9663435368c27cb7a3f5b9d2a3db225d30e0b3d1bfb5bbd2efde2b0a06ce9a4a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3d9861f61e3cdd59bb99d4fdaba0d1_JaffaCakes118.html
Size

57KB
MD5

3b3d9861f61e3cdd59bb99d4fdaba0d1
SHA1

45b58efe16f6570bb7bec54fdc909466788f237b
SHA256

9663435368c27cb7a3f5b9d2a3db225d30e0b3d1bfb5bbd2efde2b0a06ce9a4a
SHA512

1ca45ecfd245a1593c44e26954db5592f11bfc0059ee89ffd2d0cf87714fcaaa36f4dcf9af6aab080b55215ee7583a60dc7c3b2cd82ebaffd02afa5bb2561a13
SSDEEP

768:SCvknpFxmKxEyTQP8NE+NOZuhIIuTFmLVsDFiTjp:SCGpFxmKOOQUNIEhIIuTFmLmFi3p

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
724	msedge.exe
724	msedge.exe
3380	identity_helper.exe
3380	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 3812	724	msedge.exe	82
PID 724 wrote to memory of 3812	724	msedge.exe	82
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4472	724	msedge.exe	83
PID 724 wrote to memory of 4372	724	msedge.exe	84
PID 724 wrote to memory of 4372	724	msedge.exe	84
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85
PID 724 wrote to memory of 2324	724	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b3d9861f61e3cdd59bb99d4fdaba0d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffe346f8,0x7fffffe34708,0x7fffffe34718
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9560829439603554784,4392801138805526828,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2b3961ebda925bb20bd44d6d9c8bcf73

SHA1
debce83af190c0be85ff0504bf613a61d058fbe2

SHA256
98308584b7a44fd84ea90387f4295421f63cd77aef9f5f69d3adc0fbfd929833

SHA512
c97ae2420280810982b6068eb1829b7781dd297e23897fce03df70003f1fc5c35128f456874fcd1189aaa4b702c57243bfea5ee9ff18d075973355694049f6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5c7f58f6e38033250432abc244e2b5af

SHA1
53641b3a6b60d60d8ab68cba322e97daeb9aebc2

SHA256
f39a67b1c3e50c410c556102c068c2a3cbb973ebd895994a28056233f97f6774

SHA512
c1d29c27c5b7d10f494959c49d358c657c360cd174bbbc396df39d579cb6be23355be10dc0aa979b7d171b34f321764ec996cf7adc9774bb48ce474874bbc0c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9b77888753fcda6a4581b381edbc3d07

SHA1
9723da72c48d39025407c219eacfb5fa77d617b3

SHA256
a2a93f7ac917ee79f57840bc049c1918296b6235116023f191afa8ee9a5369fb

SHA512
8f52cbb8e69fb956f9093ed85afe1a1f250cdc3793744a22f4cd5e905bcb268a61372af86b5b1cfba9a6bb6db897892c2ac9e34f741338dc631381144eb94425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f62b927146085d2a1c89bc9fba0c5587

SHA1
9b1ae39e3dbeed53dbf712a9da0f83b875accbdf

SHA256
16e3e7349f580bb51bfa8978c9bd5713497832c845d9655519ab7a282c9f6e35

SHA512
2ce03665635173951be81746ec5782da5c258ec9c66af2eded43395a932a0c9cb83afb0f3725f4d19c672e257fb6524aa4edd78301231844cc16b9b775ce3c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
949b1dd9addaa86f6ac143c6d80aa586

SHA1
d149f4f4dace92dc913550e3af96454aa76fd80d

SHA256
fe9dc18df3e6a94c1f02c04273fa58bff87d5fb1b41510c4ee62db683e653c3f

SHA512
73d93883bdbf09b452876cd72443d2909a8baf6265a464e97b786f56d769ebb033d4f08633dc877dd98e0154df7378f4aadb5e1f3132ca081f65ca9cdad4a0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d44af68bc6b211b5a0d6ec66067bf5f1

SHA1
97828cc0d2f31ce3f4615345266988a1d4e66440

SHA256
84c2e7789230cea12ea0a72e9f8fbc600d5cd658116ec1b0af61b284e36cc12e

SHA512
cb17d964440649c1563efedfdb16758a72d7d0eedb6de3c3cf7eea1398ec0481f4a0ea5fef9283f902ba7ef8f05254ae6df1c3a764e4d8b47b7d61a70f638ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8784727deccca6678eec8ca563bb8be3

SHA1
76ffdc491abf7390e77bf4fb9281dbaf6910c53b

SHA256
5681e541cb8c6d7a69cae78c15a2139b3f5aea712ca22fdb243abde585d5a6d3

SHA512
e35cb8f70906168e9a78ce4cfa7dbd119f3eb825f1b6f55433053d52ec83ea27c295a248f552d9e60cda178d1529b96b7e10546b7a27710e1a32d774a8b0349b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71f8ea05e436de81efb1a20e476c7005

SHA1
ab0ff3e86b3c0978bbe80e142fbef85d30bb441d

SHA256
c15fbf94c6f46ae39d06d0df661f9c95e7871ada416a6d5aeafd3bb8de189a8f

SHA512
903863acf3e210ae575120cfe8a6b1d72cdee34ad36a33ea9e239f7b99d8222af2a22d79e6d54fafbfc4723fdc8bfc192adf764b78a0781331ceb23d2eb85cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
2e908a53fd8b12ceaab66e89a5266193

SHA1
1bcdf6eca980f3a4423eaec26c266bb2d055d5ab

SHA256
d23b2e37525335c0276a2acbb5969d300d9c5d6c4d64c5050ce7349965af5e3e

SHA512
a67cd1defc18970b0c9c70df9c200e7c1c819464487bee0a2644309d865fcaf5030faa8d3a2e1aaa95088da1ea3e579f8b662d01016a19b5cc9804359f2979e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5827e6.TMP

Filesize
704B

MD5
8292a48cbdfd0feb276d3d60a5411664

SHA1
a7c3d56d91a9d5ec95c3b027727b53a52f3420af

SHA256
ae6ebc029281b22c94e68f3ed801e4eff3f832e046d23a77debb354ae24b1476

SHA512
0fa48e00a4dec0632d60de8c2014ad8497eb22ee5477e2521f830d26678b1e1dd36c4219efb7622afeca64910209d2a1f0e993204a6c679ef142892ee89ee1e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cee159fff4934f7dcb6d27f6b2624c94

SHA1
17883c10119bd28f4e706c63e56ff98b87d0b7be

SHA256
a61010710cc2ea088d4511b9e0784ebe78886930cdf8ee22d3b271460d22f56d

SHA512
47f40241605184c7fdc1507962ebbd3a377b75a725b1ebef6dccfbe16da92fd4cbc118fc5e042c9aece424c927f7dea1fce8111817f69f0a1fbfcda826ffee0b

Download Submit