95c81b3a6992f25c5b82e0d7af08da6ae397083aadd47b550b81cbc7ba5a3230

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e0638822733d9576e996e6061140999_JaffaCakes118.html
Size

282KB
MD5

4e0638822733d9576e996e6061140999
SHA1

5f8e5c0b4f469843358bc6cfe254e484a92b2e3e
SHA256

95c81b3a6992f25c5b82e0d7af08da6ae397083aadd47b550b81cbc7ba5a3230
SHA512

96bf02eb2a978d43bb203e8893f5a43a229355cbf1878262675a6d056cb5f98086f901d51645ba12a55b40b6f0ccdf04b3bd09f2312b944ef259f5486cb0353f
SSDEEP

3072:OxW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgzO3VY7RJvfy3d49/z:nDAXmNR8/Tk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
3884	msedge.exe
3884	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
1436	identity_helper.exe
1436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2160	3884	msedge.exe	84
PID 3884 wrote to memory of 2160	3884	msedge.exe	84
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 2668	3884	msedge.exe	86
PID 3884 wrote to memory of 2668	3884	msedge.exe	86
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e0638822733d9576e996e6061140999_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f2dd46f8,0x7ff9f2dd4708,0x7ff9f2dd4718
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5584 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
5c2c745d1ba461285d812855724f2806

SHA1
c5bf5e4713eb41656bf21ef9b87b7494fd0be00f

SHA256
339148acc9abe1ceb13e4308aa39a65b118d0763f962336ee4daab4631894ef1

SHA512
e25a0ba1b25d664e4f6fea4d79ac25f728572cb76fb322356803259abd9adcc1d1240444a0a5a3e95303b09c1c41643937df7d17dace0a36369a1c7219004a28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
afac4c32c966ce14b71340e0245be570

SHA1
1e86e6579d6be58de2c07cee85b54825f9970140

SHA256
63c90600e383e334a817a47d8a404d7610ae0e07cd821c37b8429a6b365bf07f

SHA512
0d2f812c5d859c21d9e5170272a3e191f34f166a61b18aeaa3cb4aac402412931b45442954680f65538c01fba601cf3ef7a60f03bb5b9bc180acb55fcfabff3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ccb572f467b8e93d58e89bdaa0d799d6

SHA1
15c1f6efa7219aea618b4b445731388e7af56f73

SHA256
106c1de9fb3ed6166bb06924a9b3c9075054de39a2a7aada6950b2237a80ca7f

SHA512
7c54d4d73ea19eff50775c7200777cf7a13e0e5e0e81aa86d5412575cffa86576dc6d5a68b21abee0600e24111a181001d12fbd67fc600be1b43d5ff1ec8b1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47624bde39e7b6a5af324d4bfd446048

SHA1
36a5c92a8c529c5ad75e93b38095074f8f4538e5

SHA256
416d8331fe3432c01e673e87c1d61ae8023cbf3482ff8318a02ecf4197f57f8c

SHA512
70ed9d7a25d3ef27d3221ea66ae238a1c853a10ffd13b774eba7de82ac09fdd8d75e20eddfb562794c3e3f307894ef6f16beb2ec2706ec8b4dfe2d0326321f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d496e122e521b2ade116308a6dd17938

SHA1
cd20cfcfffa05cafc9d374e03ce8bebb9977c712

SHA256
95a33d9f9b1ac1f72f86a3f9335d98e984e7074b61ee399227147a6358ea0bda

SHA512
3fdba5ff34e4e76ae5311008da5b3ad47a1a68f9d0d65f4d851363d10eafadea10217994b902f8e4d3f7de2e1821b14e3b36f9abddcc4bc76aa4c32d75581119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
107a5ba59af5b0725cc748add663dd1f

SHA1
963712ffdc8607fbed21716e94732b7d9e14568c

SHA256
2dff3c14f049695d65d15827a4a908f38035fcd2a5a8ce78c4eb6c0a835e2568

SHA512
63b3846a55659f47d3263bf90999036de1f780eae3e82fa7a823db3595b2fc131633821acc216def62338b4d7fcbafa1b5db872d81def016b8cd35c2be8c4128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
872f1b76b8d56d15694be30d82e0767c

SHA1
838694732c32cc578c31eb8dddd3b06d62e75927

SHA256
0a160e250aebd49bb75e396bb1f146142f3ad5dd6d0d5258f4c2ffda0687946d

SHA512
21b7450748aa18b3872c36b1770259ea23ade875cf40007578b7dcafb78283f32c5684cc8c0a6b612c7a5f152004b71f6a56063a2938ae85e61b28242e827576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
d60a038d83561856c5d53679aad77f3a

SHA1
daccb5382967043391afd8c437686629d0a27289

SHA256
87981a44d120851d10a98fff1a9c8318b583d123768da6741bef6d2fa8d58379

SHA512
2cc95df7636397aac3a9ac93bdbade5c103b6c1163dedf0aa7b71c7bfd3139f1efc72e102be9fc6808d32d6ec38a5bcd6e4f705054f0c8e96b4fb6a6146d9834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
dbde3309f0f22a0fc3cea0df0c302b08

SHA1
b3501054631440a8e83066422e3cec201b601185

SHA256
04b6f02d392e3bb9bec6fdd117ea4c5138312582b7575e68c12e38ae0fb46eaa

SHA512
9e4bbea5f9222e90dc7183fda147aea32f80728b38ea3c13457080f5900f03b8fe5aeaa3b80e7e94515def473950f2613d222256b13b12a904236ae6808693f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
df04455bc7d175edd8b48dda47875928

SHA1
98f4e939c2ab0cc165a3f49c41c84a7f8c2fea48

SHA256
2010835a3499e553ecd7fb54878c79ee90b933103defdef70e69c08c366fbe62

SHA512
3bc0f0d2c4b181470cec4b627d2a78d3f06e1055f77cbd3dc4714af6236110c6b29d1cc16776bed6233301dfb8cf631c8546f6be3917be918d232dcbc654760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ab7.TMP

Filesize
203B

MD5
ee179e8513ec562989ab5d1a9fb4b496

SHA1
6e1f1b939ed315b5b258b5bd7195aa36439bcc7a

SHA256
2011c59f474ec2e0be06398ed3b49ea99ef7cf88bf098f6a9959f17f87601167

SHA512
7c502f4259ca79172a1a1f6acd0c70cc5fe11b022bfb0ad57d89e6cf4754b468e87a3d141003b117ad4931660926ed9d96480160bb02f5bc034d4473dcc88a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
accd77561c2e70c79da94fb34640746d

SHA1
6d1b18ba392a5319f32f801154e17d33e6581691

SHA256
b3146fd1aa80a65a8652f5b4bad6d5b2969019b8f0f1017b7590e40affa86b50

SHA512
4930cb58117d16fbd6b2176872ba9fba8cdb836ccc564eecbd7156e6a7b6bd6894416bb3f5db59b9972e5fa82f4035de7e6a93bdd29353898cc667c2b3d7938a

Download Submit