e3d9bd4ad400d62f42fe2e16fc9c4c5ae41e308cadc00e574b365805f8a4a871

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c251071c3f9f4dd82265ea8ddf67d6_JaffaCakes118.html
Size

113KB
MD5

44c251071c3f9f4dd82265ea8ddf67d6
SHA1

f760a55616e1add4717b0d763c90ed6d3b0759e9
SHA256

e3d9bd4ad400d62f42fe2e16fc9c4c5ae41e308cadc00e574b365805f8a4a871
SHA512

c1576161a1584fcc4823d3e468f170eb93bbdee239d0deac1fbf2bab83a37b4ad4e23796c9faed08037f5b1686e0b03b9b72a15c920a06d9a7eb1cd7fccf7e44
SSDEEP

3072:KeOh/SSodbnckaYJNQMcZf+fMZCqx3+QTrNDotNLumP:eh/SSokYWg

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	sites.google.com
15	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
3224	msedge.exe
3224	msedge.exe
3516	identity_helper.exe
3516	identity_helper.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4344	3224	msedge.exe	82
PID 3224 wrote to memory of 4344	3224	msedge.exe	82
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 3248	3224	msedge.exe	84
PID 3224 wrote to memory of 4452	3224	msedge.exe	85
PID 3224 wrote to memory of 4452	3224	msedge.exe	85
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86
PID 3224 wrote to memory of 4152	3224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\44c251071c3f9f4dd82265ea8ddf67d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7952942216272654746,12042556498571902500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ae82f7fad33474829e84e3c7037de000

SHA1
a91970beb0a7572e2cfee9dc593455db58a48b24

SHA256
c2946f4579f8a9c3d8b48928b430d686271ed749169c17257bdcd536bc1fff8f

SHA512
8351bfec38845dde88a0192b2a23e596c6bf7870553b09037bf314b90ebca8cc468b632374d40f194bef308b370fc9aadba2f1d88dd583f81170b9d857375c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
6d06fcab75ba656a836c963a4383a2e2

SHA1
c6e5cf4254ed90f2b7fb7da619e73ddaa3ef6050

SHA256
e41d9b5d53f58b5ba8fa3f1f58f555454d137f2c83c6b9155c2d4090a8aba3b2

SHA512
66b6cc7d64699eafbfb08581d762b0167c0c93ac0231534c16c1073f80f4d8e22eb50a259371c33fdd8693e11007cdcaf8f0fc03c000bd4403f14b271e39843a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d4c96febf5b74f5b867b969438932686

SHA1
435b15cf9b290cb8c6cfc875912d4af6f7bfe500

SHA256
7c4feda7a144159347bc46ad177416141f0f4104526984310e77fe5b26906d10

SHA512
13124b8a9d8defc21b8c5841a13f04b7c8a9c7b2a3c740d92048dda76f05f02cfca874e72b347ab683a0b2cba0a859d799c17eebb6a1bbd34d09d97fc0c91212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9fbb2079d6f9c5826aa53e35afcef8be

SHA1
596d2f34f1c2043fe60eccdedc943f838198d1b0

SHA256
b84a1189a6323e9640407c0e2d9afec9fb79cc4a39d2a50acdfde9be8f9ab285

SHA512
0d5ff9ba11369ad4f81c12e38aaa831a6b47c05ffa8b0d522f3d1818343ab2b624052a8717112586d4744d2d0940c0f7ad90196bee809d643e46013d4dcfb0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55bd5dee41732c6d88eb1602225bd731

SHA1
239cf8a2f0aa79df765567a6e9fb5d80a09cd03c

SHA256
f4076b13fd9a5223b7d24aa3bbccf8d08c5505f04176021b62930fb9e2829788

SHA512
c5592aa3161711c3dbbdcc6440f73e50fa86a3026579c251d7a87bef5fc64028ec0cba3d7d2247688ee013ae8b6eed5e6680ba7dea80f83179fd69394c69c873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb16a95820eef34bd2bf642c0a881360

SHA1
e21adb6ff46b88ddf98c18f1d959b31eb1898342

SHA256
c8d25ddf97b3046f4cb70ac8d6caf134d571831bcea1ccc526bce2297d71ff91

SHA512
7e21d1aa08972730cd06e43666210f246b86fc2cfca327ad6ad7d74e2f697a26ddfcd41382e8ba2488fa9ee5c62b69e52fd97edca63844a69d74c255bc85798b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1aa38fc4ea9fa8b574590acdfc1d3218

SHA1
37870277f75dfe68e76a967f5440b8797963764c

SHA256
0da82d97caaa93bf6da08856bb79eeda95b30c94718a9edf062f36edebd0b73e

SHA512
5fada2257bac2083d85c6e695b745af51e34ef12369e6b226f62741dba6b3b657b4c8b790a5668685cf48bee1e2253f00fb2057f36366cd1179d56494fd63261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a0ab32ad8c7896e9da503e5604d8282

SHA1
60536b61bc24ae9187b5962b157fc5a9c95990ee

SHA256
d9ee5579bc953f1cebdf08a72618bcee9c41657dfc5e4638e9b55ab19eac5b22

SHA512
a6f910eb4bc8992886ef6a1571086f141875340508856a509913a471a3d0b560485608b26a61e87d063566f856e5c83ba3591799e4583f4b48ce5b6ed3248e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b02d7ad9c3802ae2378034e947e19bea

SHA1
7787b39dc5a634250f753e4c531b67cbe39a0b78

SHA256
d491c07477eeac07edd1f2b34f358db0c9edd97a925d287250e5646f9a2da8c9

SHA512
ae811a007e4466205fbb2c412597a4d1fd95c7eeb6efc5b518b450968c44745163c65353671a018f3bb74f240e00cfdc3bf591c46c0a4fa05288a92840a0f241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
7d9eff36ad21a27ea67a780746d771d5

SHA1
35ac7620d071927738aa11be51851d23aa6d6817

SHA256
0e2c2b336645e9db8569fea3e5c6e1eb18f01d3248a6fcd43938f0cee80c534e

SHA512
070443b8c57dc829f2063997946e5973ac543da4ddbb33b525287208e26510fb2ea5599163ad0c943c83603fdf5c0e0505399dde91158e4d928e0c5d3ee1709b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5829f9.TMP

Filesize
203B

MD5
ca69fe681ee6bd8c8142d8d79b7ec3a4

SHA1
55b1ffec2cc8cbbd5cff2269a086ab31abc849c1

SHA256
6c4e8efcc962946feff2ac942db6117db7398c0b7df584c7acdb86404a4da729

SHA512
58eeaee8cd6e42e171c1ff42957d618b2184e896fa9c7da330614467264e99340437ba290f47bda4c1704f3f26be795670e6aab6690718bbd7e42abeb75d2254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3879f42716181e00bad5828873a27785

SHA1
8829151e2ab4c7f538df1d94750c17feef701694

SHA256
ba9afdd6d0fb8238fbabc88b2f0828f6d5a5ad01503fc45d2f64d6df58f98d16

SHA512
0d665af9eb0433beda4b284ba62675f0a813bc95f429c303884c6d374bf85c70e95db995c50a8fb3542b55ff864aaaee66a3d15df6b52e409e799bae78b8c59e

Download Submit