80f42d51f3e1fcfcb90a168b5ade5f0710dc0ab9f8b81aa22ae2af78185f462e

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca28b823b913d6d9fdb05056a3b9ea7_JaffaCakes118.html
Size

133KB
MD5

dca28b823b913d6d9fdb05056a3b9ea7
SHA1

998720a18aa73b3e7473cb1b61e2b3c8e6e03b24
SHA256

80f42d51f3e1fcfcb90a168b5ade5f0710dc0ab9f8b81aa22ae2af78185f462e
SHA512

7471817f627531ff7f122043a9e5d0ed17ab5843b34c63f8ed4ff098683e9b7f1e289dc07dfc23209edcf72e924f3857d944acafa0442002f50ff80c963bd545
SSDEEP

3072:KSOh/SSodbnckaYJNQMcZf+frCqIA3+iUCroS72TJrNDBdpF2knb:mh/SSokZOoy2Tf9

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	sites.google.com
18	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4908	msedge.exe
4908	msedge.exe
2776	identity_helper.exe
2776	identity_helper.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 5112	4908	msedge.exe	83
PID 4908 wrote to memory of 5112	4908	msedge.exe	83
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4780	4908	msedge.exe	84
PID 4908 wrote to memory of 4272	4908	msedge.exe	85
PID 4908 wrote to memory of 4272	4908	msedge.exe	85
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86
PID 4908 wrote to memory of 344	4908	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dca28b823b913d6d9fdb05056a3b9ea7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4436204939401106786,15006026721538390500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5356 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
24KB

MD5
d1c8fc93e329cfdb4cef6b1363e40db2

SHA1
2d034d8d0056a8c1596714c7129fc31c74a2565c

SHA256
facc5d448f6e3267100a4c236f09aa98bea1cc3b19e2b2a0985501ca499c4ca2

SHA512
07434e4af30064d5f67158d10b704afccaa31f974ccaca5e76dc9f1b05d76106b44f124c3a94af93eb1b44a5aeaa70ebc33e0f9f904d1cd4c8386b281735d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c5d83993dffd6ea5ed7657e3d515ae0d

SHA1
9e50fd82b050ebac85d0d5540d908abdba2f9e31

SHA256
e94364d76a8696c8a18fa0a391e209a633561dda9c65a2fe34625c2be7833295

SHA512
2f820e37b48736c0cd55c05c0e997d851cba736ea82ec54234ee47cd36b5b5f849602f99333275a73976f2b0dd6ce9e66153d9cce3e1c3484eacc3d9c8dd6e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d229d2086e69512a9c5b4d2538488cda

SHA1
5fe62396093f761b738cb49ebbbfe5f09c62e534

SHA256
3fc8db38f2e25ba9df89ae950caf7e625b41e09cf9e0228aa447898b215982f0

SHA512
eef77479185aa8f7551c969895a763ffe798683af13d4777bcb095dfe78c9e6582332e877f4f73511566a95055553a4e831717174559b83043a7324631034db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dbc81b85db2bdbde756791e84070b532

SHA1
f675531c443a15335ce4c8dc9f71e6e06e1f077e

SHA256
9adefcc83263dfa95b83db70129150d4c630452151544fd45603430f0c4735dd

SHA512
57b9c928f9f8593e5fc7ace858e1ce850967fcdd7262d5604145717086e3daec36c9aadb5fa55bb28419e413b04acaebc5d51544740cc36c2d2ee79c6d7de84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0ad8a43efd8b2aba2971a7d7761af825

SHA1
56c8147aa596bedb1217193aa58d92e015e57dca

SHA256
a85a9299e00e0dbe98bcff8fcba4bbfb3eded99584b87fa297e76d9798a0438b

SHA512
c368663460efafec87a7cba5b106cce913ef37b57e8a601290ccf2b43470f0a97b96dc2ac58020102c8d15d6f8a82f29631c73be6f189cef2a73cffd2299ab42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c87c006da7cd56d49dfd244cc620c3e7

SHA1
982fe26321db3e16487fbb1902270f05312124b0

SHA256
2d571f0cba0ee5c87090fef22629a6c28b8bd056dabe7ae2bf9556d3f02ef97c

SHA512
324592147e6d619886714ce1427248d661530b5ce8873c1ed29dc3fb997d50e60ce04d69a639cfa2cc063f4083a3386421c93bfef0745c60c7b2ada0f83faa0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98a5cb7bffd7f1e39ebbd952145a86b7

SHA1
cab92f353c63046a7d735a6e59b2c723c514977e

SHA256
00288dea6f3c1524c39a441d912bf4de69fc75d39579603282bc4b1085df269b

SHA512
867d32c939f9418573b85649ffd301816486903237e39eac248cccef90abf133e57ffb5735d85561426dbb765b56075b77b1dfc611c2fa1c825ec7e833a336ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7f7bd6f8a78b25a76a06f1b9e1354ade

SHA1
2078e8359a5b5e60b45befb2727337e31b88a8c4

SHA256
f2a4e676f2f84cdbe5e048257ba56dd7e3483e8533c58f399080d2b0fd2b6db3

SHA512
0d6d22813463d80077bc31152b39ca44f871bfcdf1a34d295363f0e8e300540ed1ed8c804c97bd1ef1e433fe66bed4200f0a76b4d6817bcf9b350f844a0fd79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a3167368a6d97660c521fc28ed2772a

SHA1
f1ae499a3ffbd49e34b16a9d6aa2573bf9bb20ae

SHA256
0662433dde68d1285abd91f6e24d4bf011172a896803b4f8669c079c4d37f1fa

SHA512
d175c544e5a7c99227434c2cebed7118a443d66be0068b5a2f8676694e1a24b89228728a659251be0aae8505414610ac919b52910e18eddee8d02c71f6b1a7d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
719bff9cd2392141abcb19be5b62d173

SHA1
2fe7dc43a040f25609a1746b572668d32081968e

SHA256
e2c28f6b925cd4ae9d8186478aba89683f9b5d26663b92814ff62fd62bd607f4

SHA512
b2a771b0e9f2479d89761dcd306651c487d0a9160cc3902c4858def2bf5803a82fd8bb54d477950182d12cb53d7fd258cf1c44649091f82439d6f32a19ed2925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586741.TMP

Filesize
203B

MD5
6a05375089de557bdad4971fe40f8138

SHA1
c654afbfb737c70a018ee2b85406e274aeb30e66

SHA256
36b432b71176386e677b3f5f743b525d920dd92d05f60343b0e907f250d8aa53

SHA512
51227ad8a7adec40e13ccde774e38c6771f7a8357d0722db5d6c7c53c50cfaefcea4171f6069d7ef4d58c1d6cbca37e0a2835bbe63ba815c5625fe09bca4b480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d47f648092dbf54afb8030b70cb42b40

SHA1
5d70afb985302af75dd5e858a0f4f2189c1bedb5

SHA256
934f05af8653e6cf142d9d64fd4dbf92b0d4588a470f7cd908c10f50d700d5f9

SHA512
bb305cf9340e2cf5fb1f0eaacbd13d0edd5cbd9bf7c41184d2ab8de3644ffba134ba5fa19421d60770a2a13ada44b65553a69fe9393b608a60cb9ce5c6c4de0e

Download Submit