bb87ba2daa080edf4f15f6b0ca2e037d74ee2d688c97953df33a7d5dcb19f535

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4060f455863912e452b1d90ae4d7c2a2_JaffaCakes118.html
Size

312KB
MD5

4060f455863912e452b1d90ae4d7c2a2
SHA1

bf73c9fb665c6cf5f019753d839d3eb56b9d4fef
SHA256

bb87ba2daa080edf4f15f6b0ca2e037d74ee2d688c97953df33a7d5dcb19f535
SHA512

effbc11b304599b32669e08a6e3ae63ac10383629512288d54e21a14c1b03a0925d2832eb0a676e15029f0b198e9415928f2259ac627ead10fa1ffaaff454bfa
SSDEEP

3072:OcW6WCiqYxDNvG8rmgcXmNRSzl+Ler71BMn3/12mG4QsRzsx+TIt3VY7RJvfy3dR:kDAXmNR7QD7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3828	msedge.exe
3828	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
436	identity_helper.exe
436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2192	3828	msedge.exe	83
PID 3828 wrote to memory of 2192	3828	msedge.exe	83
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 4436	3828	msedge.exe	84
PID 3828 wrote to memory of 3048	3828	msedge.exe	85
PID 3828 wrote to memory of 3048	3828	msedge.exe	85
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86
PID 3828 wrote to memory of 2836	3828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4060f455863912e452b1d90ae4d7c2a2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff764a46f8,0x7fff764a4708,0x7fff764a4718
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17186532735540451607,9791607760390549483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
8b41d9e82bfaf51825f94b0bc9facf25

SHA1
9f988a1b5c14425843d77bccca491b419f115816

SHA256
c0396130b9807c0b45615aefc58fd118f64899622a1a15e5ee6a88ae3516704e

SHA512
9d1caa1f3fea8e19eb0b8dd6c131665d826bbe85327757f4469b3e41c3c5dc77b5f3ae8bb2360a3979b5607933f7d5f7064abd1f196f7729e4ee90b23571c011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
85b3a3197d3e83c12ec69e6dec401b76

SHA1
aa02ae7d43096e2907a5813a232d9a38175c14c0

SHA256
b9f748dd54dcb1f245992b02e607592377d463574960fa45d5a9083b6c010f58

SHA512
1d8947349653c18723a986cb8858ef510bbc766a227db450021b9f816e37013c9be40ebe07cef2e6a3b909f49fc95eafd8a2042d287991baefb8a68c40ec08ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
01c988bc53b5ef2d1d61687c496c7dd0

SHA1
57a337048509c098dab73ab544262d5238c4efd3

SHA256
a5e7fdac6d045a2bc5b16248d1776f4ff6d574a08cd0549edca0d0e2398ff0bb

SHA512
b30891b2d9edc1a6a0e307b2ab7ec6caa7dc726aeb9e2706b68977a921a5546b610964a5e5cd5cfaa4e29ae42ca6a8e677c330556d39dacd5e38be1b81303826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
63e3812b792d592e5c5f29bfa8ecd0f0

SHA1
0b76573e514ccad5e4ae028a3a78650c2651bd51

SHA256
194bb23e7fe6c438660827c3529bd0e6451aa68546697968b9393d7096d63a82

SHA512
69077a6d0151938b4ffb440bf254c5c5c38605881c4599b3c4ecc2e7ee4b7d547471b7aab17d09e3e4e96f474311195fbd87d6de7af90a1eaa08b1077c7575a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f5c231331cd1df6930bdfbe1f4025650

SHA1
a03fc4e8cdf3b128ee2ca916b0ae610aea9dceb9

SHA256
ce7bfd6be71aec3c53d269ef37b649095033df12b3b079345153ed12dabd5026

SHA512
9762d0509b73f261c05d029346a005a1f40fa00f7692237eb98018271d87e530a131a635a9367346a2efdd6ad32c04accecca5ec2fa5de839d3b43ca2eff50cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
da3232d2c15ef0c093274918e8b37d7e

