047f464e9176f3f54325d5e78166b75e1d1340fe2ffdee8c988c5ad61b6e618d

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce85e9ecd9f16eff56679d930cd0e2ab_JaffaCakes118.html
Size

52KB
MD5

ce85e9ecd9f16eff56679d930cd0e2ab
SHA1

0974bcb1cdddc17ad2d6dd52df4a09f96fffea87
SHA256

047f464e9176f3f54325d5e78166b75e1d1340fe2ffdee8c988c5ad61b6e618d
SHA512

234bcbad1edc38a460f3c2587761761672a38a9a6111af355e40e38a88f69109f60285f0c1b171e90704bf44d5bc19fd03c7d3b92aeece0ece3d3a70cd254df6
SSDEEP

1536:g7izDMtXqFhVKrdhVKrS+MF1tN2F1RMGmWi9+rZtG6:g7izDMlqZMF1tkF1RMLWiEZtG6

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
22	sites.google.com
33	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
824	msedge.exe
824	msedge.exe
404	identity_helper.exe
404	identity_helper.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2668	824	msedge.exe	83
PID 824 wrote to memory of 2668	824	msedge.exe	83
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1464	824	msedge.exe	84
PID 824 wrote to memory of 1580	824	msedge.exe	85
PID 824 wrote to memory of 1580	824	msedge.exe	85
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86
PID 824 wrote to memory of 3044	824	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ce85e9ecd9f16eff56679d930cd0e2ab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1816 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12720323181975919392,6176763953604191136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
fd050a6eccbc8dee25c4974fa360e966

SHA1
f043fd205161d268b032e0af95786fbc524fc324

SHA256
aafd90b2e8694dca399ced194816cdc2e3a90ba7128075af1ca85dca78293bf5

SHA512
732555eccde5bd534005488b213aebc05303df2429e8eba8ed7b3095503f781437d3a63a162d1502c9f448b1bad9cbc52b4cafdf8e907259bc0cff96edc43ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7421ff06278a4655552681036702d101

SHA1
e4849c72e94adf7408c5c5decf6ec5f602caeb9d

SHA256
549f75c26981a745e8b4cc963b0a115234443da07cb6d347917b8591beb574bd

SHA512
d8326e08e09406b38d5868ce11c894896e6d562e1ba460295ef9f552a8ae39b852bb2bb0af2aac4b3808550fcf426070f7975b7bdd137364b22201832e9293e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d0ff884e633b25be6492e9a21b05d074

SHA1
212e39f26d5186d3a77fb9fa6993bb213c0daa42

SHA256
953a7afac3178be7872fee534ef53a43ef2b95299b4d2195a0b2ad1763c67ef6

SHA512
bd4c524d6ab88fe81405fe7b76b074e8b69e149d47842fa08fea385845d577e2091a921622075cc1f48fc15961ddf865c9d65324688a6d8a77d9d933ad1c7821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4aec7b58cb4260bf05c4fa08d6812eda

SHA1
6bbdf2b52c8ca06d3ba68e37c948e4cb4ae2c4b0

SHA256
800aac9424cee2d0e1516d250d1bab2b040528726e90405a7d104d298e75ffeb

SHA512
47d79ccd9c3b2e0904eb6ad0776e8ce62eceedb036fe329537b9b0dce9a4908bc4113e13f52f8fa00e6f0bab9147be1db74aa5409b7372bedfe54f7ae674ecf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36ea7c33671c5ae062f0c017239a7539

SHA1
2d209aca69e76355e627e558ac72d3baa38a906e

SHA256
9bd2a73579d8af60589cf2d0ff37f5306b25d84ed194669d9554d79231a46166

SHA512
9a6831a706bb175cfacb819d1d4f623cdedc15a2521286bb84a3e9d481e3bd1a9972a37a4dd8d549c2c7005df48579bf2be932526b5a05a82300a0763a5be869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
6bf079c7ec3d2740d19132c3d993fbc0

SHA1
0d225a9949d290195fd523bceeab490ccde90909

SHA256
6e8edd9e53a3d29148173b8a6663979ebec35f1bc421c94a7076c76ad2974bc3

SHA512
d5e3ae58bba8b356ff662f3ce0457b267547428682cd7574a644dfc1c9bb5c472a33ed3f4599917f7f45f215236ddcf613fc65e83954b2f19b9268b176a6b1fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b53.TMP

Filesize
537B

MD5
40c014d3f8f8f2207d936c1e2a302eaa

SHA1
0d3a818fe070f59353f8172f67f5dcc568e24cf6

SHA256
40c5b0931e0e51990a778d92fafd80f16d16c6ececb4e03094ca7a2bdf8c288d

SHA512
e5ca5816b76d1ea294bfb8df9856d2e2b056c2fef1369020bb21885cfbeacc1e88cefd8021ba216053bbdbf743cf6198fb25fe64539f693d3295c6fa7c2b7a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bab738445ea183c84a82fe54f8016e24

SHA1
b3fdaee1535dc56360a34fed941795938b1093f7

SHA256
88f099796e54de45eccdaaa7ac7dc30c8cd89cf9e6cf94655bcf0e05ccb134c9

SHA512
174fd5ff15d357965a62215c6986a9518682462f1b2f05cbebc6692d667d9c5ccfe67803d11a9aa7a841d96d0a5b4415ff28f90fca818dd91fe14aba00d6103d

Download Submit