dbb02937f8af16a3a9d931653cfb0fc6a17de87131971e80e8bdb5c16984f3f3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffa1ea791faf93b8cea9743ba9e31fb8_JaffaCakes118.html
Size

163KB
MD5

ffa1ea791faf93b8cea9743ba9e31fb8
SHA1

e6c7b16dad1d9fa6a42581fbd7f04210cf72b1c1
SHA256

dbb02937f8af16a3a9d931653cfb0fc6a17de87131971e80e8bdb5c16984f3f3
SHA512

127556cc0ab52072ea2cf9e49c099ff4680f2cff39dad5fa4757dab42d34535d26a5677727f19015c9c3bad3047454eb1a257791fd6a7361d7660b048b58ab0c
SSDEEP

3072:n7FFlSA3z2UP13G4k5QhLpOatVFbnvIf/fNbYaaLStRYF3/Q3Hi3lcxWUu/v66sY:nxF0u3G4k5QhL8atVUfNbYaaLStRY5qU

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
2804	msedge.exe
2804	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
1028	identity_helper.exe
1028	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1520	2804	msedge.exe	82
PID 2804 wrote to memory of 1520	2804	msedge.exe	82
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 2344	2804	msedge.exe	83
PID 2804 wrote to memory of 4488	2804	msedge.exe	84
PID 2804 wrote to memory of 4488	2804	msedge.exe	84
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85
PID 2804 wrote to memory of 3960	2804	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ffa1ea791faf93b8cea9743ba9e31fb8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd42d46f8,0x7ffbd42d4708,0x7ffbd42d4718
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11133568149729715175,12884968699522506624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
7b13f2bad781729ebe298510c3d81edc

SHA1
e995f4df4883b6209417de11c8e1c567a34fd90f

SHA256
69d91b797640fb029bda861c7d905507c15deabcb7fd71d5af36f6d14bbb9ba2

SHA512
2b3e088fa786894ddad110bcd230debd98d86d121f65b647c0f17ee4eaf8ef41027244d6f71d097024ce6d4b034b5a3255d97abe04a1a5116f2a15f75b0a21b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
585c64351a7d99fda67ad2dbd8fdf620

SHA1
8c71f8894b5e58541fe1ad849008cd528ecd5bfa

SHA256
a7e4c6daf331d666fc2b5900a3aeefd3df2f2fa17b1118d744748d98a157b4ea

SHA512
d457c10ba0d358829adc7dc5adc72eba5cb7c5f9f21b1380c50f180a85510684c2c22a92c3e33a25da831eed47b224077d271ea05b71da3388eb9cd3eef16b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c0c2902eb36bd7f33dbe119057d5e74d

SHA1
7865f05001a5119ab4038328b67a7940b048e283

SHA256
5276afeb96203c4d86304ce3b1cc44b8150ac3ccdcdea66a52a0be970d6175a4

SHA512
b107aa87b8bb046836753c5ebe633f4a2446a3d7d8064e9537de10ebad034ff063ade8c995e6dc5ecb73608e51215ef8163ce344a5f627d77d8071bba92592f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7e06248c394f750489dea4fa24ed041c

SHA1
3d58c30106b5e29f3af6dd9ee4ac2a3f86adc15f

SHA256
25ce9a1052664701b5d04fb3c494b474aa84fcfac123910971b8fb0d152d4468

SHA512
30d784a17c3e2b2a029e5688d73660d6b30c6f8ca7cfb3963645a3cc5cf2843f60e649c25a387cb29f330eacecf2b2bab64fd1f7b36f8cc61c701c3ba5f2aa80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bb1a3cfafc6c047410a8236c996da636

SHA1
99d87b20257cf9b9a6b5f95755f094ffd7cc6f5a

SHA256
64ae1ae370fabd68fc8d25d2fe959781ce685c6a746c829381772e6dde014843

SHA512
d085fbfb47f796fee1b4cdc79498cd83b581696bf47326fc80863248e5543ec188d6e20fe2096352fa0c485abb9d392699fa3ff4fdbe31707875aad652169801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c361fa2e82f2c2eb4777612884d73b35

SHA1
6f604db9925d68959be93e54c7541e392cd6ade2

SHA256
77f317a02364fed7081059e5b2ad78955728f3ad0bb2de3c5469af2cbbe72584

SHA512
33e66e57353bd88b6fc9bd14c0b9558c3da2917bb3f74a3966a68ee6798c0c47003b4d9b7d50ee73134cb3af4771ece6979dda4e72d48fadeaae854482f02ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4d698afc6801493e5d9ffdf7ad6e89b

SHA1
82ea9cb660d03717d5e9551d90e4c87538e81849

SHA256
58e405b6238558b67814c9555a2afae01810febd5ef417b4adbbe3229390e45f

SHA512
837eeff7390a52041310981fe788a2a44d40ae3ee16109b28f8507cb3fd022fc654832d7da92c09960f249221e77565dacffd9ff5d3a2a0fe28122301c651d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
025b727c9a24c07298029ec2f195644f

SHA1
c14263c1f4f706378977b72d159ced3809f2c7d5

SHA256
e2e16030a2ef375e46c8f139ec7f249dd625a602c33a680f382334e6cf0d5405

SHA512
1b355be2e16885c77be9ea33f19444abdbf1c11a914ad8fb7cec8326cfe726e162c164832e22025f11121b39f5a1bdbe209a55183a2eebfe9b2a3df455c964bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ea3c.TMP

Filesize
370B

MD5
cb4782c32b52f22e0f38bc24965a0331

SHA1
a02137118dc6304e15d8de4332016b64b892d1a7

SHA256
9cf339426c13e93cbc4f4381d8d0dcbb3a0f41fe03742dec5f8045a031a3199e

SHA512
391f1dc010cfa7500139c5ba58462f83075d6e746064f80e99ac2ec4ba7da6e0ccd0c444e390a50d93ed5a52b129f267f2c6c0c3b4cb0c91aeb97213b516634d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e4c853bbd6d4356bf06c54d109cf6b5

SHA1
b8bb14ac77bf0f960ab7fa0025df99cd5d29e943

SHA256
6631c03f6afe9c719c249edd18a378ea866225e2b5e782872bf36043226473b8

SHA512
5aa6ad4d9708077575c76442a54cdef7f21e5d3ab85ad01155ad088f0bc61c0b391b0b36a27a46851327b3ac71fb9b778f8f6aa035e830bd935d6bb2ce5e55fb

Download Submit