b4b79925660d83cd3ab3862d551211ac564124dc3a1120e5ca05df4e0be84cbe

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37768caf88c6b039f08b1f39915cd023_JaffaCakes118.html
Size

72KB
MD5

37768caf88c6b039f08b1f39915cd023
SHA1

78f88afa9c6db301a49190a7ab7313193bbcbf8e
SHA256

b4b79925660d83cd3ab3862d551211ac564124dc3a1120e5ca05df4e0be84cbe
SHA512

c86c5af7a4afb03ee5ffce93d7a9c569344ce37d9e271e184bf7e538801fe399e7c89f87c3d7f07d8d3600750cf1a2f4975e5138e39100cf77a0f090dcb7b5d1
SSDEEP

1536:I53D9IyLWm7sTS7T/RvSxOadyCuAqbX3KeLaf2/TBib:I53D93LW2v34f2/S

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
2984	msedge.exe
2984	msedge.exe
2616	identity_helper.exe
2616	identity_helper.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 876	2984	msedge.exe	83
PID 2984 wrote to memory of 876	2984	msedge.exe	83
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 1392	2984	msedge.exe	85
PID 2984 wrote to memory of 4192	2984	msedge.exe	86
PID 2984 wrote to memory of 4192	2984	msedge.exe	86
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87
PID 2984 wrote to memory of 2384	2984	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37768caf88c6b039f08b1f39915cd023_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff27a446f8,0x7fff27a44708,0x7fff27a44718
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6978787700632772772,16491851329486545100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6058b3b4c9c914d1da5eaf485b0f6ccf

SHA1
851d54b34e17ddf935749ee2acf628adb5a5733a

SHA256
6a706cea99f40f161f7584fec0172afc6da75501a21c1194de0e68ea305bc63f

SHA512
56367b43c16ae021875fd61159084fc4cb8b01bf137905a39f2f4d70cfdbf3038edd312f8d72663283324d9836551106ca3bfad23d98ab8061cabebbfed60713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
849a58ba3d474ecc17456301847697df

SHA1
ff495940319977103b4cf4181777040530c2ed35

SHA256
f4d6807c16c187934a600fede7254dba2aa86603faef1377b10b99b984a4e8be

SHA512
41205f374656ba523472d82f760a6dfcfaa57fa5ac791b3e1d20b8289479dde5509b47f8483d846647881bd05df3450629b240fa817d37e500cab0ff70446e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2525eb44b9ecabef06aac57efe624ee1

SHA1
aa8cdaba8332ce7b4b4e4caed310e4096d18b595

SHA256
c5eec79e5db36d750670f1512861a65a4a518214eb0ab9aba8a26908f30549e8

SHA512
ecd823b163fd32ca3ccf76b79af1f35d5a80bc03d3a92550113e1cc7ce73f2262d7a2f4f805895f45dbcc4d9e0b2f4b676cd8affbb73854ceb5a7a68f1394e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
340B

MD5
b8e4e2b7a808667351a19b4731450ea6

SHA1
de4287530a028092f78f30e14417f55bfc133574

SHA256
8f3eab5c9d09cf6837a4d1d3d9bdb38d529490b64f264b49ec9440c5322c650a

SHA512
6a9c94740ff1cb84a9a532bc8663d1382d1993339d50ac1d2f2e6f0a13f418f9a12173d441189534860c19b9d8ef41e45396076d9a41fd627b9d69d617c5d0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
217946d2238b2904afbc34aa4999af50

SHA1
d2998cef519be658868ddcca59f6bdacc1ccf96b

SHA256
502c5f8ff47b171f3820eab95c801067e27052fca55f8e8236d02215423519df

SHA512
b9cfaa25db0c287f44d4ac31a483a4bde405512066afd8f05d056e273d428336e432d991568cf4b7d68fec5bd9abbabd87ed96bb2a85b325fe633a7b2487b930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
91b588fb25cfbead5e6bc633bb263b30

SHA1
f73484b93c41ebd34de56c766ff694d78bb20b98

SHA256
fb0776fe2f6e9c6550ebf43c1382178fd7022b23789cd7aa6f80eeee0ed2c1f1

SHA512
aabe03445753ea9161a494339263c62bd77976d1293c423eec6425c2ef067b2d289b59c5a6ae451136fd905d662d369691bb0d522f4e33e38bb7e0703ef8e3cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c8851ba3a553a6e165ec7b099bb77769

SHA1
ed9b0224ea6fefc7596cd6d6a65ef310221a4c17

SHA256
f4c51894d90523afeb99f0e24d8429a8e4c092d108d1c2afb9eda3c618d2e3c0

SHA512
eb8c4fc7f1b498f554fc43ca3b4e3a0dd6ba22498d40e2310a8b101f82bd996a1fa04194b7add1d2389dcfafd9fc5d0b460bd3fcf4adf42853499385a9a95311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3603ba823ac59a04fbe75c6f221b582

SHA1
383be22f51582fb6d9a4f1bfcdd6f6b3acd73665

SHA256
53a1c303d2e19b14d8f50257ae45971f8e37d89f3fd6b6c1c93950716c6bb535

SHA512
3b7d1106ebb3e675a541fb4b7ed899c32f0f94b947d43858de4075e42156a4a8e122ad57deea57b20b24c918c1d81c48f3257056fdb5fdf5816adfe339916a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
37bdd2df59a18212858d7c2addbdd66f

SHA1
92e8baf13fb932bb0193135404419c24fce22f5e

SHA256
eca082556ef1edfa6a603df0f2526501805a2d38d483053036d909e2948d2251

SHA512
f5f519a45373dacc31f9524baea89467cca221aa2734735200a2eddbdc2c74cd3a4d058b9fbe7e1b152cb163b6ba775bf5894db31786e118aa26ec3ad0408279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
522488e5ae7727dfd5ca9f8d96b33d0c

SHA1
1f96194799d975330e91d51b175c812aefa96a99

SHA256
cea2e61c12acac2601a5663e8274325960761cc247d3f367cb8591d1a3545b57

SHA512
d8f64d74b444121ddf3581bf66f7ce521bae7930ed80501dd11ef48b31d4a91d0eed339e020d28226f1595bb1fb4ce3418212139599c1956a0dc1ebd9a5efcbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d6979cc2f02e7ca12b3634a138a0895f

SHA1
cf351825bc44e8e7fbcb6d88fd00a35954202325

SHA256
781137f5107113e1ccd3c124e2b019281dcdb97dc05c41236e9c16d9b7ec20c8

SHA512
ec85dd4d8e7c24f4d077a4dd456b95e1ef3f1331424f761f7c371eff28f88f4371a90d3c25a6cf32523925809a8d6a16d6184b0180a2273a3b71c8d1af6d6f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e3f2.TMP

Filesize
872B

MD5
d3f83a2345a8946b0e67ccfd854c921d

SHA1
60af1798b61170025ed78bb191a3d476434abdfe

SHA256
6d5ddf31f183dba6f142a5ffbcf4cf3782278b893c7d8bcb6697067ea837a3e7

SHA512
f92b5c0d0c94cb8a4ea46b8ff7c5ea295d9dbbcfae71c8eee0d9e9bc44a1afe62f5e5d675138a7b29d5fd270f2ab7e90c2d89896d7f565d91a078fbc961806e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a78db826ab54addd356015f321e28bd1

SHA1
e5a06b6cc923cedccddeeafe1c694703af049137

SHA256
2f927cf6cd4a635a3190b09da1e887303db2ad22ce40743c85c9d4e81e9d422f

SHA512
b883a6f5fc07b16fd1273eb552e1be4bfe7addd438d66b8f7f7b00b9a5e5b80608b4a5c4ed33e48df90358d1a932393dd772b1f44910e12e41ee2041aa36bf14

Download Submit