49c96e3ee5005be0db6ecc17cc1225889154730ba17a98d1c3a1bac1953077b6

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c51b5833ade171235e793a71f692c2cf_JaffaCakes118.html
Size

70KB
MD5

c51b5833ade171235e793a71f692c2cf
SHA1

77a3c835bd33cef5a01005e61e9d4c3210d5f49d
SHA256

49c96e3ee5005be0db6ecc17cc1225889154730ba17a98d1c3a1bac1953077b6
SHA512

692301cb4005505d35d43a37faa957e002abd3b00439935ae607a6a96a5d9ea7f38af291007fa461e6088772cf4d7603f12a36797f055a03b930e964c2dc6f1f
SSDEEP

1536:MHvYoJZP88w1WrZqxUvC93IxgdR6TJGv8XMX0pFUo:MHA4h8jWrZqxUvC93IxgdR6TJDa0pFUo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
4056	msedge.exe
4056	msedge.exe
432	identity_helper.exe
432	identity_helper.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4888	4056	msedge.exe	83
PID 4056 wrote to memory of 4888	4056	msedge.exe	83
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2320	4056	msedge.exe	84
PID 4056 wrote to memory of 2760	4056	msedge.exe	85
PID 4056 wrote to memory of 2760	4056	msedge.exe	85
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86
PID 4056 wrote to memory of 4552	4056	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\c51b5833ade171235e793a71f692c2cf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5a6646f8,0x7ffc5a664708,0x7ffc5a664718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13971145284654283041,5236706766322674293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
41KB

MD5
9631c594f55c395f07b12046cb8fbf9d

SHA1
cd6532d1689166c19477923c73083eaaf8cd21e3

SHA256
a56a5d0f5f612bd39fb02fa1ff7a721a33fcb841f40c48757381b3b7c4a25726

SHA512
5d3bada46dbc583755c279b5ff3c155e15f16d51b6522752ab289bdb62b71abe1d91def5733ef7e77fc01d127508d07e2c67e731bde26a478c4780c8918ba105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
5556d89d78fa209301b8ab45071e5d41

SHA1
6804f5b96051b4cd91ea22526776abdaf204b598

SHA256
bb4b53724ba50d05edcb38986dda70ecdffaae9bc25c6d340353b1f260d723dc

SHA512
01507ba47d81e6ac27b27d59fd1fdd7bc802abd8fc309df34a84789d0fe3c54a9e7af9cf4311ebcc83eed40b14e3e9bfb79d145cfab146dc06e2a8024bd415e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f9ace2e3e55ce1eed6735cc179f6aaa8

SHA1
247d3d98dd6902ced5a550aba5633c31f385d496

SHA256
b4f8cf769624882e9c60e0d53fabe5e8f7d7cb2654c9a359295dda0ec528c152

SHA512
54d3b75c600a1ed8fe973e88cd70edd047cd7e2cd7c93f01014a680135178ed640f6e0c60bed82d6e7a4d7ee9aaea1c84b10f0d43c0716bf21c36ab7d10a8398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
930413dca19f654cfe984fa3fa5d1643

SHA1
f78028999a4886cd49fe0bce5be5c96f4b91af59

SHA256
036cfaec8a0af60ba7610edb91b4f9b2d1360a6a6e6f06cc309cddc2d77f45cf

SHA512
0c03feac50ada989d80bcf896d71ae3a15b643336b68359960bb07f3bb467b30f154b3031597bc02c1b7d97663b5b304bfb362fa56c99ae5b12e836dec3cd443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d65450b777e018abc431af9da6a9591

SHA1
7f446069ffc5e1efc6855ddd7274535ffdf5223a

SHA256
c8017110088b028e9d48d2a894a3c71a925fbafd50c7532bbe734ba6c2ca3105

SHA512
af5b9955df02b5e517a44ac7282d2809f6659f6cf5d2c8a5a0a49da5595cdd176268ce32e93900d33ded560ee0b4f8ba170f052a74a55b627430a545be490d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
49ccb877036e47b657b03fa3ce624acc

SHA1
bba127b93ac764116c782ae087b6e3ee8c1a647d

SHA256
8cc3672aa07ea5d2a93f9c3f8db44b9d56580e92b12545c2a7cb7832614ae6f5

SHA512
fd95bd974dd7ccb9f32858b78bb6c5b862b9fbeb2a37cd640a38cba83cf8c83989914245869066dab64517c895a538dedcb36bc5110bb1cad1a919af6ec3b548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df0c7a5f1430cb017b11d066c964d23a

SHA1
ecbb44a49f7d8c69b938a9d7264d24a091bf0d35

SHA256
1bf5cb82cb65349d566ab621db2a98ffb3b5da069bad35df4a144134d0531090

SHA512
65d0e4b53ee8ab534f5d1b2b2ea50d475298772e6c997e73a095860e9615a541fd30e4404252f3884c18d16d3eda9277f47fd3b901df60a41cd41ae522a922b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
f48fac60de7eabe0933986213b72a299

SHA1
345fbd79ca00385a80d9d6973bba4490248d6794

SHA256
0cedc4a1483090bbbe2181846c432779d2eab584ae1935638a8caf8826b85e3c

SHA512
6936ecbf3afbeb46abea09c50c12c67d1bb4206cac05b9505a04f5df402c572d8b44c6f65cfb7de1eea46a03ad4e50c77abeea8e809dd1c119b74887192f9df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58142f.TMP

Filesize
203B

MD5
923a259226e3c44c3fdbf7cf7cdd816c

SHA1
aab40c343db95632e43aad90a5629a97e0e7718b

SHA256
2243011676b6cf793fc1075f84eaf1ae73737fb4f98e091215c5b13788c435ed

SHA512
428e3fb7bd1c797be0302efcaa1f5a50115110148887c2f49619ef56fd793daf58d4ed1dc1656e5f95f7062a89d7e62483137d4d01029f4b0006fe37cb828f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee435f666d12433905e58c12a9adcece

SHA1
c27511fef39163579369813a4953b4ef7733d1bf

SHA256
ba78a5eebd6a5e48fbfc383be41d8d1fd022ee07100f9858a73da48c25bcc5d7

SHA512
9fc78baf3d051c73158adb24f70b28b4db6801c692c292417b5195e5983af5fbc97fd67f4199591ca7651f61ac678138f6f8973ac302b9ca0069b4e0c07fc492

Download Submit