SHA1
1ac8badd23bbffa45743c06f7e0925118d2957ab

SHA256
e7498677969cebe688825bf88dcb914c288536de1f3a89db83c6bf9a1d7a4514

SHA512
d3d05f42beed2b1ccb968d354c91abe03ce595a690249fbbaf44a5a4aa44fc2c8887f4536e3968108d70dfa555c22b33080e495a2d9324b968c8f75e95c47b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c9bfae5897683c7de0f21e10bc6ea37

SHA1
cb406013c6c8d86102a86cc37646479c2db5fafc

SHA256
bfc3afb81cd7536910a4c80edf8d33b1338cb83b2dd40c2ca9d0b6b4514356b3

SHA512
f2d9428e0d515f3b778b2a0cf52a1c5e2322c70565b7b08ce23e859ecc0f3f5a20b767100033c9d5dca1674f7540c45a32c9a149fa6fb72151817ebf65083cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da0cc640f61545289af88b954eedde97

SHA1
b96fa6262a7ca7c31de0d58f5e59d1666f8db1c0

SHA256
5bdc4842c7602984183f24f14e3abc5271fece0b736ddab1d889846224911905

SHA512
5e493467574c8cd236b5058ac46eb15c13a5b12aae6cfde9527bfaeb71db9e93b4c8415c53d8d8ad41d13cba6f7be39faee6916350153950d2c004072133c209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
96ee27c5ebb546e6cd8e07603e9ab5ca

SHA1
34fe0d0c402d3910cd0d1f0055dc6ab0990b3eb6

SHA256
41f5cdd04c97e1292aff27fd589aa0681e2360c080750fb4c3fae7d00f316f0a

SHA512
07a2de1a3366c8e6c8ff890461fadd2a2730f0ca663ab4dfa150c9fea5c0ae2f892a24ff4fc5aa63863307c094d61b8cff7f617676bf14a53014efad65384fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4de234cd2e4d00041fc8c91c8d495c0d

SHA1
0d2982b7443907e874a0aab17b61990b489ffd24

SHA256
65b509f20a20379686fab93f513082ecd01c3855a0c9a6f04dd530fae5df8ee6

SHA512
5d2e817b1a113e67051d6e1f99ab10a33ed6b3272e19938b5a0468eae75c21fa5651f76af5802c1afcd51413f5d95fea0ec2c630439afc5521c1cc360909e7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
9814b8a0e998cd80fc1b7079c1695ad6

SHA1
2b281d1458967b62dbc9bb5159a8f5badfb1bdaa

SHA256
366bffe543ffe2e13bf30f3db3cdb52e75972e81aa70eaca7faf389cb5cdf506

SHA512
0cfdc9fe85af92a8d6d46eb8d82ce44fd1a30f47cca6abe993749c9cd3a779db3f886a8ccd0cec20fbcfee0ff8bb096983a6f030dfb020adfb785ffb5ea7e78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f05b.TMP

Filesize
370B

MD5
e4f1319e3a2672a43e039394c1f155b2

SHA1
2d6aad6b1779b85144e9dc2ff3c0fc2616be5ed3

SHA256
0deba98d45e39c2e55767ec66ca527adc19e7b3d878e5384c58f22fdb526fa13

SHA512
66c8533072cf214283160aa556362675051988f443be5cca028919e44bce85906d2335230d937d615687da01b36258eb9ce3fdf7d7f2522015d628d953284c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b1debef335296edbdc58f005df650141

SHA1
6eb7306e867f30890e0d3a2eb7a2eb129fa13a20

SHA256
5feb5e579119fbbda46bad2552779f944a6204dfd0ea6791b98f6812422f262d

SHA512
d3e3d588ad3369a5b59e53d22df8285f3da86f96e7ddea23994fe7fafdfd1c0ea9112b2c057f1db2a94086d5b125933c7b15c3a52fd5997d945a5b6b08930dfe

Download Submit