a303cbfd3ddd307f2e6df8c21b12981a40e5608b132bea425d0118c8b7f428dd

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d25a76bd6e02889f6a74bd0913be096c_JaffaCakes118.html
Size

272KB
MD5

d25a76bd6e02889f6a74bd0913be096c
SHA1

8a06b38af1aada7c0cfafb0063080242e9591c29
SHA256

a303cbfd3ddd307f2e6df8c21b12981a40e5608b132bea425d0118c8b7f428dd
SHA512

4f426244b8fc1047230f5d41d9b57400f779b9690d96fb3cfa277196856e5779173465d7496fe1a27e3201040c452743d4b91df539616865d10c177125e8b690
SSDEEP

6144:Gklccklcrklc7uG/bI+3VkcsklcPEijZeqhBEijZeqL4r0gnzqdVBRK:Gklccklcrklc7uG/bI+3VkcsklcPEijS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
1624	msedge.exe
1624	msedge.exe
1576	identity_helper.exe
1576	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1228	1624	msedge.exe	83
PID 1624 wrote to memory of 1228	1624	msedge.exe	83
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 3720	1624	msedge.exe	84
PID 1624 wrote to memory of 4216	1624	msedge.exe	85
PID 1624 wrote to memory of 4216	1624	msedge.exe	85
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86
PID 1624 wrote to memory of 3152	1624	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d25a76bd6e02889f6a74bd0913be096c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,375054544376841189,1539063378467539472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19c8f365-441d-4fe6-9a30-fe0b621bba46.tmp

Filesize
3KB

MD5
90bdb96224175cd96894f293daef75b2

SHA1
a08ab74e115b91b68c868b46757f94d2434c5df6

SHA256
e3d55a744ce5188e6b6c93a7ed3ce8b5c49de885bc6413f8c99b8dccd93a8b90

SHA512
13a4d7968ade1db98c38ca06109922f0278d02fce1459fd093d50c8fe12abeb1e044bc4c9b97934d4870548d1b0c0ba214f31e1f84a3bc0127c477b4d6573067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d0553e761582d3551251ed4cdd4630b1

SHA1
a9f37486a93f46520cc3f75e7f47f0cc7ee37a71

SHA256
e94ca864150d23e141dfb107993574c55fb3c9a624d978191304cedef742d532

SHA512
8ffd60ac70173aa9c05bb64afab9e96b4e3f00bfc206e14ecd2a76eec07660e594ffa3b400884c727c16cea89c89d8cc1ab9016ad9fc9f97c264ae567d1c10eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
30a4354ae49ba5581b17b1321d3cd9aa

SHA1
934542af55d0b6a6494e65c0d81e39d91afbbdfd

SHA256
7cb97de2cec6bd31dbf73c2650aa3b1cfb511f6d3e2d50a209ef2eb02c231e76

SHA512
4d6698ef072ddfe0e741905a3cc65576cff5f586117ef82d3efa1b6b16875207303d16a8c9b9529c7c17597836bb9cc54890f7df2fe904f7fb504885807790b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
108213677b4bc1d1eaedf58c4694fd73

SHA1
4732bcae2b4bd6f650929e9b87d895f19bfc2c23

SHA256
0b865e72f51d98dd06ea5d8d9dae41cf93b9fba58308ff50389e69e1bd5bb630

SHA512
87892bfd54e218824a6497e66be18d5962151687bdc59fddf94b29264fddbf3e737034e7ff1521af6c741319c1f9d62c888de4cba293ca1feb360b0702298bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b9c9b02ada321c9ed6c3835ac787589

SHA1
5bf6e3b59ed944b28ccfd43b3465d58a0b12f357

SHA256
4b19106e450a0a1825da14da0d15c27db85d03047f3e5edfe847f79706f0d2c0

SHA512
c7adb2cc8d76b5ece010619aee1a1c1f2748aeb9a1a19ca5585a153c73587008f95da8103666f59f6903eccc001038eb0ecb88de9192fae6128fd98ea18ef54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0200eae67c189aee976b8d198faeeb89

SHA1
a45c32bd3f5e6a9923acf773d4eda6613f32119f

SHA256
e908295c765591d7c3ea16e7d2cd9342b528ce40d27e64cc016f34ad5f9656c4

SHA512
6711f92b652b7b44a4679bf2a22ce39db798b6f1bf6a1ae0e784ce8aae4429f99985234c17930f5325efb959be1982753380d29be9418fa557696ba74708fcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98d20f6b9168645bcca513e45d48b6c5

SHA1
42c2b4d4d7999c6b4043095d7ea43b103026250e

SHA256
1bd62bfb2477b93857e4ccd320ae1be07c09ff043d805b1e923a9fb28665a18a

SHA512
eb565df01d47a2bbd3be04f9a7ba389e9c2c1767e0e7bca6653d60cc620e963f36fc59f27fbd61411b38023b0cf53210a280699558d30f71705f036a2595812a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
270fc82cee09b6451a875a1e34529066

SHA1
374a845489f533befbd9df132e553783188ec662

SHA256
43a545735ec2ff8cb9add1bf357c4a4d6020272a824eeffbae46cdfbeede21f1

SHA512
b1c252f343271ce1ea7218e997b8833e0364815e7e647fe052eebbf8f61b8e584ef1e759160a38b8fdcecac61991ea956bb6c2702002635ce70c30e6d077e7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3cdb96f6f2185ce2d56c3c54a991f707

SHA1
5dc4e650d31b7466fde099ce0c073c5b09876b36

SHA256
c207be8523349847069f5e904b9ca6347ec9edad4a435e041eb8daaa591d81df

SHA512
9a6f77fd46f30459b9fc9e95878b2dbd57534ac6999a3d7ea8915fa13c1b48c92043728a90bff57d3d71c0f45e0ad50b2e3bd97f1d86afb2ca65b9927a115331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
52a17fbdadc21a75284870706f74c084

SHA1
146ea93b2b27d7f48fad7ec32195e44032f91c46

SHA256
08c1ffa129fdd2a27d69254cd0d561cb85a0b2a38b3e7f2c91a6e45ff7a99e0d

SHA512
4ef8525039a475da9184f7342b3f9f382b4d488ae6c12b023d7db60d47b8d5cd872baef860ef20ada43e2719f8f074b585f505a954afc217e44dfe6bf560e4ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e8aa.TMP

Filesize
706B

MD5
dae7467a87e17e0cf4dff52264e0d2a2

SHA1
dba54148d84e81ccdafd63697725f240815d6891

SHA256
8c500d1679812e81ca732fe118f0c84b02293a803084aaf1c3ad5986ad894225

SHA512
0b5ad43933b7482ba500e05a4c3f196b7f8001a7896a3bd983c732395307cfb737eb4084cf68af9364e386fc5724ece0fc801f1328ff494d292ca24638b7734a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f1304f56d36d7855a68201e14dcfed0

SHA1
8a0b709d2b058ca5892bbfdc989a660a5477d1e7

SHA256
5dc07618c5b8b49b0d66f66c911bcc4e68f8e6ec3cee4edc480513741682fb22

SHA512
8d31ed9bbfd65e9741c2670a2917f4100142aac356775645c3808f5720782f0c77f3aa41ed4b10d6f2fbb2f4e474bd02673b99ceeebeb3fe19552e2d78c08447

Download Submit