5e25a3457d91d
SSDEEP

1536:ncnD7iqrPWUM/OOLleUKbnEj0OhKmjfdUKbnEj0Av32/K/JB2ylOo:mWqqeUyOh7dUywplOo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
5112	msedge.exe
5112	msedge.exe
2728	identity_helper.exe
2728	identity_helper.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2368	5112	msedge.exe	84
PID 5112 wrote to memory of 2368	5112	msedge.exe	84
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 4824	5112	msedge.exe	85
PID 5112 wrote to memory of 3192	5112	msedge.exe	86
PID 5112 wrote to memory of 3192	5112	msedge.exe	86
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87
PID 5112 wrote to memory of 3872	5112	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\53e9703b9dd2a6a2d3a44df18e32edf7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd452846f8,0x7ffd45284708,0x7ffd45284718
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7193990263361305042,15116920682982943989,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
e3c30f81bbcc52360e2e3baa482e2baa

SHA1
ae861ccef6738877cc80a50c8c16c797da7c7feb

SHA256
cfe8ae98edec87261d13d89dc25d870be22e071b5c19bfba5bdadcd72799a342

SHA512
8af64f2c843ad1ea574e0adfefceee4e60d4e774428f389cbb68ee6c39ceadb080c9d4e8b85c8f4fd1c123ec9a401a25789b096add96b09f6013bbadd44acf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
84dbbed3aeee406c8df06156d0f5ba5f

SHA1
f919b83c63850565753bbb766eb888340421b445

SHA256
c4390229b2be2ea6fe0cbdb71622cf077569a0fdd668dd2dabbcff3c02384d4c

SHA512
adbcc891f070f9dbff701d3191e4b407851523c048e4bed35fb3b50d136c0177464b7b77d2dea3f221b0d450bb9d848474b7219c661b1b0190aa5e96fdf1b98f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
01e6c47df36eee6f8ed0a199a15c95fc

SHA1
f9993803d4c81ec3b7379a3c1232c00897cc8630

SHA256
e79954ef3b1aca6599e0530e9d17ad3b725718d970ef7237970aa7825e895982

SHA512
c532ee80558a07cb71d778d6722383cc31ba954531dfc2c1f2b00c307aea1b6fefac35a09cfb4c5cc9399dc009927130ed2ba98f5b02d552c499a8b171ebaa04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c2b13947a109fd2489464582c5f2bc1

SHA1
e1db6bcd9f73473259960fa7bfa77f703c0d2d71

SHA256
8758e01e38295872a71fa6fc7ae216b63013bbdc2aec874ce3f551a69fdb4c5c

SHA512
5f5a25c339a617215c6435e188ed391afa30b93181dc8f4885447b341056e53f5d7db27c666b26c1cfe82820d3b6f4575ef6a4f659ca73ac443177e7d63bcfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de5ddf9fa64dfac1333cb4d7c573045c

SHA1
a7182e07fc01fa1e7cb2f1b1713f25796349950a

SHA256
4f1e2ac7fed9ca6f6bcc95e508a502982dc1a2360823acfa9b343d569181c23b

SHA512
0fa2b91df88f810397809fd46768e281dadd09b6644b80703319722445d3a6dc9124deb3fd18a8850c3a66635fec8cfb46379bb64ad4e2f97b94487b749cfb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c10943aacfff17c15d688e1bcaea9f8

SHA1
c7ffd4dc5d9e98e710bd1bba8e872b6ac0bfb5a2

SHA256
3ece61d1c67d553e8f4edba373f477b22e032caefa0be1b3703cca6101c8363d

SHA512
3be8e83207add65224851e36c3a7fcea412eb283c9e057c22f099dc9fb5c17ff77f9470404bdc174445e0326f70258a0a7e2efc378e24fd0520bd55b4d9da099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9ef921ce16e83ce0ec780bf2ebb8e96d

SHA1
4cbc3bb4ee25adb4e612e74710cc3f405984a592

SHA256
19cb5e851a226c6fa949750ff6d05fff086e0fd88196e3be9720e4c38299495c

SHA512
4e3fdba8789852b962b4926c709ba13590c2fc751b348100b3e42b15740d9fffadebfb060c6ddfc3fd4fd71a959da43dfd1478cc9f4ad7dba5d0dbccf69bbe23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
038d49fc7ebabe91f65cb44af1afeef1

SHA1
f06d0bffdca09da07171e3a61a30fc0e65ebcf30

SHA256
fbad2ee4ad7ddc7e7e2d84cdbfd0802980e57608dee353cdbcbd8872da2533eb

SHA512
318e2f22f951bda89cbbf5dabda59833147c1c4ab2b86663b09edc498bfa40b56ef774a780bbe4cfaa4557ebfb4bfa25d6e6de13e01dcdd5d7bfcd66f8f62e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
5306dd6f75f017e1b93a04f9facf3d0f

SHA1
073cb26120ea485f5b1c78d88dc3f7402eb98f7f

SHA256
b2064329b14dee03f773e4a38fba2eabd574631ba5142e052dd51c0b439d60bc

SHA512
b09b96366c269ebc9e37fbdfee9498f713af1b443ca7432d07332268d171f7085a8064ca7c2fb8057ce5ced913f1b0b688ea9cf0f53b64d62524e098cf4ca191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c4d2.TMP

Filesize
538B

MD5
f6bb23dc3c397b0e0a8e51c6d7a99bba

SHA1
0ad2a0fedc72246fcacb14d3037c48278496f1c5

SHA256
3867fcee4e4730abf03c7a0868cff03caf804a367986eb55768b44a619b676e8

SHA512
32cbd6d0d5da7a8c127135face89849e98bf1063ea32d355bcdecafeba391143fac02c9c556bb1e8d48cbc3d2b012dc211cefa48f8f0509d78cfd522f82666e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
916f5509c93a3a14365be10e9eeb2eb4

SHA1
3d80c701a45374a4c5e4070685b97db9405a4052

SHA256
7cf410a50864cf0c580c91d701a3222da4df70f5ff335a73cbdf5c37f9b2a8d7

SHA512
3a1c1669eef97b2ddd78383882e2cdeabaa0f5b22660588c3c9969b744679c9547fce11a03eeee65cf2f6a5229f695029c50c60e2455e22efad77ec9c3439e98

Download Submit