76249376660d20978b2520b0b2f248a6251efe113552978133de07ee6c230d5d

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe
Size

4.0MB
MD5

ea83125444f0793b4a4f111ac8579037
SHA1

f0c09b5088159238c2943f0dd4b4fb511bc22061
SHA256

76249376660d20978b2520b0b2f248a6251efe113552978133de07ee6c230d5d
SHA512

1778b0cc46a9fd1cf0585d1e718ac9be0bb044f5941ec9539e0f21555dd9004250193c6c8f1f7f084bbeca7c23d962106b269e8c4cb51ac65ca19e062192b443
SSDEEP

6144:vxb4lxG83BGQFps74xdZL4Ego5ZyVWu356Ro/KL2P:vaG8h7WKZlZET56WKL

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5092	msedge.exe
5092	msedge.exe
1176	identity_helper.exe
1176	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5092	4796	ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe	92
PID 4796 wrote to memory of 5092	4796	ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe	92
PID 5092 wrote to memory of 2596	5092	msedge.exe	93
PID 5092 wrote to memory of 2596	5092	msedge.exe	93
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 5108	5092	msedge.exe	95
PID 5092 wrote to memory of 5108	5092	msedge.exe	95
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8696046f8,0x7ff869604708,0x7ff869604718
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8696046f8,0x7ff869604708,0x7ff869604718
    3⤵
    PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
922523df4bc6ddc9ad36b2c9a89ab847

SHA1
4859749dfaf216ec11f83ae9f1f5312a07ceba5c

SHA256
cbcb4ed99e5161c3f86d891298f2b376e1faa47bad89e8cba0c483c2e4aeaab1

SHA512
1ddd910545dcb4fdb0eca1797025c6e160b849da0834519ca9d6b304ceba8071e96a5d99ce49027427c85a05f6fcf992bfb6c8b6387102bdb2ceae34c4a3b8cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44cf28b5fa205326a65723c51404c99a

SHA1
339e89d9292bb75fb869071cd52226bda7d4e2f3

SHA256
71f2f2762c3f3e2769bab55883fb4fd90f01334a314cb42c92755849868ff217

SHA512
10e6a7426e4fd8547abbc491e3448a89b168b8503cf2fdb41222fd5fc0d102aca3fb265972382923f2124035c8bc2832119f2b5e7ccfc192bad2482a661d1ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8f137ca28bc00b57ecd0aa12c985ec1

SHA1
3f9a4589d3b3d2aa91acc4e6cc63941ce76bdf7e

SHA256
f006003c4a9255aea785084639c931d741c481b038d3184787f5e4c49ba1d62d

SHA512
07f1f5a6a0582156c94b18fbd92ce439c474898bd2ca185a37d0a65047777a5f606067422d3c1f52e86ae9f2ac799c293e70fa136d29761434b7782352f54a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fab6d6d15d9bbfac41322cf74ee5e24

SHA1
c7b7f64afd58ee6d3fd8e8eed572a5d7e37fc3e4

SHA256
4554c311393762d86614dc7334cf8ab6ea7c760e61fa5d2d1c74adff50154a84

SHA512
b42dc0a3a6dbe10066413eacc537ed1cabf8fb4c291b2ce36c98acb2e96de059fd69baf029914092e3dd72dea58d589a3c298e15e3f1a9a89e3e00a9ec1a7895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9c57c3173a44c08081c6b58b55046045

SHA1
f10ddf856132fc46c8b34f7d53e39acd7701b3a8

SHA256
6e5d8794418838f8ba6b115849761d073de177c9ed47dbfe37e25febcd9b3b49

SHA512
a7473dcc0d35666a96959c67be9777977f0842b0d949def0b5705089018f1e439865fd7f86d658263e31ed6cd6bdda580900e6a4183679a1130ef8502baef749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5fb43cc85b1992ef9cfcd1ad8e7681cd

SHA1
2ffc8f312e6301b1470734fc58b301a2350973ce

SHA256
9a897684f215490b200352b404ea50a75d2ade4ce5a43468c21519318af53b61

SHA512
34d61e6f6871662677c9b864374c62c6129c3d42fd32f8991b74bd2b1aea3e6daf8da9867ac4de375ec1b0640643578776bcea0022dca06e753e9e25ea79bc4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ddbd.TMP

Filesize
369B

MD5
a1c2371c5486814dbcaebfbb11e79416

SHA1
bcdbba6b96c84c35285a811de99f26fad1cf574d

SHA256
9bf5c5a7cde120417b4f281443c746a13e74f75413da7c1bad7827cf6d0ca943

SHA512
34f9002d2ad2af943e14d5c90f546efdf19e2701f9d38264896dc89e4d98c8493c4f9bfee5053e1fd2c0fa07a8aa41ace892405a459989c0b50771a0c8959603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b49285d8d644501117b21a362c66a514

SHA1
c988196d92a7dbc9f9393a70e4651592d8db662d

SHA256
e3e378d47bf0dbbcd180276e16c78d82e31c8b4965eee0ad4ddd98740a1ea21f

SHA512
3b92cb369627ec6bd3f20450575ea9d8efe9f740b11c56bd66292944be8b23b2940f656ca3a00aec12f46bb8b551a854e412298fe2c83792f7720d4187252422

Download Submit