f70a5a378f53e182c06c71b2d36be12ebf4aff223be288e9d69ab753f4a812a3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3466bd0014338f26541f731c610b199b.html
Size

70KB
MD5

3466bd0014338f26541f731c610b199b
SHA1

1c63692083770cfcc949f68e213dca0a3efa0942
SHA256

f70a5a378f53e182c06c71b2d36be12ebf4aff223be288e9d69ab753f4a812a3
SHA512

c77e8ae247a83887ff0589459f3494e6847dded35e95be816b50ddf37f8cb1c3b276511d7448bbff045e2d27a97e0278c5120c1b984beff01dacb78eaf9411e1
SSDEEP

1536:kMk5hP2zBjxEnKyI3ctsHdmc3JHcNIYcv3f85cwAi67cYkec4j/ckVcGW3cscgel:kX5NyB2KUtzgPkMf8ClWi9rCX7Ceisex

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1324	msedge.exe
1324	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 2464	1324	msedge.exe	83
PID 1324 wrote to memory of 2464	1324	msedge.exe	83
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 3160	1324	msedge.exe	84
PID 1324 wrote to memory of 1712	1324	msedge.exe	85
PID 1324 wrote to memory of 1712	1324	msedge.exe	85
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86
PID 1324 wrote to memory of 3480	1324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3466bd0014338f26541f731c610b199b.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5f3146f8,0x7ffc5f314708,0x7ffc5f314718
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
eb243eb6f1b8cd6a97ad2f17c1a25e7d

SHA1
620d3cdee4ce00d98d39472f756b87bd1b1c2243

SHA256
69e89b0134dde02323b051f8b80a364c2ee2ed00f709b60798493a77397e12dd

SHA512
6300201ae02c5f01dcde679124c7838297b4ea97914ecd27037023bca210b7578d294cfdfc1424bcd1871aa50cb68bf0ae4d789c7f7136bd510ab79e10c0aeb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5ab5b2045543e648bc6d43238f4f7ca2

SHA1
26386dec93ce548bcc50f04131f8571208026a0a

SHA256
c2eff1fae75286ca2ee0fd27f4f66d7723cf247cdba309f4329efdb7db8283a6

SHA512
8c74d69752ba22c0387939a7be0291cddd6ab1a29fb2dbcd2d90cf5c0e3136c28c4ed59faa34f5c9a85f9e3a379dbc56f1969aee0689bfbd22f69ae62f8548fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
23089d14d02381b4a4a828102d70f7e0

SHA1
1056e1ff1cecaa3066c0500d601fa85d249deaf2

SHA256
7fa0d19096221132a9f3ba3d815e6182df1f698584f75301aae393fe64f001dc

SHA512
82b57577df13cad8983e9ca7ae73a4f6461dbf7099fdd4d88246eee80d16e8730761eff5293fe2ef2f7e08bf70a02318674511478409783ccd05b9723bb0bc41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
33bbc899917d8baf96da5f27696a4fd0

SHA1
1b889c5db1ad43d49bd8a8c0fb5c8356e9cd3e8a

SHA256
096cd80b43094b5ee77c007565be939d5b2639b66690b51fc24d0bee0e636dd7

SHA512
a5d50074c6fe78698eaca1a2d73db1018ffed69a204ccd81f112fd746760325b70cb0de61cfed70f0f08bb4911219cbe8f7980c85095a0105a251dfe3ec5aa72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
720a71ee06bad32b6ea42eb357400ff9

SHA1
ef7fef65c5eda01d553b05a39b9d4999845d99a8

SHA256
e03ccb1e899de60c2ee00a625eff9ce730cabdb6cfd817437acfa57a0f972ccc

SHA512
e43d9dc8554ce6607d4a8d3ea794cd4c0dc4425e9e7e16140415b68841bf609d2aa7f103d454fb2552b0fa065945f50b3cd515cc04640ec37bac0d8bc2933f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
542b7ff6a0ad3e46b1b398301e5023a8

SHA1
6cedd071c2a3cc5523194bae8c81256dd0a82289

SHA256
80d68f221d3564d588fbf15034d276a51ed975d9bc6656028e1f13cd70d1be79

SHA512
b5d6dd1a7157be5da907a4428066db415932fbf47e46026067adebc7d36347c041a70dd8722dd93149b54aa76dd377d9bb05230c8a154092b3c2b94fd582cbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
79fca75baaac9ecb0a9728dcca668216

SHA1
dd9121d36951d664d40b8d06d2e12f8de0b20b31

SHA256
c371f76b6a293955caecfb834ff18c5191e7aa0dc2dcbe2a146687a2fe9cc859

SHA512
30829df87f081ee5d15a948c53379895701e1eaba056ac0916bdaae1fc99fd05e1d4cd370191f5941add2e18b6d12981676a2120e24d0c46a269a54f74875a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582769.TMP

Filesize
370B

MD5
fbb4bc4cb8fd49b71021720df58a3fe5

SHA1
2f23891cfff3cb20fc2d28da3bf1f02585d6492d

SHA256
c8035716ce5a8bd474a260a9494c9c879f584416fde31f843a99c630964b43c3

SHA512
0e8386a29c02ee6afaad5d7ac4a80bb1419618b9eb32c24e4cfc225ab38770a4c2f3e89d2d5a5b761efd56da3b2f22f5057da69d9da6e7ad6b6d71190fbc52de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a5ebb546b874d34b7be224511b661e1d

SHA1
d1a9797f6191c8349ce1e4e283a858a41c107b5e

SHA256
6c74905a026bd2eb9edc6723bc9d8ecc34bb74387c082b3c0f6f4d30df9c5d4b

SHA512
68a931153a9c7cc95e9a2a9a9e23749e1b2559dfc2ae5e67e3307a65827436a1cb47150d032e7b370bac06f82f087790d9a68933fb5790ace7a0bc54cb1853c5

Download Submit