e9c958f2331adf3d680317018d69fc6870728d6bb8b4c59869728044b2432ec7

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcaed987640ab7e86aed34d084e155bd_JaffaCakes118.html
Size

106KB
MD5

fcaed987640ab7e86aed34d084e155bd
SHA1

44399de7016b3f0de643b372ddcdc6e4c57f1018
SHA256

e9c958f2331adf3d680317018d69fc6870728d6bb8b4c59869728044b2432ec7
SHA512

bc4902485389618475d3c81bb0ad7b5d35d62768571f41dabcdc62daf403bd2fa0ceab163e37ca2c5368ffdf1bffefe74ac09cbce5fa640655c93a1807d97411
SSDEEP

1536:lA3x//oTDBBoW5hwBQ9zhrttCJ0aEVT+7r9XKGpVZfUgk9TC/wb0Lq0fr1/oFP6/:lzOiDiDNNrrz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
4876	msedge.exe
4876	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4556	4876	msedge.exe	82
PID 4876 wrote to memory of 4556	4876	msedge.exe	82
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 3736	4876	msedge.exe	83
PID 4876 wrote to memory of 1924	4876	msedge.exe	84
PID 4876 wrote to memory of 1924	4876	msedge.exe	84
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85
PID 4876 wrote to memory of 4484	4876	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fcaed987640ab7e86aed34d084e155bd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ae1246f8,0x7ff8ae124708,0x7ff8ae124718
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11891038740678350041,6103893386977383820,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
1382173e3d95161d3007865e6e4c70f7

SHA1
54a70400c5dc15753edce1f1e5919fd575b7fde5

SHA256
d9d974db912ca24306cf67c08d05a356e86474260277c146068bc983108b8711

SHA512
d066a8ed7f63c7b410793baf4c7608fcc92385f2859fbd886ecc7d880f0aa11a92784c457adeb0d61cd0dc0b5da18b5fd5add2d70b5a3d6b2845390260ee5ae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
284c8ae5b9bdf22cb1474d2976158ffc

SHA1
ab2786fbf368e95611951d0175db41ea563e9316

SHA256
fb49c916b13b284adb5cf1043188f8804b666d0a001cbdc72e65f284776bceb1

SHA512
a6b2c53ae06fb4e5ad36fc9adf93f97bf517cebf5478ca1187a98d33dbde2838da7d223d3148b75aeda2fc4a9e206022353e83eb6a2187f4a1641654b32f115e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4e24ad85c98b1ff43b0cdb86304d9871

SHA1
2f542778f02e189c2b4d6bebad569c668b5838f1

SHA256
deaf8550103d366af99a780acd1593e18c6aad96b2cf8c32dd86011934966661

SHA512
eeb66d7e8d0bc3ec53f8f13029be4a4413ac2a5f34df0f9a1e786f14ef710498a750150c42e3531b674bbbf227ce1787735a200dbfe10ea915e08588b4bd9fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5fbac7e167bad365af9dfdc0da42b4ed

SHA1
d475a8f690a7eeaa51ff71ac08fa5ce2574c5fd8

SHA256
d95e4b68f93bcbba5640dae01002e469d940ed37c8630d1ea347089b5deacfca

SHA512
a725fac7e216a3f5b6ec4befcf7184fc54060b088ed7dbac519e478c148d91e5b199776add7bd5339b954be1c83f97822a680230513e995409ec4979f4ff2b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a00bd2b301bd4dd1aa6c6e2ce74257f

SHA1
953f5b480f203f46b4ad925a425da7a8080d9fbc

SHA256
37c63c492a28ef15419b67051ab3a864724df3080a1c90b80db8c778b93f6bfd

SHA512
f3d231e1e6e76efaa0cc681dca178d05693f0a7baa472646d689e77a3a1c28d7fedfc2f7406929bcd545237502ffc429dd661b8c8e5fcb9ce3b0692d98253b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51701ba7db03ccce3a72211c2ea6b0ec

SHA1
0a94a55ca27fefe5f343cbfd6f98042ff98a419a

SHA256
559634d580a254266501704f84961fa4f563d68969390d151ac3d18694fa2e07

SHA512
309798fa90420655595d32dc2dc176f38e3652e69d76dc062662ddfedcb7963b710163715b5e504db0095296706c096e9bc40109dc900bc4404d30b07ce5cf9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9f5b30e9af8b1c9f0a967e47fa54953

SHA1
48489e8ba06c2027ed7a27ba6e4bc2981de3ca80

SHA256
5c6705d1e78811e47b106a5d41e7ca4c9129fca314ccc4043b4a156c237ad52c

SHA512
4346568fc12eaed9cfce382adeeb829b800e2008728d66ad1e9d913b4f5c7331c37ddb45e16fca5da1cc250e4934ea24e16dcc711fb4ddc65c0932b860b8632b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9c3a95e2bd20e72ccdda3050bef0721

SHA1
45ccf8be28779dcc33a960e7e6f6290578e4c0ed

SHA256
d5191dd5203f7d460d8f29ab3f4de403fcc2ff395b9880cc9c681a2553efe3f5

SHA512
2f9c4e11b2056d67673daa25af34587a04a3529fe9764ed093ce0b80d297213748dc17a67700e652d65f3e4e8eef565516f65bbe750a14ecd1f128834d689dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c11.TMP

Filesize
537B

MD5
3693fedec088236a15b56c905c879c3a

SHA1
e83eb555d5569e1679dd51673ddc7bdcffedcc4d

SHA256
446af094a9e66a65f3e81971ef518ac077affad6c1afa50f520428a75f5501f9

SHA512
c8b6c43091cf431efaaa40883ad8f81dfa73af6c17fc81705ef4b7aba36bae0ab8bcdd268c18ae75c3515357fb43e97746e9d853eacb926d7c27670c06fda806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e05ff632da2a9059515daa65ad4de789

SHA1
fbebfee1b7aa834ceda15b505db118b60ce75bbf

SHA256
7c3f58732ebe935420f6924517eb423625d5313e7b4418abc4ecea29b7bd8e5f

SHA512
0b8f5ebfca9b7dc9091e6689c267a7be691529ccbb789bd3248efab65cc06a7113d0da493c673ccea94d9a2f598495a29bf62f16300ebdb3a2d341443e56b3b1

Download Submit