badc56883ed11e4fa76db23f9b41e7c9191796a6e2667ecb6ad987c39ca06164

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118.html
Size

358KB
MD5

7a10e7da6760aaf1c716b8826a1508e9
SHA1

bf65f78611c89eb7f151a9ab2c911f773f4a8482
SHA256

badc56883ed11e4fa76db23f9b41e7c9191796a6e2667ecb6ad987c39ca06164
SHA512

32c24df5dabca750cf4eb520bfb40eae4942c59adec3e1d11aee7efef73790dc30352d1522464a9b63a930edd4ff5b3061311d7837cc7b19c3697f32131a1a58
SSDEEP

3072:wsW6WCiqYxDNvG8rmgcXmNRSz7fLer71BMn3/mBmGUQy0qI8EDfzcdzn6Vrn7RJ4:gDAXmNREgny0qVEDMT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
3712	msedge.exe
3712	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
2992	identity_helper.exe
2992	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 3508	3712	msedge.exe	84
PID 3712 wrote to memory of 3508	3712	msedge.exe	84
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4996	3712	msedge.exe	85
PID 3712 wrote to memory of 4036	3712	msedge.exe	86
PID 3712 wrote to memory of 4036	3712	msedge.exe	86
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87
PID 3712 wrote to memory of 4728	3712	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb773746f8,0x7ffb77374708,0x7ffb77374718
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
318ffbb8b70b421abc02996dcfe8afc3

SHA1
4240e64a8604fa36481bf24471545a2c7c10c89c

SHA256
fba866aea3cb0fce98cf10cb57975933d6cfaaed27f9f25250008814c9bf8e95

SHA512
1a0f6266836348c4ee0fbfdfdc9197b66add2a5b150ea8a1205b4e3876eb5c82d7404bd26791de29ff48004dfed187d9bab5a9678dfe1c71cf513dd49abacc56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
6ae741972a80dcc60f434330dba5eea3

SHA1
7eb7c89eec92afe97201bab2f4599305bed02c3e

SHA256
f49ad3fee3010cebbb2c4f9772ae935330938ad1ee9c296e8641f711c09fdf89

SHA512
24f8fcda890eacd6b09ef411f582591aebd6938143d73a05be9457ff0b04e021bbcfd62ea34c88658192652be65ab8403d4abaceabfc7a143e263b9e8a500058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c17e12b440c082f7419d0315b3fa6bd4

SHA1
dcecb914e507cebe602690afb4a5938cdcc18760

SHA256
9e3d675205795a5d3977bff8ef214a85c4b0690fd2933ad184fab154c5c405e2

SHA512
05fd47123d18c3b01e47e6cefc672e6c8ccfe4912ce1376ed3e628a68a87d253e7d8673d1109b63ea8cdddfaebcb8696fccc7cda9eae96052d5befc91e936546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
826276d88c67034a4cf24da6182b1f33

SHA1
da53ed6741c19a2a1a42aa429f84933a983c31e2

SHA256
a6c680d79bb56c1ac8d95e90350c55acc714b79b76e4acaed7bcc94f9ef9df5f

SHA512
5fa8385d65e2dbe75c3b2cd8f567629fbc79f97fbc1530ea9fceee9cd142be9508c799398bb221d6a63111a74c5d4d35ae0cc82e6181812662dd58ccd8b1fdc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0489146f81662aca180ece91606d78a7

SHA1
9506463eda3f5da5f1bc1e347ed60a1c25fed618

SHA256
a35b6c7b79367d155caf274267b3a685211d3fe49be7d2a042b77402504a3c67

SHA512
8ee2decb510caac06a16d7ce3a1fdc452deba787b102d8c18bc428dd796205ae026fcd56edd3f9a9c9edab19d763004e1c7b5138c28abae34129c707c9a71c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
270351514e497891feef753c045a0c65

SHA1
55a4bffb8304bdb8ef1246da0db9a2040ca57aa2

SHA256
145d385a5cfd9d0c962ff518977b352fce1917112bd9e1deccac48798d06d874

SHA512
d426a92b0ccca994d0113e3e4637155e0d6ad98d429378be998440f9e35e5c8f28138a33bf81107a821cd2f00c67ce21107499c57464c74d3ccbc573b75254b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3989bd663528e55e47e12820560176a8

SHA1
6d1513d43465f6a58f79edbcfadab277e34e2c7d

SHA256
1d713ea348c67885537051d838149c72a71f00cf4bb090a72f41217c1df9eff8

SHA512
d7f50cc01ae98db10849f743aadb71a75d005e6080229be1d6b8345fb932a0141d8e75ff5dfd8f1352408afadd7065510de253ec5225af24630d6f6aabfa4839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c3109c9c308c8547e8b3e18e20ec6858

SHA1
b0597129cc838e46d4639d1a2feef18def98b377

SHA256
bb04b05208087a8c72713141ded049809e3566fd1ef9e60423aac60856a40e10

SHA512
11f1b47609781c9f6790f2b54052a4801197a6a13b47cbf5206d36abde93b66cbb80eb9238746ed599fe5599ed40468e5a640980f03ca325080f790c6413d2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
1ce4f55358b20093276e9f6f5834b162

SHA1
43fa366e54f9d68d9b5df34e17c346d8ff6d885b

SHA256
0008d43647f0ee45dfb15d074b771492d4589628bba768af1b8eaf7296e6f41a

SHA512
135052d88b43f8dcd42a28e98adb650df3d7b5d0b9d361dbae117c1cd384c94e979f4277da3ecc67eaa1ebca0c00f7b2dfb925a5c122e48c612435c6606032d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a2af5e89f4d410aade9aeb4ccb985782

SHA1
214f1983236c72b036314143fe4782c8dec53cda

SHA256
9f18487bbd8ec78fe33e1d43eddffcb7bbf9366b1a1b95a8c7a52620ce9a7535

SHA512
a721a8fd81d890968868dfaf795a9670405572b9c562dfd3683fe165a0da4b1ecb4ecdbd9f7796fcc1fcb0020a7d1b3856a5a237f4b328ad45339ce6cb60859e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
5edf0765e64c001b37680024566ec6b0

SHA1
8a4f2ae5feb8628fc5ae44f50998b0fdbf36049a

SHA256
ed3282bcf96e744484714357f09ab9d6f33eb5090b0ea7a2fc8402ec5a348177

SHA512
5606eafbdf8daf142e9d45207d9c8abb8a254efb00e003f3ee676417a238f68922b4ffe0033309fd0a6d011a4092abc7cf79ec9cde7e0e0bbeb323680fa9aedb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809fe.TMP

Filesize
203B

MD5
0c2894de376ed09197ac56897b60688b

SHA1
4d4056dcbf562558075c565000b0dea0e18fb992

SHA256
ba93fb35770906eabda400fd35325b8f568cff98645a9b7cef293a962e902a02

SHA512
59addefe8a9c5f9401ef38c9e29ad0472bcb9d621d70f81351b56a38f69b247c264cb2a432beb128f568d529c2a623a94a3a50842bcfcc1cd9d1dafa13faed87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c6a489510c0a81d2ee38a160e4694332

SHA1
edf80d243e657e8d41c97d8103dd529f8068076f

SHA256
21ce1b1f112b6f92abef77d6cdd44e4654cfa9bfc23112f3ae904a4eb0e6f618

SHA512
9b41e132b1d22c25c67c390a0e7862dfa7deb9feb3905513347f4771d7ebb670e1df2daa1d3560d49490fa069ac9dfb0a20e6714625f88bc6e4eacf109dadcb0

Download Submit