4129ffaf17e3a40fea01a7c34891eec5ae99967b8bb25697254b9945275f0d07

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf941c8e518e3e2e6249301d0825878a_JaffaCakes118.html
Size

281KB
MD5

bf941c8e518e3e2e6249301d0825878a
SHA1

1a328646a7756b62f91cb8496e2975e8c319c733
SHA256

4129ffaf17e3a40fea01a7c34891eec5ae99967b8bb25697254b9945275f0d07
SHA512

c07df329de7ecbdf8c38559439cecc75b377ee378910dc48b5909bf969fbf7ab2d3118bd893970fa143f34c38d83ff7e7219c239558b62e4c0ec51f94280d1ae
SSDEEP

3072:OkW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgIP3VY7RJvfy3d3kR2:IDAXmNR8/nL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3508	msedge.exe
3508	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
4852	identity_helper.exe
4852	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1464	3508	msedge.exe	83
PID 3508 wrote to memory of 1464	3508	msedge.exe	83
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3472	3508	msedge.exe	84
PID 3508 wrote to memory of 3540	3508	msedge.exe	85
PID 3508 wrote to memory of 3540	3508	msedge.exe	85
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86
PID 3508 wrote to memory of 4016	3508	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\bf941c8e518e3e2e6249301d0825878a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a4146f8,0x7ffa3a414708,0x7ffa3a414718
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9983480541974724612,1919446559744623235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
abc48fd7cd6c006eb9f9c5719748c9ec

SHA1
1bfee875209e5a39e65213bd25322becf223d1c3

SHA256
862e5db88bc456d003eeb9ecef6021b12a7313427596ba87eb4771020c658f93

SHA512
62d9cd90cef344841d5f5acde94583c36d8541bfb6a61e72b6152d2054770ca3e056d702dc01fe7889a136972a12ce92057d84b9e9082903504cce730ef64594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
68c04a390e7b8210f38dd426058e5fc3

SHA1
db35f57388540e772c88ff180b4548651064f81c

SHA256
246522699fd4535dc3fb8bf63ab89855de27495a4a607fc67471206c2c26a173

SHA512
4658411366fc7cc4a90e656c8377eb8499e44cfa0cf1c3edfe1082c351e8f54fb58342cc5de26321f6cb636198aafb2d0d8b6d9dac45a4c07d4db54bcd9b852e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
72f4e593f195767bf6c8bf4fc94395c1

SHA1
c7431eaa1c5896ff4423e715ec7beac22cb2c4b0

SHA256
1ab1c063c3a05ccb4454af82a805d2ab2f946e0af5ca6bd59060210820b89316

SHA512
b300e21f93be19129475fffd1d9ba60ec533eaebc6a624ce54ba9d927d7a9aa8f973c906fcbc94906e10aa68848365d7f2a4625d7845b2e6d69ed4bff57737a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1c7af5b56517c9855cd742584c34a42f

SHA1
eac308ff966fd23a4df7379b4a20a2e62a34706d

SHA256
79acb5a5a8532ab9642c042d7a757a9535e40d141cbe834f715a630b7c0cd3c3

SHA512
924cb65a68b4e1fba95faed7408917b39fcff0587b8e84b8a5a936c212f8b5baf946761dfa7ce134bd0206e26e088e28b79a43f6bd8de13018cc3f6b5cddc87b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0d88b61136b65805e0c2cc93837ba1e8

SHA1
e78ef25724d32d8a96c2bddd45505a11583bb521

SHA256
f14a4a5382228709b6e5501abf89ff30a4ee9db943a4d997602b889694cbaf38

SHA512
eeb1ccc6a0028e7ceede621a554dc8aa5947b4acfa0e57c3731db09c812a68672a4e41cd949ff78fb777a849f23c4829875ae71df035ba40f5c716ee902fd52c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca9d77888adb7fdaa14af6878936168c

