26c76302b14ba81f092dbee99ae0c72c5a401b72b736ddffea284b98f5e92a2a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1cd430b383b4fcc7cebd881fa897be9_JaffaCakes118.html
Size

117KB
MD5

a1cd430b383b4fcc7cebd881fa897be9
SHA1

a5230187cd98391a17daff4b80c83a397cad9c1c
SHA256

26c76302b14ba81f092dbee99ae0c72c5a401b72b736ddffea284b98f5e92a2a
SHA512

98abeaaa9597c1025a6f8230a34fac3d3c53197a77fa67d1bba21ae9b2e7346f81664e1b8d34a55f46c6608826ca34a261ddd9dc9ebe4e7e18cd534d2d703a0f
SSDEEP

3072:BHz3RAe5fT22Llt8aN9+5K7QdJnmktMGb5:BHzKS22Llt8aN9+hX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
4728	msedge.exe
4728	msedge.exe
2956	identity_helper.exe
2956	identity_helper.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3624	4728	msedge.exe	82
PID 4728 wrote to memory of 3624	4728	msedge.exe	82
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 3460	4728	msedge.exe	83
PID 4728 wrote to memory of 1540	4728	msedge.exe	84
PID 4728 wrote to memory of 1540	4728	msedge.exe	84
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85
PID 4728 wrote to memory of 3392	4728	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a1cd430b383b4fcc7cebd881fa897be9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa97c046f8,0x7ffa97c04708,0x7ffa97c04718
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4052535272202616191,1278220004693206962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
a8bfb34533b54b8cd21f9062dc912ceb

SHA1
8838a552e9674a1d05f2ef02fcc98c1f8bde6d2a

SHA256
aced709f08b4f13989819a7d4e2e4873a81cf66e48f41c078d5970e045b78232

SHA512
76462d898577b0049eb7a2d3873a905e43682d0fffb86fb9922d797bfb51886e6f443ccaddcd010ad46b493090441865255da366c8e4011448414ec5c28dec58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ab80569e764c55b910ffe5ecf08d9df7

SHA1
4b1221b8570853268ea4eaccfce6730a4481fef0

SHA256
70a854845fc9c49f8a4fc497bbdaae3cdf7eb39b67076feb9ef9e56f20d35cd0

SHA512
29b82355262e95a205157e50953daa54e244f5fb75b6c1ccb6d0e67f60b2b7689ff6c06c1b304b3c73662daf801c3cfcbc476a7e972e446d81f485ce7bda93f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9905abcfe5f51b373dfeecd2b5d326b1

SHA1
cbc77598c7e3902d40e4f5ecf706b177eeb32f71

SHA256
dad27e2353a625a7fd1c352084a5ebe0d7678b3b2251225b4c543929490b64cb

SHA512
e3ec2ccbe5458a3b2f3a58bda172de504144f3c224c857f2f6b6275ddd67386f968943cd2ffc650cae13a064f0c6eb2767a78847860ec63e31695803acff063f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
467c854450314393efd487c2aa46903d

SHA1
0f68d2087ec65325c01c52facf25242957123c73

SHA256
d6215e4136cb8b787b2cf0b7d89ee31b5d722b5027f7ed5faa8ad074f6d88ed7

SHA512
f871fd6ebd219891678a63024665a13040778a4a2ea1f74b07480495856fb54638ca8898c83474b93f2425583d6c60fe3163251e8fc70872e50807e82d3e230b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d72281a6c6820f357e5ad8d09f8a3aa7

SHA1
f9c3835690ff80b7bd9869f0cfd0090ce73196e6

SHA256
3f5a15b2254d9a0718a7bac3a03859524d92aa2d38ae0adacb4a458881c48498

SHA512
1cc81487e05adef4d91e16b2e769d8afd3aa8288a2cd892e12dca20c2179d116d4f92355e031bc6d3728b8f614a7a4e3b40d80aea1cc3d32bd15978dc3af61f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
caa46539e4ce6d1af2ea26e0d1fc0a13

SHA1
7922fc9a6cc251426029975b533fa38f3ee33a20

SHA256
7ccbbb2422269d77874b5af5ba1ff1256fec0b67519f7eb0209d2dd8aa312842

SHA512
0eb81cad7ea9fa91b3c2eb238cdf0f26e743e191e0c9bbfff16a609bb97805701c5dd2f1d5a08bee853d5c765ca597dd1acef89220d20f000aca5a7240250148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe6dabb840b6a860705069d1e7468d53

SHA1
faca16b06bcc4b36cded736d383715bce7c8294e

SHA256
774d8deba62cc92aa8d5fee72501e705fe65b936fd61c5cbe93b62e1499d8fbf

SHA512
821ffb90ce8c5d0c68a7c7a9c20aeb08c13155dcf7ce9774f4e0590a480f31492cd2b619939b50c396c8104e047ababd463de1885a64c864c97e5241d9df0b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abd5251fa743e9a8a288b994b59b46fc

SHA1
abcfbb11e36cc2794518f94bb790b710759abbed

SHA256
8ef8082d2dd0632c113429ee418ab9cb50909b15ec1076ee6d97ab237f0af6a2

SHA512
a2fe6ad6e3f19e9d2f06b9532cd7c42bda84372d10688dc96dff84ca7dde53f72e2d12d67d9a3824a17815edc5968c9eef0dc5263c0ff4cea57e1425890d3e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b885dec4ec966acd289d350fe05eedc

SHA1
559b4d5bfadd5d35748440340dcb6721917fae31

SHA256
c7d3f5b649930e71e31a57943345aaf4d25ef6bd216805f11b8d52c987f5ed78

SHA512
1181218cf9deca8680136fef40b8e1dff14396bf2a324b50db363e6ffda272c9a2f8de633b32f0b82056e52cef2ac76d8072b76ce43495185ee3aa2352c501ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a53c76c11144dea72e018f53b20b9022

SHA1
c78587261fe805583f5f33692854fcf3016f224e

SHA256
b64a368cb9ab0d25b151e5cf6f342e62dde7b47d634ac8e152f9b705965b0963

SHA512
c7a0d89116f3047d0d6e0c51d47d9226f4e4fbe5c34513ab9a5e5c6cb61f86a22ce44c9d03c0e2960d8ac37a47cf23c93def9a05e3a2b9f348477a02c9ca6f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eea6.TMP

Filesize
204B

MD5
ce69006433285b3f7a2e450a48401e95

SHA1
22b15a34b85cf4e50d81f7f2c6354624abd0d8ee

SHA256
6a366209b83c6f34422a9791aad4709c7e952cc2cdc09bd8bcd78d83906c9c7d

SHA512
1a6fe0c498980c300de09bf76921c57bedc1a86432491d665ff4c37109be788febfb3de4e8a6a32eaf29989c2048b136700eff452a93531ee18456411817ee84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47611a43d69b67e9bf9eaa1ba83ba9ff

SHA1
5644c9a687d0aa3bcabae38bae9c82b67d8ceb63

SHA256
868138f4385f63e96106c063383e639ac9f110b12ceabaed122d1e59410bfbcb

SHA512
b396548ea9876ce7a89f2e03d54fedc0425db1f387bc4b5d61f614e7cf0108c870def8c29d3fc1eace6a3fec2c1ce460cb62de538ff7b5f0e1f83cbc1d75c6d4

Download Submit