e894c6ac58ecafb6f2b694d8d25782f83d5b46f34e979c769213dd38b97db5be

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d27c993b157f2d73e88d274dcd9acbe_JaffaCakes118.html
Size

258KB
MD5

3d27c993b157f2d73e88d274dcd9acbe
SHA1

7a38f99f0043bff67188680c53f765906ebef826
SHA256

e894c6ac58ecafb6f2b694d8d25782f83d5b46f34e979c769213dd38b97db5be
SHA512

5f606e854e20765cb0a20ffd1236094c1371f371801af7b971ac508c94345f889fd8f5c69753a48d44480aeeff84697b13573b5ac6155eecf9604f5fdac13ddd
SSDEEP

6144:HuAHAOokyBGBFBQBeB2BBFqJjxBIa5IVz7ESXXDyatmT:OAHA/kyBGBFBQBeB2Br+mzlyh

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	sites.google.com
13	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4004	msedge.exe
4004	msedge.exe
2648	identity_helper.exe
2648	identity_helper.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2828	4004	msedge.exe	81
PID 4004 wrote to memory of 2828	4004	msedge.exe	81
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 1192	4004	msedge.exe	82
PID 4004 wrote to memory of 4352	4004	msedge.exe	83
PID 4004 wrote to memory of 4352	4004	msedge.exe	83
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84
PID 4004 wrote to memory of 3920	4004	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d27c993b157f2d73e88d274dcd9acbe_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c0404718
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8464862465037369363,13285871834259649903,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
35bcd7076c6f68127ade54c91d58d54d

SHA1
920dda4b503cc216da813b094a45f8c2a1e64525

SHA256
a79fe7bb4b75e63e02e1f4d6aef3a4b8bcbb2aa7c354099992a889f3196ed484

SHA512
a7673a96342db2745e8bf3f894d9052bbcba8d2215d05699dc0076ac028e89a24ce2da726731c104a96dbfa9cb7e973358b3b0e560216b368879c3e18f746879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
58a9d7d636eb73b3eb3a411af3d82068

SHA1
01a509c52901bc8ebfd80b402f048a065f8958fe

SHA256
bb4b12a7451e671992ec5d1b3b5fbd9deac52d6ff0074495c9842af8b920e383

SHA512
2a7e06002c54673161d31ad573a86aae50ce6d911b3101bf149c35cc8218a3f9dc3c8722d6590c26cf9a7fc3f1333ff5ccfa57f60a05c0ab562b18b22524fd26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4d32782447da25de7869153b5ec8b9a9

SHA1
9394012133a1f3e8760c7a5f9226acd3339982bd

SHA256
a09a92ce03816eb840facb2d9388758498152b0a7f4efdc50a86bfe9efa593b7

SHA512
4cdc8dc1980eda0e1c8f5ffd7a9c55a658043ce584513c6a398ccf00b8f5758e651c22ac824f4a042ef025ce7ed459b888e6c003c33757ea8f270e6ac56ba33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5864278b27615fd9be5d9634f47494ff

SHA1
27f5074bf6d5bd6a67f5b94229ec2c11d542a848

SHA256
4c9a2d095b1b92fe02dba8e76eb5111c33189d4ed6741673dbaf3d2382be6a6e

SHA512
27bf06da78571df79f34000cc6407308d9e153e232547e763fde7ba8590ed43b16951df1b4f11d26ca2cbcfbf0596a3f2de4e845266d940e1a484d4d5d3efcbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad24fa56f72fcbae32dc6b1a026459eb

SHA1
858302f53263bdca738f23c5b372206ef1b4f428

SHA256
32da9675268355dcfd74068b6c8cc5b206ee625b83205897d439f9fab6579cf6

SHA512
6ea15c68860b59b601fe4ba0490ded4bc76c930af6dc97383668c276e3229ee41b4cdb2d16ac2d317faaf9cc665465bffd747e99a661688a354624e0971b29c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c4e34a509c8c731be94640d0fc127eaa

SHA1
eace0ad04eae59922807c43b6eb1fac2216bf105

SHA256
1c5a2bda4aab807c915a8b7fa1e470b387fd4854ed30abcc30347cff630b94c8

SHA512
41f7d5cbcbd6bb8f42ef54a9c383bd56d483aebfbe69f6c738190c0f0c932500a22fbf5e0b739d9c2acc266b48efaedc90b388d95bf27a4c9e591e19a5ab20f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c024141e4e5873761ee10123f49404f6

SHA1
61d236bdefc27b00c1b0ef28c00f321002c7f1c1

SHA256
c42f04db1988b9cf139e8e0a3ebf633126aafc4379161c0edce2ea4505d30df2

SHA512
0fb5b5686f8ae34016061f570f63fb0bb7d28dce2dea58f70667f6d2b5c9048c6055cea3ec4eb6e6944b102512458b4c22016ac857f0f266e1fe4e39f588f3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f75a2589284eedc96de228516533103d

SHA1
f501c43a0448bbf8f11d50dd8f4542fa36bf7297

SHA256
272b8b3b63d0ad6fceabfd9624be88a0fa243b53ebb898c2d47cbb1ee0149a07

SHA512
ad017a8b8032dd2e7aa9539cc760c6abab9fd54b726a1df9f5895afd10008899507e75719dbbec4dd8b71940b5411a2fb5e1c8a4aa8a556f8e84c04b134f84c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
141331c6eccdb3729758b5aa69b1b9ab

SHA1
7b9407111ef12278bfbc23ecb7dd9115933a8689

SHA256
bed5e0805c73522b7402583d9dfa7fa3cf7b53bf62b270d9e3027a781b340bf3

SHA512
ab907235292571b2bedc38970c3f5a50f4db4cdc15f5f047d36dd41a90aa2b44cd84e222e3665ca8124da01e4547214c97d7a0028195999ddd476b0a8e299406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df15.TMP

Filesize
203B

MD5
d8d534337aec5924598bbaa206f257de

SHA1
87758b4c67fa34c248170704ce4b69eecaec06fa

SHA256
3d1f6dc1ee83250b0a3258609070bfa9e99a2ffb76e0ce0bb86c76f9e8951ae0

SHA512
8c0f1a4a860386a482e6c18d8ea94fb5740f4bd34428b154df474814eb507d17d5daf1a8d7c5b7fcb7476ca7ed4570aadc280d1ab35738e52964dd096ad6b9c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a17eb6a896292b44dbbad10ebf7b7778

SHA1
e34ac17a4d865e583d1ba3de80dd17c6f9f49966

SHA256
5eded521b1df26824f10b7b97333147d813e32d5f0b0fb41ae85e457582ba044

SHA512
51dabda20ad7f78c6d7db14c2b8e479fe027dc2de9c8f90d58bd9b8bc9d71186cdd59de7c4e817d4981235182226360e6b9391baf2b7379ba05aed7a1bee5133

Download Submit