80d77a8e8afa241eac61e4231b7d3ab55aa8b22c7b5a54e2658f905eed1029b8

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01ab164689e1357da4bf9f59f545660e_JaffaCakes118.html
Size

151KB
MD5

01ab164689e1357da4bf9f59f545660e
SHA1

a2a30f58da52354fc97f36d87656461bbab0790e
SHA256

80d77a8e8afa241eac61e4231b7d3ab55aa8b22c7b5a54e2658f905eed1029b8
SHA512

8a19d96705f154eeb4ece117bc33e151bf489418ec48b0d7f54ef9e6d2d2d99a0ae82eecfdeb6f03dad63c60f12857f5ab9b7de9a8e763d5a9f38a5ddbb7dcb3
SSDEEP

3072:U5zS53b2UP13G4k5QhLpOatVhv7EEYA/fNbYaaLStR6xWUu/v66sbsGon4G59t9n:wWD3G4k5QhL8atVBfNbYaaLStR6xWUuz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
1784	msedge.exe
1784	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
3500	identity_helper.exe
3500	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3060	1784	msedge.exe	82
PID 1784 wrote to memory of 3060	1784	msedge.exe	82
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 2036	1784	msedge.exe	83
PID 1784 wrote to memory of 5064	1784	msedge.exe	84
PID 1784 wrote to memory of 5064	1784	msedge.exe	84
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85
PID 1784 wrote to memory of 1780	1784	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\01ab164689e1357da4bf9f59f545660e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffadbad46f8,0x7ffadbad4708,0x7ffadbad4718
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7953297408470557246,9116728325669581810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0c526c90cd99a117aa52460495ffc132

SHA1
e2a6096247f835c761269695db9f85a3833c9a5a

SHA256
5309d1d4ffe67309713a95df46f92ad1c8ace811278de219c045c829385bc621

SHA512
1fe25d96754a648d57da3de9a75f27e398c0ccc90db5fe8bfee9e39188e981a7d7553719c6429680d70fe550b654dc411f18ad2e4eb59ace653683c84d81b89b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f21a408a1c28d9b7fbf6ba78800ff66b

SHA1
2a9b40645776d3f91f1f5dd6842125eba929d33d

SHA256
944a480a61896f70cb419681918e8999514201c86ce3ebdbc78b81f1e4bffda9

SHA512
cb711679a0a8359c58d6a97607fbbdfa4d8ecbca7975f2354a73baadb2e630d3a357014b3ff0d1b09141552c03f1872b35af1d013e12fc91da3f535d537c088e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a396a1b87f60ee8c39e8f9db680561c2

SHA1
5b9c94055c2aefd3d679d3eb9d30760481268923

SHA256
c82ea389c3efdc668455f5189db58b73f25531ea80b627a79f79e3020d002f51

SHA512
5272ded5da6ca67052595e59a82a3342d7384d9afe4d0d777f60167d5ce5643e97d4c6c4d3105bc0cb0e3c65b6eebe6bd9368616b290552dfc2fe7ca166bd388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5c0d19b7b7b71351177011729266bc44

SHA1
df678f2e3d62530ce4c1aadc556af7dbacd16329

SHA256
c6fc1b9cda77c0b9358472ccb9aaa53340f66dccbda2cec7ae092369530670d5

SHA512
58dda7bb1931cdcc740cea1caf95c8598a35bde3673afbac84250034c1ca3d6d0f1d71bf66c19664690c3b52468a07d3139e9609a610b6444a74b42ca0c257e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35022e65a5275dbc67cd21751d40a5b3

SHA1
8c62edda0baf651445b2bd426155f96fcb10aeae

SHA256
bc93b2ae7648a5323fbe9c1f65cd250af7b4388c2d7fe5011a44545c14742c6e

SHA512
ed60a2ff0869ad70fa0a62824cb3f284fd9ea54b6160625185897a31aaf3ebb2b715c43a9c3abe46c43d66138b5d32a21f56a67657aa9efd4c472e09be33a054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f75c5adc61b144688ea81a0ac55367b

SHA1
e67dedc4d47a54ea5e824e429e28e1a410b95870

SHA256
049cea56f6bcc064495f61ec9a105adb2499e5cd3485690e3c7db7cc98574b15

SHA512
6c6fd0acf70c989aca19ed95fc2b21258b187d73c5230adf792a91afb8861474ed7761d1ea4de1098edc8f1e3b93ee269f37294b7f9e8e90746bde491810d350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
66c3c17ee574071488b7c7519b2e6072

SHA1
e8a7cab054040557371cdcaeb68cf5aa2d276a3d

SHA256
7328da503cb25224e4dc5e3856676c9a218f926c24412d9d1f50ca97c3925e3e

SHA512
692fc4e9735d7bdedd2cadb57a229c082702d4edb6f92aeefe97014b7672c9fadf6ed92b0e9095a1020cab3670a8e8a230c1c2408522ccb84f3d8bc2c3b32e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59485a.TMP

Filesize
203B

MD5
57815e5f310b361ced94e46f0cb2ca46

SHA1
a1818f4f4ea672d5fb0965d22709f56ef856d179

SHA256
09e60b1d9236da49fc108ad1607754908161ff95a716c1516764e8cfd68a5ce9

SHA512
9682cb77a25f8a06ba67c0346f863859806a76bfc4f9d18850fc5f15492125f3adb967459cace83f3d62cd51e83a22a392c02586739573c9416a87d1a938d2e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\efbd3180-b554-4c9c-aca7-061536f56cd3.tmp

Filesize
10KB

MD5
f10d5456834229f47b0f7cf664b46250

SHA1
d8c88be1178fe6ea7d064fb1a1ce5bbc9aee35fb

SHA256
580ba8e90f32403fffacdc01a37bfaddf2a5618b13dce7a5015498183cee6aca

SHA512
4a1e724a22e5c29ac727210df9f5cd11b8e5d5871d28175f563008a11d7583e2e91e18193aa0fbfde8c2bcd3dac656eed5b75e2752c3c29eb6714b7657af0fe1

Download Submit