99f57c5c1456bb5851379c21a80b3a02c066377fec8be7a760d24a13b03012fe

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1320c05888e9854ff42e0c18697959f_JaffaCakes118.html
Size

231KB
MD5

d1320c05888e9854ff42e0c18697959f
SHA1

2f1becab80c4fb0b8920b08813e00bebd0f8080b
SHA256

99f57c5c1456bb5851379c21a80b3a02c066377fec8be7a760d24a13b03012fe
SHA512

a6c15fa6947e9a0cdfa84dc609f65ad6c2ae069a4b92fad0b44d69d6f34cff8c6a036d1e99892aca156eef1615443e377a7809334c9e102b49574c267cd81a15
SSDEEP

6144:Z9F9kEvcjJoL39uGTQ3CPB7Y4pUhhbhmq2hDE+CSq9oWjucucArS8+P0lRIR8M9u:ZrpRL3rTu+RIR8MGd

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
44	sites.google.com
96	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
528	msedge.exe
528	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 3212	528	msedge.exe	83
PID 528 wrote to memory of 3212	528	msedge.exe	83
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2332	528	msedge.exe	84
PID 528 wrote to memory of 2696	528	msedge.exe	85
PID 528 wrote to memory of 2696	528	msedge.exe	85
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86
PID 528 wrote to memory of 3880	528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d1320c05888e9854ff42e0c18697959f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c7046f8,0x7ff97c704708,0x7ff97c704718
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1280 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5441769157637446529,11262866775938379639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f8a6aa6aadb22ba3e1e0b102e89b9487

SHA1
74dd0771b4596ca395bbde83988df7d4cc546541

SHA256
71deda38153f55c6073fc60591656c9bfc918542ef30dd44c96ae2fe18da6119

SHA512
281a8748b4db877f74c72cd5b12d43722b48c41a3c96ef5268f37e9df2e6cb47ec9420096a1defc15f71d989bdae3fb84cb3132f1a25be2a7d706550caad9afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
587778a5c65cb18b23f67d524a572a0e

SHA1
1bdff3d3781c5459e56dd507033bc7d8ca81e46d

SHA256
c7d391776fba5eb323818b324c61caa7ad18af2692c57836e501c69d3d3f6a2d

SHA512
2cbcfc2fe9312ed3a294654d7b70c672698712f8411f145e6429638d65cec0b93a5c9435bb0c1ee78903b9ba432c39ab86598be2697bf64b39ab90f4bdc19162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1badcf41c3601e729de77532ed78eeb0

SHA1
4950d7480b83a78f279c480bce00654035b0d5c6

SHA256
0a05d1082fd057409335753c66582245e5ca464004ac97d7f4aa198d317b5618

SHA512
3f6e78c62ce04eb62a1e686faeaf363033978018b33bee3884536f812f4b141fde1a8ace1055c50e58881bd0f9475ec7b59ea7c221ef04ab8bac0c4489403d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a80e03753e59aa8f1331fa2d7aed06f4

SHA1
698fd673a277ff0be5ad50d425b83b3e8cb65cbf

SHA256
458f77187f5679a47a3452ae1cc6408c7e760f6cac46626a69423efa33efb3a6

SHA512
69186e73eed6c9319550b40474453f6fd8ca4a3bab1972e2964266f54e778999f431c4f0e6aec5035127d58fa8bb11a12a662bba27a9c70919ef18d1371c441e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f4f96da37504e8d135b48285c52e012e

SHA1
23cde8faf1cc1e9d70e082300cff422102c19407

SHA256
fc572a423c29c895cebdb734acb27d4de3f0965b869fe9b9e257bbe3b31b454c

SHA512
db4ec805634a4e9ff3d6aabd1b29c2848a05437a1dbbec16b7468fe431e3e86e13d6f4e97e111938d7dfea223cfbfcf59c866b95f7284c2723d9bc9096718846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39efb74c503b0c2e8a47433dcaa1ed3b

SHA1
a8d3ecf8bd44224fe047b59c7a4b6e723b477cf2

SHA256
a79ee084dee1eb9089d6d77259a4f03e374ca32cf42e9171e4b8cffafa9f6652

SHA512
5d940202c76401bd20cd096ac4a8e69c5d04a5aedfe7c63db0ed7aff5822c5aadf43d2c9833b36179d1d316281e4fdfc87a187e25cf2c65df3ed0e0d06e0597b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1081ebd1b6535b3353737c930ab919b0

SHA1
c674c687b2ec9279e3bd5254914cfb35fef357f2

SHA256
7166e70e7d0985a0a82261946305a6ef4a3c0caaa91ab475f01023cf22841b1b

SHA512
c1e70b21f8e2091f25b91aecd1fe66498ff3163a5842401304757f91d15bd9872e40ba8d5b224b6dc0197f13a7511378476b3de4b228bd90bdb6681f4a7bf642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585975.TMP

Filesize
366B

MD5
adeab8ec113d2e5889e21b66fd98d4d5

SHA1
d5e9e5e0b148ac39ea6b58bc95b2784866852c75

SHA256
06e790e71991ddf98b5cd81a4418674fab6c47f5960a0633ca32634044dc76fe

SHA512
bbb67dc16624a4e9cd9b67b05aa6fd92a1bab7fba3546fb7d36dde1b7987684781a1e5a7a6fe120dcba185a10d43b63009fcdd710ab57c071216c1e284cb9afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6860db2a4344f19090b1e4b09d883367

SHA1
be34dd326f35bc4e329e2e8a044e3fc9f3bc0f79

SHA256
6dbd7b86cc774340a07018c4264d08c95c8bbb5bc2c4a4001aa93014abc458c1

SHA512
524e9431d6a125c592ed62dd979ff8d5d4b1f95345df0051e8f1facd6a9f454878f23d3ee01dd0e21623c21c0fdf6c7ea31a67a388e49086041bd3e8fefcc3f9

Download Submit