24becfd9a84bcf6b8dab8422e10e18bccf5a87748d00dd2c44c346ad2449e418

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd0ce985d4757c8c14a2e2b35b17f234_JaffaCakes118.html
Size

71KB
MD5

dd0ce985d4757c8c14a2e2b35b17f234
SHA1

8e1412b4464ac6c299f523d6c3139ab074aa5ed7
SHA256

24becfd9a84bcf6b8dab8422e10e18bccf5a87748d00dd2c44c346ad2449e418
SHA512

993819475501cee80bf7a5613de7b7f405ba1d9261223459a7384543975e4360cbf07ffc4729a8dd5d3d2ff1c1a1babcb44a704de1c92a7f8d5b0482fab36c67
SSDEEP

1536:W8c2i/juqQhtmEcJOvlae/yZkV5yxuF7cAUHUopiLFu98RydN9hD90MUgL43opF:W52iKxcJy3/yKV5yxyoAUHUopiLFuuRO

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
14	sites.google.com
15	sites.google.com
16	sites.google.com
7	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
4148	msedge.exe
4148	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4344	4148	msedge.exe	83
PID 4148 wrote to memory of 4344	4148	msedge.exe	83
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 888	4148	msedge.exe	84
PID 4148 wrote to memory of 800	4148	msedge.exe	85
PID 4148 wrote to memory of 800	4148	msedge.exe	85
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86
PID 4148 wrote to memory of 2976	4148	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dd0ce985d4757c8c14a2e2b35b17f234_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc437c46f8,0x7ffc437c4708,0x7ffc437c4718
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11265942536965843,3284813962655576515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
c0c3c3b4ed80af383b36b32f87242dfa

SHA1
b12c97820c4b0489613884fa3e926f9735c31309

SHA256
6ef6d7a1a1ec4eccc603c62186dff53020095b34044db03dd6c75c4a1605a789

SHA512
8adc87223ece0ecbfd586e7389f9c830fb5fbb074d97a2f8a40c69c68c250b6b1edc0da27aa5402db27c065b79d1ca85d85829af617cf387636e0d7343214daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d9f91120122cc51d1d2b6a16398345bb

SHA1
851a1854b77b777f00d8b028db4abf91f20842d8

SHA256
d5901289da7436b206a756cfc6b5770fac9a5956fa333eaea4ee73d67dda7f5c

SHA512
c9fe630efdcd68df93867f78abe61ea7b7759ee71be7f292a45b58822d9da5b04457ff60786a57af4cc4900c4dedbf600b93de75a1d24e1b1930f53311711540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ee7737180f6b10912962ced7195f49f1

SHA1
4d1dd05c2b562c6f28d4cad084ee4ae2a37dda6a

SHA256
22d4fb86eaf151d20daca36935fb04b3fa7cb264430a7a0feb9cf14c92ad360c

SHA512
88d35122af2e93836279bb574bc9e8875364760bee2106a54bb1735f822da864f7c6058d914d2e776178cba1b8292576d766a71a2ddf0bc1e459c4048a321a4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23536411313ee89b31c226a49469f6b0

SHA1
02e4551c1692b22d0b794d9a6d45b14696f6954a

SHA256
9ae128c699cc92b79d784d291d16e44bb3c3cc7e0b1a79158214436a7417ee39

SHA512
7de0ff5719159785d77b36721e03031ceae6ac80cddcbda2ab43fa259b88fcd0d2ee5fb8ae3c4305c0ae7bffe13fcc65fcaf01bd5596ecc26fcafe0adc1df6eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81b1123aae86b762943f182f736f506d

SHA1
f1d55b55a3d88e65101c260ceb29b71944504377

SHA256
534d21642d77eb9dcc811d03b21627862ea095424ca862c1de9ea67e900e48b2

SHA512
934d17549efe8bd2ebd7f9b3fd0d53581cc37e52e108d4c0f397e12344bd812885e573f4cc6a1e9fc38443ad04ac2184d5fefb8be58effa326568b8124ddb0f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d1fcdc1d912cfe0f489744f7434ba903

SHA1
04d293c50bfb782a5cbb6837833427d86ea66c34

SHA256
2e370f62eea636bf7ac012b38ba7bb89f4d5935f0ed7fddce37828e97c08852d

SHA512
778c7600068611e331f949f08a271ea143a750c04236f8710febf453efbebc57ceac85ed06660e081108ddaa4b98fd2ec49aad865c8de885a61d93de25c93223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa57fe89981ada02da14d026799e32ee

SHA1
25a6726baaa6c242c6a6ed683519ee0e65223a19

SHA256
e4c93b6b9f8053be89e95dc81ab15b91f4bf977c479c241e18ba9fc4778e126b

SHA512
eafac95309a578190eaa3cf500b059f50e34b476bedfcc34933167f558f415564b0c599dda2a03ec531039122410d1ed12bff30801dce2cf8592ef924483e0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
942d09315c2ce9652e41bd93b6c4c6e0

SHA1
7d80ab2f221638b5dbbb87b9d50a81baf24ad1f9

SHA256
10e6c01bc51184a8df85cccc41497575683d84e9b70d4a96c0d05bd82d7a2900

SHA512
1bc5dba39c28af880988be8bb66cc42d30464c7dd343046636b305739f5df55b4847e6de16aaf2dc00d21a44797594ac702fcaf0a185fd40ad5515db8a890cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dbe9.TMP

Filesize
203B

MD5
00f30e3d7dbf1ad8e77156cafa11d2ee

SHA1
fb96f0f6cc5d55a8afde4511dfa870db3c4f0ab6

SHA256
a025baec7d465ea2f3d5ae18957401044744fde186ec341c425d5479e3abe923

SHA512
5ab61de6507036b007bb9284d5a78be905b738eaca2d3a7edab9d9a3f9a0f16ae1b79bf41bbb45ee0bd32867c05bf6d5abe4e67bacb64ec8bb01b21407700128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a8b1182899e3f8b6ef923e0c8ca563ad

SHA1
d6a78135505cee86710e57ddf65331d0abe72d2f

SHA256
910603013b169dc29f1b77ecd2a6622eed19e1ca3af1f73ffe5ecbcea54d8a16

SHA512
663afa424deecaa9f3958fdcb06195b1383ceaab3ab0bb15a6c43154381e451e64a7b0623a7b503f946aeddbf206179aa19964044c251ea3aa26fa5b6a931676

Download Submit