90632c143346b877dfec651afec06c806ecc57aa90f04e0bd00a4d5fd962db22

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e53f6fa5797f6927c79823ee5b6e8c2_JaffaCakes118.html
Size

157KB
MD5

4e53f6fa5797f6927c79823ee5b6e8c2
SHA1

c132d4c045d716e40b3c853feed8731e86a0ff50
SHA256

90632c143346b877dfec651afec06c806ecc57aa90f04e0bd00a4d5fd962db22
SHA512

53078a939c5b7fa65777c4b04bcff1ddac7f364fc1a26aa3d0aa9c1f7f0fa033d5687079309cc34a5f74f5cb49ccfa157f0f73a869750ac6db53339fc73888a1
SSDEEP

3072:1W/eIsbscyRzLhxNlG2Tj7suCz1V9oQ9SZQCAV2R:1W/eIsAcyRzLDKheM4

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	sites.google.com
41	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
404	msedge.exe
404	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2428	404	msedge.exe	83
PID 404 wrote to memory of 2428	404	msedge.exe	83
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2780	404	msedge.exe	85
PID 404 wrote to memory of 2052	404	msedge.exe	86
PID 404 wrote to memory of 2052	404	msedge.exe	86
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87
PID 404 wrote to memory of 5088	404	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e53f6fa5797f6927c79823ee5b6e8c2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952e46f8,0x7ffd952e4708,0x7ffd952e4718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3096489269475522930,1922458726091487824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
1cf5a3368af54d370ef3784c871cf78b

SHA1
eea3d89d64c52bd1454cee10a258e428827f4401

SHA256
6d09305417b0ca2cfef3a69e2dfb2226463cc987a9e32144835768dfe5dce239

SHA512
34a84c352830b234f5466a06dd3dbca9a51a54438232131776dc921db8f4dd1dddb22fbcaa0d305f7b8c7066cf994bc2ba1d9f5d6292715d7aef66f9f23fb16e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d60f9948b46c7105677512668c43d366

SHA1
446a3d3d36a0eef6bf00b85bcb00ecceec540b0d

SHA256
1fe2047f9062ad9f8e9ee135ee3c971bf32977f542a363ca90107add9d6fe787

SHA512
470b0b16552157ff93eaeea200dafbaec7f1064155e10f8521e538cd25f5c1310f7644ebcbb6e6a268678fe8c57af6b13623dcb2eae0f0c7f1f69816ee584e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6737a5cd9743a1b0f6aa2e893d05e18d

SHA1
2f269a312fc52b7fca51a2f4ca7ca3944d08d32d

SHA256
74229d0185d57377724370c2530b9358ca259c5d23d50d51931c940d8c54d9da

SHA512
9255a722f041c33425f95a2ae8e6fcfe4e47466c1d81fea23e018715d40d99f5ca487d38db1712c47919923dada5f617c7a3cfd9cca34531d68ad53eb1055fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a6e63ffe54d5811ddb664847a7d78850

SHA1
c23c1e7372f5caaec57f52f66b368465b99dc63d

SHA256
6c829b3fd1f9aba97aa4e5ebccf9f7bc19da8ec94a10f4ebdceb8c556bce5284

SHA512
25d2d81b9d0346ede9cfcf01daac3249f3d6573c3e4bae83c5bfdd0322f9dc9a0c0c39880ac62c7448a294011abe790c9f3a6530b42da4eae72705a07741d794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d0877da8a756024966deac7d22d24aa

SHA1
d682c6bcf2a8f600ae2cbd7b4f3d07bdd1acdd1a

SHA256
8066118a3085d5cf93d1ba7486c55bb9aa24b4c48085cb07e1d4626ae098566e

SHA512
1eabe5b1275a4ac2ce3791bd2bbb09007f9d514b5abdc61e470644cb941cbfcab232b4511c6e4970ba3f35d999d5958b3e8d7e9663a835a0f6706f8a85c140b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af4f03cef8d4448467c525ea66e01ea0

SHA1
3c5634ff41fcf8905f43f58a1b0e57510067aa88

SHA256
41f4a5baf84868641b0c20987bbe350ff3abbec0f6ca403fd6c81c0274e1d724

SHA512
ca6c00f9b04108145ca8b2620e23f30320eb07c2fc98d7fb371f39b7f054688db497f4295454e3fd6417cf0fdc608e34564e2d78b1905b9a56ac8d2470f091cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0f957cc2327e9f300bcd0c8812339548

SHA1
0de75cc992a051a2f318fa388b99a9dabbde5b8d

SHA256
b69519631ca0183899aeb4cff8acec344af2c1ea0977ce58bf902aef46719220

SHA512
cac6b908045ced09e24487aa5cb87fdafb47d686b28a14fab31b99bd69606fb01899e78ebdb6c11ada26e8f3cafe267d0bd9e4a468896793ae138c8e8c7ef6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d67a.TMP

Filesize
705B

MD5
7e68f73557ffa5bc38c2452c9ae077c7

SHA1
01b9f78304bf84605ced339b3f9b5eb66c05e3ba

SHA256
7a9011a0aabdefc0e5f8f4c31f9338b3609f0fe0c32b965bc3f73f520440258b

SHA512
02c20151a047f82c5ccc4590624bc643a46cb2d20c689f53d66e4a969f229fd3aed199b9723bdaaf54f250e2916542430812829bb79a20b1742f956386268a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6fc1ac1e0841098baa7e1d2c54abd86a

SHA1
1c46c15fddf1ef70605a72f495c7c221222307db

SHA256
dee7031da01145239b43d3981bb07fa45e566498d9656ed1509ec38a06534852

SHA512
80fdc204a5ccdc4384c823affa423d34fb7c0efbad089317b5eaa483030eb876dd142081adf1cd8c049fa445fd55abfbbcd08b34621925e993b733e3702f9cd9

Download Submit