04cbfcecb5e6903256c0b2fbc06c9d7226b7a84d09aaf6eff0d9398e71771f13

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

325258c295755b3f3010b8804aab810c_JaffaCakes118.html
Size

188KB
MD5

325258c295755b3f3010b8804aab810c
SHA1

b8c649189ed19b1979d9be64acc235f373450623
SHA256

04cbfcecb5e6903256c0b2fbc06c9d7226b7a84d09aaf6eff0d9398e71771f13
SHA512

ebd80c1297d0e399621c7f4baa7c1028c467f23ae325d685a4d47114ddd1d5b29b29ab6173477c8f68dcc5e4ecd41ad24124be70a86a0945ca33e5257fa8226e
SSDEEP

3072:zBZpTqef8hER+PFBNxNY0Pcve6XDBCSZkIcz9rCX7CeFspuAAa+LsWc8wUcXmNRP:NqLli2XmNRP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4368	msedge.exe
4368	msedge.exe
3976	identity_helper.exe
3976	identity_helper.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1180	4368	msedge.exe	81
PID 4368 wrote to memory of 1180	4368	msedge.exe	81
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 316	4368	msedge.exe	82
PID 4368 wrote to memory of 4104	4368	msedge.exe	83
PID 4368 wrote to memory of 4104	4368	msedge.exe	83
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84
PID 4368 wrote to memory of 4376	4368	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\325258c295755b3f3010b8804aab810c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba6a246f8,0x7ffba6a24708,0x7ffba6a24718
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1443447759998727766,12483347161307304690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
240B

MD5
6ebb2f1b8d68733a786ac3588d203fc9

SHA1
a9f68db354ef70f2ae571c2dbce9b14b458d09a6

SHA256
35b6278f870e3b1a0a506c6773afa78f5ac71d23cd273880e1bd7e91d91e8e0b

SHA512
e065587f2e08377082612fef00790309676049d6e430b432d4c09c76e6c187f0f453fece9e5812a3f847b3ebcf57a9dcd7b48ef71dd000db84075cefe07c2da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6a4cb5c71b497ed6e2a9420990bc348a

SHA1
0118d1413e9894ef5b247485eb515a375bced1c1

SHA256
801b9a00b35c7a01a17b1388d456a5815da1dfc95e6420a1ae45956ac2e9de1d

SHA512
2f0d4636e43440eed8d97968555fddb314f492d5e5a3ec47658f09d796f67d4185caa7e4df9bd6bfcf1dce5c041692b0cd3b0c6e7c9821dc5b9dbbdad329ebcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0cf9314415154546d24299a9324bc620

SHA1
0e2231cb5c5a975f976373d0ee904179b04c91bc

SHA256
5e5bc92119e443d7c52a9ebce88d0ddf214cdcc10938ec01d3e0b208ee756e89

SHA512
77de3371b86b669428561e44b6d4f1915ce1f0d509e2800b751d12cd3ba7df3654263b08e63d9951bf5a7f11b5463f3dc0fffc19fb1efb7cb857d1f4b8445d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5147a1f5479cd3f68a3d729fecd04089

SHA1
29a15a70093f150293d81d37653b33ea13238ed6

SHA256
945e436ca12a52a2c6be3b3d73c4830db159fb2cf25544c6658c233f6a775942

SHA512
5f47d44dd931e108ac4f71971e3f51ed3b69bda333ca31166a1ab69a3a2cd3422b0d724d1ebbda54f0d2457e6070266233fd23a639e1613d6aee42f508b245ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37fbf645587bd697e237af1412afb015

SHA1
8e798f31047d49c7092908a60cd32a0a96ccfaf9

SHA256
cdf1cfd321c8090a996439c382038b873d107c4e19f97b78824205fdc044ffb5

SHA512
6e7e747774d9a56b733221df4b1074c1da4d7bd7c40cffcc65f333f0bb89677c6385e9ddc4092ec3c156ff6c46c00120a4ecf1c049965592a4f11cc1bccd04d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1662ff933b1c31460162fff3840d3c7d

SHA1
59932b274837877354b2304b3d4f4eeffe03e725

SHA256
d1ce5fd346a04b1bdbdc45d084e3152cf69a79a9cf9ccd96e62404be78bbe90e

SHA512
c1629ef0d7831a892ce9e549b80a9a0be8c6ee9ab658a20a99adfaae2de43df507c6ff46f97cd01b54acedb0eeb2fecbf388f367dd36cf9e8c359ee643b05cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c1010d354c9c3b8031f822e7b98c9451

SHA1
089d3cd134b7c5afa634bb27f9387b6a453332c3

SHA256
9dcce7bdada0d31f841594f65d7d0e8adf718d2dbf5227b927d9ef171a68ed41

SHA512
8b0893ce8d8dcb20dd6462286f66b14055a1af02cc06eb86f0f147bb3bbb185ff24f5b700e082abbece32ff91ab7edd73555ebea2cfc1b6f7db489d1068b96ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ee94155be62e8231d03b5d95de90884

SHA1
ff046b80336a7d6d7f30216593f8546ecb00640e

SHA256
9eeeadf1a981714ac229e751d20c2d4d3331e33a353704e95ce78db27efa01ec

SHA512
7f850e808d002ced899d2e50a6ffe2c75c6f7295c92d74b0a165846b38a323c6eca95523347b12c200c6c4619a4bc43e8244fef7305eece8da9a792489237f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
73a451a7f4f7ca907b9751d2bb13b803

SHA1
8356c2e00753439578e188e4b3e2a11e153a846a

SHA256
76894e64b4ed6b8414c18c7933f447e1a8367b0ab3087f4da74ad32ca9632684

SHA512
804ef6042ec1613fca4c7bc5b15062451ca9bdb1aa68f017bac9bc0828293e28f0c9bfb43af849e5b14da59f136a8663ca1b0e374f73fa6d94ff53c5c3a2c752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
ddfcdcf51462763556a22c7b75169325

SHA1
8c624bff6643fb4a6a58ff3ec120024eb1690a87

SHA256
ccdf161dba57ead894c786272cdcb9f2597dba61fb84ef9624210a5e39e78c83

SHA512
54a73e251c0e6b0984887647c17842bb3cd1c713929384def57651e8a484c824666d73efb2764ed247b400b0659203dcd4fbd1031bcf7cfbab94d95dfc67f255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c3bd.TMP

Filesize
537B

MD5
cc44373a22a8a3dafbde4213819f54e8

SHA1
e206bec3b876af312a0579eb556110bcdac417fd

SHA256
276c155160a800398d51417a5972a5b28d952627516096a7cc9a8192221ef0dc

SHA512
9806f3f20841ce65241a5693e299ff0deb9407411fcd6c6a776e40ec0c79932906cdadd982b97562047599f164520e0151f3aea4a374d2fde694de370ef6e059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3949afb94286c51b48a58a38e50a125b

SHA1
a439dd17f1a10d0daac2bb6c10ee8db952cf0320

SHA256
82317868b7701a01357fe2414100dc2b7b202cf2fbbd7554c1741aa2917334d5

SHA512
e1c1b0a72efcf8e7c7a3aa7870e7b951e1caeee51494089cc35f969caee1f47e8398c093572fcb6779a27816c4c30a3097cc0cbe7e241945548c81c6017409d2

Download Submit