30d67e1fd74815d843fcb8a6f5080efdfd52e757c4e2b946ead78d683320cbe9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684b0b38612c2053780220f895d724a3_JaffaCakes118.exe
Size

336KB
MD5

684b0b38612c2053780220f895d724a3
SHA1

1b0376f07f7f6074ea53b97feabc0c13f6acbdc1
SHA256

30d67e1fd74815d843fcb8a6f5080efdfd52e757c4e2b946ead78d683320cbe9
SHA512

ebdc61a43723c2ee8acdf48714f22fd17f376d2d5013166bb801e9e7a68b67bd2bb9b04d6dac95a292aee8e1c4d3de2626738f79a16f5cf0fce0f2cfaab5e102
SSDEEP

6144:gi/XCM+znnTkCfhVJNdykL34cd6bUfFdXThUV1wT10pNjYeNc3uETnJ:gi6lnTkCfhVJby7wPXKVuT10pNjYj

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 372	3328	684b0b38612c2053780220f895d724a3_JaffaCakes118.exe	95
PID 3328 wrote to memory of 372	3328	684b0b38612c2053780220f895d724a3_JaffaCakes118.exe	95
PID 372 wrote to memory of 4644	372	msedge.exe	96
PID 372 wrote to memory of 4644	372	msedge.exe	96
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 2948	372	msedge.exe	97
PID 372 wrote to memory of 4756	372	msedge.exe	98
PID 372 wrote to memory of 4756	372	msedge.exe	98
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99
PID 372 wrote to memory of 1692	372	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\684b0b38612c2053780220f895d724a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\684b0b38612c2053780220f895d724a3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=684b0b38612c2053780220f895d724a3_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffe767c46f8,0x7ffe767c4708,0x7ffe767c4718
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17153277285486597097,15584613550384993706,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3540 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=684b0b38612c2053780220f895d724a3_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe767c46f8,0x7ffe767c4708,0x7ffe767c4718
    3⤵
    PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
60e687ac7b3fa8b52e25b0c7850c6698

SHA1
1e253c9ff9b86b5a2325a6cad70315391d862a17

SHA256
d76e4bf08c45055edab916e7aac746d61df413737be57d5447e2b87f95fc18e5

SHA512
5e4e7910b3d09de1b32909fe7dc819b5a123e2721de388be3c7ed7fad25ff039c68080ff6826a4bd1112d070ed4acc767433fc063c81d6537e1dfa92a05b5b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaa5a958c0939808bdca02fb43db1f72

SHA1
1b866a8a3696b0bd4acc3e8eed94bf107d95f69c

SHA256
b3425dcbc136c040e7956c3576e907f888c85381d726c87ecceadfa976849b7e

SHA512
e0e3d1fc9ea4c292466738eb68e0567331883be0838a999dfc6406d9376c2558e0c2d57b9415580dee170590246809e32e116374ce47806d82b84c6c9bda41b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
909528dbee30e559f7aa6b2f9718c7e2

SHA1
87744e5817f36fac580d413b819811e6d1fc9f37

SHA256
d32e8fcd0e69312b77e0bfb04b68c79b8e9f0d33b3cc99a7fb00083016322fb2

SHA512
baea7369bee87ce03aa7b9dc41a65caec3856984272ea26c8504584be50eb6ff599e0de03e9c718d99b21daf2561a29ccd66ac188c9994f2653de849c3c53aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e2f8bff713dd51d5ad767020259d035

SHA1
a5febf7e17d2bd393d80ae333250dbec6be1e1c0

SHA256
945dbd2cc138f430b6723677648448f0a4182ce955125f9c5500fe00bd03400e

SHA512
6e50efc0a201a43d274f850755efc7cf544ff511c125bfa27d702333019c6cc6db2ff72c781e4287fcfeb9a0e05d66b4de92224fa41c822406d7f394fbe5662c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
040c2bc7c38c39cd8065c3466dfdf2a9

SHA1
f3f606f83d280a741940b5c539eed7d1997f2d81

SHA256
ee2d1039e8e05c8095ff65e8a3273c11370ad8417acb787fb4a9ac833ddfb016

SHA512
cf839c88bbe73855a53d577f6c364ec6f70f9c928b83301a4a582e98d0119ed13375129cc2b293e056c701cef9e78f6cefec526dd26e9035e1b0ec92d7fff676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b46b.TMP

Filesize
371B

MD5
a4e7bc828a78faff632f836d49400ee3

SHA1
59b02e1944dffa04f177ce362de9495172b51dbf

SHA256
67203885ec7c1546d3f2e26f5101402929b1b90627c3062d573e8c7ea00f2bdc

SHA512
1a2fca3415b568cc9864a5a8dcab217c5f7dcd4f792cd919abf9819c350c7cb620c07ef728da842ea339774c26df85d9b9f37ea3549364bc2e730d63256b7aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
04013d88fc5a99d0ef2454df3bbca8c1

SHA1
8d73597091c7dba33db8150c496a3d9e152baa1a

SHA256
2f8a8bfd685a474db19fe6d121dec384dd7e4d08c9c9f8a84907fdc62f2a5361

SHA512
900586a9ecf3a9b7b907cd31ab0d7b9026a20660f6669dd9d66f466e4a451ac65c518474df0f647ffaf88eccf46c227010805c80f48b634eabca3890668201ab

Download Submit