7faba2a3dde86b7fed7811e1f8aa7fc2537f2602cf520fcfd483be14df12f819

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8098dc369338344c03c0c535506bd2d_JaffaCakes118.html
Size

421KB
MD5

c8098dc369338344c03c0c535506bd2d
SHA1

15adc4d5e4797f91e77c25b80d5a3b6a9d0f16a6
SHA256

7faba2a3dde86b7fed7811e1f8aa7fc2537f2602cf520fcfd483be14df12f819
SHA512

b2d6f59e5db22acb473dca3932053e1fad9b2b9813906ec834a1cea3d3835b43abed6d7868b0f5096b707dfabd61d9237baf4b58056f1b49dd4f564beb44da0f
SSDEEP

3072:5WajqjnJShkeyGeaBrZZ249D6IsCGl6/hP8nllT/fM0fXzgGI:QnJEeMrS49D6IsCG/8asT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
2264	msedge.exe
2264	msedge.exe
3636	identity_helper.exe
3636	identity_helper.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 756	2264	msedge.exe	84
PID 2264 wrote to memory of 756	2264	msedge.exe	84
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1752	2264	msedge.exe	85
PID 2264 wrote to memory of 1812	2264	msedge.exe	86
PID 2264 wrote to memory of 1812	2264	msedge.exe	86
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87
PID 2264 wrote to memory of 2484	2264	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8098dc369338344c03c0c535506bd2d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd171146f8,0x7ffd17114708,0x7ffd17114718
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8753761171520443245,13002653042463386000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
05291dd39f06bef17c268189ac6a178b

SHA1
4e3d94d4b1508b8aeb9664b9569c52f5d1ef5748

SHA256
a977735f36b9926a1fd3fe22b41c5deb4043462cb8110b16c18150b685133057

SHA512
33760fd5f4ce8be77195d7ce03a56a6c6ca75fd92a57d8e6d1c12ab572cec58c776cf2fa0b57f15d45c446ae32e2fb9790cfb7b7c5feb2954059c36a97673166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
c9bc409ad60fdfe9b4d88e25daea4060

SHA1
63ef8df0f92ff824c53411488ed9831fda337ded

SHA256
be31048e288df796481971fc3ae14612dc7bca16adc8231b12750e9eb3d5afec

SHA512
e7cdf8c087201167b9b9eff7683b088d1c4fd78214ba0891b508f9fd8c8c8a0f7f86728c9c091e6fb149df330b0b48ae42f1aa1caf5e11bf15fbae6c94042eff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2242d9cfb3ef9e9ad169cf6c09963b91

SHA1
2f2047d4b35aa9dc337a54d741dc387fbc5d26a1

SHA256
99c4b0c63b028eaf943f5469460f8d3f17abf07d99b17c95bf20d3d3fe0acfc9

SHA512
ec0581102a8b9c02fdf78e5ddcb3c648b6eb6ce83088050e9beff83bc0a63c0ea9a31d02c0221e3291189fe8eaa626b80ab5494f04327cf683ba0fe39a8717b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
664a12c35d1475aca6020eaa19c9aec5

SHA1
6283de36ba12b364be632a2ea2d01a83934ab5e7

SHA256
ff1461e111bbfd4eefa3b6ecb827b6b75fe08085d0129f45bd7377c817013003

SHA512
d5300b6586222926b65575f93e12ced9ad1ba6bbe06f48f5b3faf4be42aa64b7ca8711505eed130c5d9d6cecdfdaf593b8934b546988b469b5ccaa6a24670676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dec78a56b4b2eb29b74c5d929395c231

SHA1
6ac3c68d2071c41555aff419e8877fd7219ce09b

SHA256
50b4c92ccfec2d4bccf373eb455f0c1811be941565024d90225db37a9a9c0168

SHA512
188f10b4a1675edb0f196829d73ba829ab2668438e5f4d77a1fe8cbf9404425bf7f8586115acfaf8639016032a276fad4c67a8ecace5c630a0d48de7c367cac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da5d19d15a952f3ef26cb7ea2fcfb45c

SHA1
dc63302ebfe7509792dc865e2be1016d0343b109

SHA256
bd1fe9ff2628078b1ca90f8f62faeced9706c171f6bf9a7c11e205cc518bd814

SHA512
ab1c47854907cc9e32fd8f7ca7c1ab30f7fe28a88495a24d6b1db372078db662244c6fef96c9111baaf5860724145936d2ddc7821aaabbad90ac9a050b55d2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f603f56e6b0428a9b04d359928d6fd5

SHA1
80e1d62fb1de9dcdcb709f79b3923612257ec7a0

SHA256
d28f6c48e9299af248f54b2c4d1a1c2e7e1136515f6ac1d370fb21089022cced

SHA512
fcc66eef6d2fccbbb5dc41181e9a88754a229807bf0b328c5388993e5aeee6896dced43c7cc178b6b9b00a655165cf358a20cde80f5c1483287b9233d00739cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f99332a7e279d931162158192936800

SHA1
baf4935be71de503bbad86b70d6b36b66e78fcf4

SHA256
1c434da1ba2ca2299ac3c9126adc9697453c35337e4302796d79fdbba6accab5

SHA512
39af10c39bf24d92bc169884412a08e73edc937534811135c2698c9e4972836121160a8c389034a19a70c7c3a7a835bec267064c2bc56f7096b2fe29fd49ccf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584c37.TMP

Filesize
204B

MD5
f583fa11efc3825c681289b166b27263

SHA1
9c466dd0f4972db08d56d7568dfd9a6e3e39e081

SHA256
37428e300de10aceee7f69549abcf1862c94cbcc6fa26c33b416f4320d533e96

SHA512
fff6e966398637d5aa79a096ef1e32f632e54954349ae320da3da29f28fd06d7442aba193a0af983da8e232f19ea52c473a461cd1df7a6c6af774ec7b2682e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a15a15f17ebdf3efb23fb60c5a4d3610

SHA1
ef867d39d26f7f7f90cde754dc80ea3fdabd32a8

SHA256
6c5c998e50ee8cbe19b6bc754e660706b21d62ae21be92cd5ad21c0ef40a4848

SHA512
105542edfa8135ec7cb8e1aa5db9f88c6bbda5b4fefa1a3522083a89f13aca5321116bfc96bae3ed329185a8113ccd4b276009568a8cf06a436aa1c54af971b7

Download Submit