SHA1
a8dc7a692f2da1b5060d452f0d7ccb12a34625cc

SHA256
5356a3f2b05bb518b03e52055eb944423a2d457706bb4b3cb8039c924c42c6c2

SHA512
b38c58ddbf29d199ba689b8eabbafa2201794f72142a3205bf4c5e72e31a0f95085039a37b592a3d853aed7843ede4ba0ee4656cd85507d9c1d372ada3f8c095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c25eae73750c5639afb911d6e98b65f5

SHA1
671072f18f6bb3dea26b18c7eec64a8aea66d8fd

SHA256
144ae8f86e19cc322d9c8e5aee698a9bf83538de9795397cfcf9661727fdf982

SHA512
4824739ae049bac8e0bb475b1ae3de0cc223fc525a51a066bb30db804ea738b32e7e8c207ce4efa567b11e635f819f6fc7b652f2fed9780c0523ab4a1b06220d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fbbeee27ecc8807e2cf489424f42cb1c

SHA1
ceb2e939657bb4316b9c64efaeb50b9ff5daa6c4

SHA256
f6e2f28e457fd1494ad1052acb72c71485d8e8a10442141234a25f38c4770fdd

SHA512
75177b882ca44508b644d47001fe6470a43856cd253b11ed11cc6190907e75ea7b023d03b3abd124e8801021a55bf51aca9972e0e123b4a641b181ca2ee17e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
2eac48903ae5a6f03067986a75441769

SHA1
35223a94c2c03db6b6a4363ee4138f03f34c0fdd

SHA256
da7798f3fdff0c76a1fe00ceaca2102db0ca83b054a8776700f7b21e181ecb29

SHA512
a8493a4a5271f0dd3cbde9293b153cce9da02fc7d7999d6fec6e1372c1c1183249a990306e31a3d31d785e5ed212c7a1450cea4b8ce134e3167a75186f84fe0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
becb91d7c4110392ef24cb3f07c3b451

SHA1
19c4c4eadfb7341c16c5fd199886d499b28df805

SHA256
3b204c7771f9f4ee38becbced8ddebaf0b1fba5d166ead80696f4643371ec43e

SHA512
6b8ab05341ae31c4a969cb8c9373b9dbb00933c4d0d4b51536c39af1c894cfacaa32c890808a04fdc7fe8d9d0e0bfb68d6ffcfd2a5b1d3b47e1e759f01e54e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
3a1fb36909fadf66c8a3b6c8c5d9b4b8

SHA1
e9e439c66a9ee733a23af08f64d1ad1ca9ab9e4f

SHA256
3a5af1375f0900331e5c8712d151b164b06042ff7b7b1ada2a0e6a53b8717923

SHA512
f6af056690a03bda8db5075058ffdf55db20094564b2073963088cb6e20fc12cb6c3463e16e21d03413763a337c55c0640e885fd9c16221b1dd293a00e7015ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58241d.TMP

Filesize
203B

MD5
724d867c9e88bbf71d0cf5d2574acbc3

SHA1
551e4cf83a3fdd88bf9cf4dcdd0f20f38a5652c1

SHA256
42a0fd58cc18606bb7bfe3351ba038de503b166af023a820d7912a1744dd9b8f

SHA512
de53cbd58182a6a7ba721894badb9d02e10f1bb295cfbc31e67e54c6de0d0c43ca04bf9584958c3205f9f8e46d8b324244de5a9f0b460234479d2d9858641ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a42b931b57def43a73203d910cd5bbd2

SHA1
3bef0d0dbdd3a45c8a80cdb7e63ff3b7959b90e0

SHA256
02b0b062cfc2e25ef5ec2bb98e7127e01d644a789e14e883967213206a7d31bb

SHA512
b3828daa8f31a9f1f9d4ae324be2311f64f16ae73c4232dcdcbd1b5aeb4161723143e9c682c810a4a1e936751c0032fd76dcb7eb08eb66160844f88da39736eb

Download Submit