a40c67ecbd0a31d3e0633d34445def0366b90305cd5c28cc8f31bb213b850d5d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4b3b30fa982827ffb39c01645a0ccb9_JaffaCakes118.html
Size

282KB
MD5

b4b3b30fa982827ffb39c01645a0ccb9
SHA1

4e62b46bd4856f3f302efc7997b1fa76c21e848d
SHA256

a40c67ecbd0a31d3e0633d34445def0366b90305cd5c28cc8f31bb213b850d5d
SHA512

46fa281bdab2875072c1e653e74f8751d342955f079031a9c9473b0b77a5e0749fc956274afb4e404a12f5bbecbf2dbc6e373c4edeb73114a39bd8dac40d5ff1
SSDEEP

3072:OgW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgkr3VY7RJvfy3dhw8S:qDAXmNR8/pQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
4912	msedge.exe
4912	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3956	4912	msedge.exe	83
PID 4912 wrote to memory of 3956	4912	msedge.exe	83
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2148	4912	msedge.exe	85
PID 4912 wrote to memory of 2148	4912	msedge.exe	85
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4b3b30fa982827ffb39c01645a0ccb9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fff409f46f8,0x7fff409f4708,0x7fff409f4718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
abc48fd7cd6c006eb9f9c5719748c9ec

SHA1
1bfee875209e5a39e65213bd25322becf223d1c3

SHA256
862e5db88bc456d003eeb9ecef6021b12a7313427596ba87eb4771020c658f93

SHA512
62d9cd90cef344841d5f5acde94583c36d8541bfb6a61e72b6152d2054770ca3e056d702dc01fe7889a136972a12ce92057d84b9e9082903504cce730ef64594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
cac70bb9cff8363e345881e594cc4a59

SHA1
8ca1aee33b85c98bf419600e7e770faec7359aa4

SHA256
dd743860c32b293770b1fc9e466c7578ed6bbd7ba21a65f39e7028f12ce51f0a

SHA512
7a40ad10d43cbcd05898fb68cced467e28b23ca91f7ff62401ba53ccdc5802bb2d64eae25501147deaa1703d9e6abe7c3afcbc08fed411f4af4997fa12e67627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
bf722eed3bee47925b72a6705b5d39ca

SHA1
cc11e785aa815b291b67b1b8a53598dd7841ea8a

SHA256
ce0f067ec7d5c9b2ce0efed106f54d018257c979d379a68a70283b3580fad5eb

SHA512
1ffdf9a10359324c4df7db35b8579c051ef8d602efe8b3dc560d8381c22cc8d455745f192010b155597153c0f63ba8cb45c816b760aea99d954a2e04dd3de3d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
998a8facafc989a237ec0438f8c58efb

SHA1
cfbae537749943e3998f7597569b05eae43c7a80

SHA256
0da4ada0923720c62bd10e78db82a115c7afd0414194b1c1e47a3fa6a5a8e91c

SHA512
1633c02ff56e211f299566517580b0ff0317c5310fab98fab13f25ac57375bd82667e56064e2be7f04b3dc43d9ed28fb9facd47801a5dc287a606a79a956dfc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0aa8dfdc70f445420d105b3894a83b2

SHA1
1c6432868a817fab89de3120bb4ab1899481829d

SHA256
2d7cf2096491074a649ead07b9d54b05e3b4cd71ba9ab9298788b105b2265a60

SHA512
c8f722b35f80b6f21fc57e1da3683328b10ec966652ca2d6004d0693b917b1900b5fa396a9b73f65bbb1ddb65014283b0fb547dc23d7df7da6f505e7322f88bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
24b85a0cf016bf625bf1f2d474249e1a

SHA1
87d1ebe4cded9aae1208b53b65fcce7516ef63b3

SHA256
f841db15e742468f0d0cb5cb7c3fbf50551db5d93437dbc5496e6975c0972908

SHA512
54ca4f89c8c92506ef23c28e328b47518b24aa682985f7050079eb6ff3e409af7744cd482b963a100d86a52889eb0581e6c400115f82f029e1acb06817d1daae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19886921752f77774afab7844edb4f2c

SHA1
ab581232fc3d3b47c2faccfd2e3a6c085b860333

SHA256
4bfc528adddde231626485a9adcedcdd2478e2c0711a0324a800680afee23a26

SHA512
6369d8fac8887538b9e7d6203519a448b5f6d0392cc4fa9bd0645dac8774bbcf2f8478a100d346397553f8574e9931783e10d7508853611fdf43941e068eb8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ab4c8ecbd6ad1e69dd9696ff4e8d5b00

SHA1
e45205c668aaa717f537dda9cf5f2509f76ef211

SHA256
48ccd09e89ef5aaea5561e45340af4481bdb38c3f4b24e55868b730c6cb1c31b

SHA512
8d4cc0396dc605c730016e2fb543e4bc09ff8a351fffc71965822f7f587ffbba11d8bcc8f399fcb1100b79ed11c6babb880572123261415518516b546f68a958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
13684981aa476d2934f515d1ca5b0720

SHA1
5d2b32f852d9d3db538f875e99feb2fb2e7c8686

SHA256
8b8f8fb9ef09b2218e44b199191ec07817302acc0ed245e9091c6e9d06a4bbe3

SHA512
6bb2577b2c75a6b6554ab444eb7e625a8eb40f916f1d69dd8738ffd872acd266273fd2ff8fadcbb765e45ca8348c0c13e9eff9ff8d0584d5d259aee0e5babc49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
d04504b74f57554e0c4e927710c61ae2

SHA1
b161fd12fd7c998139b096761da0db62badf0cfb

SHA256
8b6c3d2d1eb5c4d35a375a0657020dcfb8bc3ca29df24e51db1bb801a451716c

SHA512
ae368a512f2fce7ada1480f8f19c079fa770a2c9a5778d95e135a9aa7b85343234ae81f70be756f411062ae44bd66315dc6f14646fc611c51da9a14dd986cab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
9b6d0b114fcff05ed5ad1c6b4e7b1204

SHA1
393145f6ed186e2c4be3c6b425ace2f69fc704fe

SHA256
571aac336a0de664b0e28e5d4fcc723aacbd35aa104323cdfe9cb3c5f9d28cbf

SHA512
2bc532d46e3b86f5b5d2fb1d8738e6e09d29a686d785cb7a57f6a2073411d6c2eda6e02c73fb5cb9e3ca2c066f7cdff374de197abe1a0734b8ce277e932d8e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5895b3.TMP

Filesize
203B

MD5
efc4dd530f3a8f921d67ff5d7186bcd7

SHA1
cb6ac91e5250dff0abacc484c9edcc78391f0ef9

SHA256
bb3ee71aa16cfa58921a31a47234dfcff4c83649233fae297e751f9d67f1b047

SHA512
08f809b89406de4c5c120f12f05e40aef5f37e2aaf2cb0c53830191ecd5806422b3d6d4456cebf78aa0cafbd38cc3e0d2d817adf0a6079a6b9a7f5f3b5936106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1eec76c4787285404afbafac16b9745

SHA1
975a20e14cbcbb71e1b45d46be265de92436bfca

SHA256
48356339df277a29e21215666833023e648566769a5aaf200ce6798e5a5215a8

SHA512
558c8f8566f67496e4b2a1f4014c71fddff58c1f7540917e406c29d985237b3aceb64a33a0b17dfa698d0141b498dc57ffc2a4629f0c6259160ed99095ea30b7

Download Submit