85daafd7d7ac9261894a50b0a9961950640fa48a71158b9be4bd314828c9119e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deda139f91498e36ccd8297dc46b3697_JaffaCakes118.html
Size

281KB
MD5

deda139f91498e36ccd8297dc46b3697
SHA1

7ec9690c35e09dd9fecda0759af372f7768e7991
SHA256

85daafd7d7ac9261894a50b0a9961950640fa48a71158b9be4bd314828c9119e
SHA512

aa6c8138f15807d0a3418bdbc6c82491e1a488f9eabf6a564b4240ea7d29813d9ede5ba25cd025f168f32583c63e5b2179abd9576c61e76d45788179cda76292
SSDEEP

3072:OgW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgMz3VY7RJvfy3di45C:EDAXmNR8/Ha

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
2376	msedge.exe
2376	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 5048	2376	msedge.exe	83
PID 2376 wrote to memory of 5048	2376	msedge.exe	83
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 100	2376	msedge.exe	84
PID 2376 wrote to memory of 5028	2376	msedge.exe	85
PID 2376 wrote to memory of 5028	2376	msedge.exe	85
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86
PID 2376 wrote to memory of 852	2376	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\deda139f91498e36ccd8297dc46b3697_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa333046f8,0x7ffa33304708,0x7ffa33304718
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13328240336304664735,1079510075766759116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ff3af06-d2e1-4fa2-863c-642d69fb4c56.tmp

Filesize
10KB

MD5
02e55cd296f19ca811ca4351d65a38f9

SHA1
00e1deb9ddff5cc0453d330c923fd4f616753cdc

SHA256
cd632fdfc7b8e4a8ab8c3ccb8ad46d8c54d2659b6e99d9dd266731fccacb3a0d

SHA512
d4ef2c77ae6539091ee4301e0b9f16aa4fc2a5ab956db00321f305bdb39d01bc6e06ef352927d9cb58f1d47860c463af7af32be0d45fd2a0980261dd9e3f14c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
abc48fd7cd6c006eb9f9c5719748c9ec

SHA1
1bfee875209e5a39e65213bd25322becf223d1c3

SHA256
862e5db88bc456d003eeb9ecef6021b12a7313427596ba87eb4771020c658f93

SHA512
62d9cd90cef344841d5f5acde94583c36d8541bfb6a61e72b6152d2054770ca3e056d702dc01fe7889a136972a12ce92057d84b9e9082903504cce730ef64594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
ae6552012044ffdab59d4a33e781a612

SHA1
4eb2c3927437719a879bdac394643a512c177dce

SHA256
61381f6e6a34621e3c89a6f608202233baff2af351d923495aef5814106a37d3

SHA512
6568c34bc73a492f8ed9d8b82073dfa5a51ac871ed8b887ff27fdbd7b010ed68277930571d1df44e15b302999c7b86d10b00f9569169d97491cd848f371b6576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8aa633841f2f1c2c4dc0d6efb33edd0e

SHA1
73be06b29430b4aeb3d19c3093b2bc14068d5643

SHA256
8fad4e356b23e37da23e4e264ac1d944496cf232ee2c52bfcc42f04216ecfacd

SHA512
462652d12d4ac5ce1e8bdef3950863f22512e143d93b58638c7d34a706627e06af92bab27a2c7710e31a8daa35733ce44399a5e15915f8f6f54f8b08e9dc3889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c31b6c2005b577f6667678b26a5c7be

SHA1
74ecc216280c3eb83c7dc4946268dc62a7cbb52f

SHA256
e5002a9eed7c78e198ff8407559169c007fe211e1490125cfd3f080d6904d543

SHA512
3a850444c97dd4fccb028f449d2cb7c191ce6ba85ad6df93c913daf0b53c5467afd3eeaa7118c1b1aabb67f8caefe094e4eb17afbd0fec893e840c8897d41fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b04d9b5084dbe166bbbbd477cb047c62

SHA1
334fd2cbdfed60320383402b480e025c3fdf41b1

SHA256
0112ba4d91df464a7789f46c80437e65ab831e6c24a45f2a580cf4597d791b76

SHA512
9680293385a8e1539b8d3870bbb20bc55c1f6329d1cbc55ee79ed85c448df8b2fa7ed6649a1efb3c1069f557cf6871fa86c9748e3504d621fb4bcb22a610b383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
996c161793b9f9e9591a1d4ae669e977

SHA1
bbe645a2c0050235e2ad696120021876f6e66ab8

SHA256
687131e224ffd5343a98cec649f425f42766efc26c030cb81697a4a31e3a731d

SHA512
1ab76695096febcdf2a41f83822221f36ab0b84a98876c3850d4a259c5babec376d55cf285d6088435003bb64fb074947a2c19c957bd1f7fa347d31ada2a0bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da5ed9d9ea45e6eff4f9d6c8ef250534

SHA1
80ace0f6cc87bf59556ca1732e5bd846313f827d

SHA256
cc4cc17c02f93606c4d5aaeba47cdac1329a1a81f5b181678ad4422f3af08795

SHA512
535d5ea132f1ee8be039ac2aafd356c43dce783d656db283f7d265f633ad52dd6e02bc645f48cfbdd2505627aa884418bfe55748c4eb378db383dedc3ead7e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
afb941b226f85971c686c4a9362405db

SHA1
fd7c00f902434b835d3c911153e0a9cd70f07d0a

SHA256
6cbbfd4bda59ffbe0fb0ffe923a5455791ac478021834150cba098d31a3ae67b

SHA512
79e8ca4c579295b9687a7bd3bdf4f17caf8837bc0dff9af0ac287a933dfdc72f70a24a93e8aaf761c30824de2bf4174bf9e2ce652cbbbb87cfed14361ca04d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
6b18987bf58700ffcc609073479abc19

SHA1
10eb4210fcd50779986a1476553081a35e9abc60

SHA256
e17a81fe48b4402e42c2d3c911dc0eea9a71c3704c02c35e6c049d248423dc57

SHA512
68f177bf46f401e5dae9fb6196440e2abb3d06f61c2bd3a27eca6f5725a0a717dad46e721edb4e026fd02ba693506b8f26543875790a60fb53f39f11fa984758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
801094e146fdc62de7aa831ce03bbc5b

SHA1
7a2f7b8119064184e4fbd31b4c251c0ec7c3c1f6

SHA256
34dd7bd1b38404bac47f800451a723da6ab18863e8faeecf5345f6294232a5f3

SHA512
d25d8ac6a0ebd840778959a94329551829c14f6553e95828826ccae72355ea3faf83c6bc780fae7a80ce93690fe806648fef09d449c5a8c2b9f781c15b356245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58316b.TMP

Filesize
201B

MD5
545299a413ca98739bde59543ed1490b

SHA1
144f4a120604bf7121d9b66801ce5930d16def09

SHA256
8de75cf438702d6af88d59fd3208a8c445498a6f18059be3b0d34ebbf1ed998b

SHA512
c6c3731ed9700690c7c8f2826a4ff17e4bb07e56e8e3ef223c976243f35663618b6a7f67c1e683f5aec656f13549effafa8258b7ac38bc82b1d7152ed4b6296f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit