5e64c9312a69a2233dbc830177a6112b8d0ec661b86ffc23d7b8944158295e28

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61630bfd456edbc088278bc6afea02d1_JaffaCakes118.html
Size

105KB
MD5

61630bfd456edbc088278bc6afea02d1
SHA1

72121795c8957dba0c798163693f04bcbfd83862
SHA256

5e64c9312a69a2233dbc830177a6112b8d0ec661b86ffc23d7b8944158295e28
SHA512

1af7e61d7233a22465f3474912dfac2b5dccb712b6e59fbf2f93ed147446af2e6d7e4193ffcb0ac14a56051327b6713eece644d10bfab75184c9f26ccf527d2c
SSDEEP

3072:XtZVYlAMYznpBgoB59bBxmsUgw5HAH4L1PE:dZVMARznpBgoBjUgw5HAz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
212	msedge.exe
212	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4572	212	msedge.exe	84
PID 212 wrote to memory of 4572	212	msedge.exe	84
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 1980	212	msedge.exe	85
PID 212 wrote to memory of 2644	212	msedge.exe	86
PID 212 wrote to memory of 2644	212	msedge.exe	86
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87
PID 212 wrote to memory of 4944	212	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\61630bfd456edbc088278bc6afea02d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac1d46f8,0x7ffdac1d4708,0x7ffdac1d4718
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12240746188945964016,5060238542287384555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\226a7823-9ab3-4e05-a16f-393386607981.tmp

Filesize
10KB

MD5
f09740798b25ce075887079a40c0f1cd

SHA1
1da008b10b63314fd603bdc5d6cf3ca593c07ca9

SHA256
a4c80a20332e23ffcaa549357efd2c9109c0655060586fd4aad17c986e9aa6f1

SHA512
5bf58724293f3c2276850c53812a08c074b5114659e660eadcfcbdcf1b7cd72b12a5a9be3689eb9fcbe9f2d294a809c02c19eee32f6679eba16dfa1684e7c00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
d6bbd0da0605c1b0e0705b821e6270db

SHA1
4d28793dc9c82bda5bae48a7f9daff63b50593d6

SHA256
79bbb3da66684d8235e3a60b421e0f075eea29e935d893e5b92aad01e0c8452b

SHA512
cf8ef7dd91408b92216d4cc98a6ebe34304b2166ec763eb350a4697a15925981785f0206c6f8dbc1174d883c5eaf886e5e540206962fdd24ba1d578e09e06077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
10a1967adb4e7010d5e020f6bdb07fbb

SHA1
03822f0dbc62aae4d227f3c9437c0f68d9826283

SHA256
71492babd7d45dfd2a28e80188c9ef861a03f14855526278a50cf85d366f4e34

SHA512
f22b237efe6d4674b2221c6b0c81ef524e348073b5e80905d626a0452e2006def286707151ef4ea956428f17e8e96896673620eaa2c180f7ac906ca01bcab9a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c4bb580ce4b9a5cca13e91e701646afa

SHA1
9d60899b7392748fde20fcf7b5af29253de8c5e7

SHA256
e992d04c608f01816d773ff3748417dfbcafdd217371a16308125209f8de7972

SHA512
d7eb88243e0cd5321f7ce4c63c23370cb68d67e5becfd7da4d815362a921a1156c99202a56445806d0f560d4ce7508952aebce5e0a68b988cb8ca8ef7700f317

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
477440a820a80ff0793d3826a696b7c2

SHA1
016552c2bc0b3939c708510d80ab03421831e60d

SHA256
94c2c350ffb4e33a01fec5299cc295d282e7d777fd5475fd0efa31e2e4fa2a01

SHA512
2b2ed991e57e5fcd737c3dc4c006b1a70c9fa50f34c1d9f571382220dcc1e7e155e65544fb5b1e0e3d6b5d266c8f897c685616f60f1ec8b2e1f29efca10a5ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93839c789409a4fcbc9ba10a10e3c36d

SHA1
bdd0feafeb690ff4a03ba16524191386f3e51a61

SHA256
69130406d4b238fac5a255d020a6c94779f6d47a17ab2c2ac5b9fa80740ff13c

SHA512
e22c9a02aae85a9be9d54a2e857b023121a61f08c0164437d880b8db5a001e1283d1208be03852b00dbb09c3f9d1065dba5371406cd7a364ae82eea19bd72940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aa67365d8040732a8c6ed543c27864c0

SHA1
a52181181492c3fdeaca29141ad235c80eea8e68

SHA256
ebe6b46ce96bdbf0dc30546ef8d0a9eee8ecb002d7c4cba0080c31c13970ad49

SHA512
f8b420a7ee83ebc36c81eac7fde0a38efe72108612cc600c536f6bcf4e4fc107d0b5f238415804d80fc33ef1d60d42ba5deb632de621d394f6b715a49deffbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
3cf66badf990c9eb229868901aaba429

SHA1
27cbda8fb66de64fbc8fe591a3bde7bd4766a721

SHA256
2eb35232c166e01e8ec0242ad6a6724185f822fa75e54d80da2a5d9a0cb2535d

SHA512
021e1ba6e61d22c3f61e7945fb51294265ba433bf0b18ef74be1de074bb4e895f205d56abab41e4c2817bbf94c0d3fde1010faf45c8bf7dc906f32736ae5d036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b41.TMP

Filesize
372B

MD5
cf8ca226996e07345aa869d2385fcb21

SHA1
34725389f2d78fd850c2eb3b9c904006884e38bc

SHA256
ea73dfafe69dbf43d6e480085331d2e650b5c5c8415275d08fac16ab3d1a86e0

SHA512
d1a70701dc18584f50ebb7136adaddd661815899a04694d4dceb517a15f6ead79af166098c9f0556c95086dbe9df606f4ac7b75b47e4b874c7be7093d86f78b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit