06800c11513aa6810747a401ae34f394bdc071159d2c2219d91fbdef15e117e3

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76751dfad944fa552c2a0731ad86cad4_JaffaCakes118.html
Size

425KB
MD5

76751dfad944fa552c2a0731ad86cad4
SHA1

99cefd1953d593b2557e1b81df391267951ff880
SHA256

06800c11513aa6810747a401ae34f394bdc071159d2c2219d91fbdef15e117e3
SHA512

98d2106338e404b05c6c69fb6260ea6401f70f57d2ada283bf9b6a53cde3e7693df2e107588c5b06296e755ce002952acf7520ea13aca9ce40c7b6330e5fe7ee
SSDEEP

12288:YqTFFd1PRXTql10121OlmPI89+8QwM+zIowljsI:gH+8QwMu2

Score

6^/10

phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
124	drive.google.com
125	drive.google.com

Detected phishing page
phishing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1220	msedge.exe
1220	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
2084	identity_helper.exe
2084	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1924	1220	msedge.exe	83
PID 1220 wrote to memory of 1924	1220	msedge.exe	83
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 3724	1220	msedge.exe	84
PID 1220 wrote to memory of 1104	1220	msedge.exe	85
PID 1220 wrote to memory of 1104	1220	msedge.exe	85
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86
PID 1220 wrote to memory of 4104	1220	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76751dfad944fa552c2a0731ad86cad4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffa82fd46f8,0x7ffa82fd4708,0x7ffa82fd4718
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6751242175228395939,759977620318714945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b94c2d366f741b2aa35e107015c27a27

SHA1
2e8606c2f1a62b295f4515cda588d3f93eb493bf

SHA256
db04cb9f1456c21a8bfe426e8061d1dc3bb405377803649ee7133dc6c2b8063f

SHA512
b0b1ce351dffe177b431a262eec05edb1d85c0cc84f2c3ef708fc94d4b63a65aec3267824139d4974149538d36fff4d919ee0a72020bc5026d0af1013841cc06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f5e5cbda66c2b1f507790cb24d69a5b7

SHA1
93411e90b852463d08a0256ee439c7f07ddb60ed

SHA256
d23713d74eb4faf0fac309586aeaed2abc53485628c9f92e7c02950a75d3ff40

SHA512
784e1924911357b7d032d0b80c7296dcacdda20fca42235805a53946afbeae6075958d44bb30aa19c0849ba377cbd6603786c25287aa1010e68ab3ef4311f004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9148cb9462bd17ee90672e01b0c87e3f

SHA1
6029bb72c86486ea3b33f78d2a3855dac3c91571

SHA256
6c1ba5638f6cb4f505da986116704612b37ee7aac7a87d86ce48dd1af31f844f

SHA512
72c975fca435493693c028117ff8784669cafd4f996b619c071ac26e03b753f0c93bd39418f973e74ec6f98c62084013a4da08882ca3bf332557fdc29a612dd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
702df056824266fbc7a6fba2aba79085

SHA1
5a83aa41c7eee05f0dcb335d96d9c7bdf5a6d85f

SHA256
e25231f6841d6d21b7797141b575cb11f94092421896e1ad108a1040cfc3833e

SHA512
6634502737d3a40ce4e892559f0feefdd066e0bd113a1aa87a89288ac57b01faad49c83c977c6b36001ee2914578f48a9304e083850bf0daeec11c98334254e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3f25932b822ff22dc8b2285ab8928bcc

SHA1
9880731cee04fa0e0a267629535e8a0953978de4

SHA256
7ae92bf4084c4bf8a23577ec62fb847599fac715d8bf080feffce9560252aba8

SHA512
d981463fc8fa26faa9e5e53b9702e141c82cda07ec9a7f3a76b1146b9d639c27fcbe4deb86697102da47656e7d388003379e9eeea56c20da7b80f7f77e2d1bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4582df24992c6234fd2ac57f6502300

SHA1
05dbb588c8eb9499507b7d5485a0955baefec742

SHA256
6101abd3291549630c9080d293e9485240fa575a61b414eedfc6865b2e58c59f

SHA512
acea2b375f9fa571e67cc4ca3bf8340794cbb457e6e18488aaa1b3f1b569651d91cabd9f4f6e667ebb411032dedad704578edf27f0bf22fc94cf08d2dcff0bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7681dac35b14e2a9e87150fb6e6d8626

SHA1
113db693115a3fa0a60ed2d35b7670cc09a0fa3b

SHA256
4da8a687300b3018b2f1b69025ccb35b7e5d3a758824fa0ee813c4475a4eaee4

SHA512
2aba2380157cea4e05fe511f1c8377b87aae2a08c8cf57b64a6b4e0ff5e23791a25e32dc8e7a174d4addb58e689df44ebedd5985fcefd7c3443bbae29a6a8de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e797a60b4f84b1b809270eea24fd28dc

SHA1
fda093cece0e4f751e8ba4d0adfc14c6b5e9258e

SHA256
0c2d9cb6d5083d397ece1c0d2276924d774a1c092f193529befad81b97fa09c0

SHA512
859f179b0ea541a3ade227d011936f6019e07a5b10b424c61a53518a0600f73b81439e119471a6e0edfc62b1836e8820f5c611dcd3e69df4eb8fcd6316df1e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7aa82c51237e533244960f30440b51ff

SHA1
decf21dd20a42e8a14ec578ab1cb7f57e96e7aa6

SHA256
7a769e361416ae79f3e34c114d13bafa9d58147026b662076abf4a26135f3ff9

SHA512
110519e0efecb53ff55e6f10cf6e6aca50e81fd2aa209800c53441dacc89670bb1f4da610cca48467628df753ffc731ffc992e95bc3eb3ee426d65df25b1d4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
e0a397c0523fd8345593172806841218

SHA1
282c4135fd5174122d607f047904807efd5838f9

SHA256
b6407a09e0a4c720ab2d6d468ea4ee01e08c5b2527a1e10f4142e56f461bc5a7

SHA512
c68b7dade61097b99a49220ad71fc06a3dc8fc4d1e024f9d00f808e80ed04c08049426c63f006aa700f777714c791f251675d9ce30d1b45b517b93d327030d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
22ef3829cdd8b921347e7c152e4396b7

SHA1
9b4b31a146938f27a4cd231a666b8a996961106e

SHA256
dfc91a919fed9689066b1379ef7810d1e1d4060395274b47bbc6baa46f664316

SHA512
8be286f7aa0b2398f0bda2522bf766d9391cadd82b200ec596aa5e152509c56d7ef5ed03341f4cd763b889d109e88029f1924ae7cbecd81780f1b42b5a7da98e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587c6e.TMP

Filesize
204B

MD5
1283e806b12e08790f2d0402339a871a

SHA1
c2348a467a1d5552c63f6327d9259848f49bf706

SHA256
b45fab0b60a3bd130a4a2bddd3b74b087803869601dd3a8f4b3a7ae5e7d1aef7

SHA512
054a6f5501d5531415d7e5174ce325118ede2ed432671016a24cba0e648c88c4dcde76dc04de4e2c1881baa40d5a2ad4d488e2a36afe9b736ef69b0cec2723c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d19f613530785a3d97a8d526c854982

SHA1
2c22eb21ed61bddc56e3ce293ff22db8b707d7ec

SHA256
a2ba523894aa59d29367086951eca4ca59606c3d875a163356fa171bcb343689

SHA512
37354bc2786f13c6a980e3f264973295c055480354c1fb2ee5a80bb1e8c189f9cda75c029e2636ccf86525f4c4fbfa5b37e2bb4ee19063f40be2919d17377e98

Download Submit