6b42dc33f52f8a7c88fb424d98628419cfe68f6b909a57235b39a1eaacc9322b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b64bcb6d1b9cf812be96b0d40baaf8e8_JaffaCakes118.html
Size

108KB
MD5

b64bcb6d1b9cf812be96b0d40baaf8e8
SHA1

6e5628f2c989c69a200ae24022cb6d5edf576856
SHA256

6b42dc33f52f8a7c88fb424d98628419cfe68f6b909a57235b39a1eaacc9322b
SHA512

5609d7a27ee3ab7a7ca3ffd923704c90beed3a611755faeb4f32ef7a06c96e8e384f0c76a058b6391ee3355859236f17e4fbd0313e2d5674b38d719062c75308
SSDEEP

3072:4iviEPLsewYlW68t68vH6OEn2TX5ppRIR8Lg2jlS2+9pZ:4iviEPLsew24VRIR8m

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	sites.google.com
25	sites.google.com
28	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3948	identity_helper.exe
3948	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4464	3872	msedge.exe	82
PID 3872 wrote to memory of 4464	3872	msedge.exe	82
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 216	3872	msedge.exe	83
PID 3872 wrote to memory of 2648	3872	msedge.exe	84
PID 3872 wrote to memory of 2648	3872	msedge.exe	84
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85
PID 3872 wrote to memory of 768	3872	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b64bcb6d1b9cf812be96b0d40baaf8e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c4646f8,0x7ffd9c464708,0x7ffd9c464718
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2651048864334896397,1452339255535657545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
106228f9d0e831b6849e73c3b38d63a1

SHA1
3890f187c1b962201bad7df2088443750a5cae2b

SHA256
94c6e67aafb3965c76d49a68b1bd2623c0289b6382a0f0de50f11e2eae9fa198

SHA512
2cd0c15ae0c06339991111c6e10290f6902eafd2ebade0d8100e7f18c75e6a9e07509ee2d793beecd5b4bae08985dffa327deb1be8df8596ab9dce04c880c6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8ce378e59e50288ec53d156311d8ca51

SHA1
385078d344780d9193926deaa8a4d01b283ce927

SHA256
7dac3ad707d57969e0a62b9bcb4d12d51c1ebfd5473400c3f470f74c0c1f898c

SHA512
165a0eb9f2a14f1fea3f8c06acb3b7f3577ad16db0e9b7d0207dab5980cbf3a9f4a857f0d1ac3b81fce181ca454deca5370dab1c69ca9045759c21bfe95ea9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
193dc8d3f698942e17155bef95b66572

SHA1
19e0acd0f4d2cc5ee9588f616fa39db167c9b1bf

SHA256
ff4e780eaf5dfcbc56a883e0fccd59ef231c6c12bdb430c02a3780b1f63044f6

SHA512
96080e4c72e8ae7d9893e7ed5a6db21af191e2d7a6965a12acf2ed994d31e88d5ed9cb957e067166a6ac4bbb69ce595f9eb7f931d0611ea7a968c8de7fe35ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
42653fdb7d745e6f6647d3f68a5b9261

SHA1
69e0a5083cf3d76833cebbf5a9a32497e65fc95c

SHA256
baa5ccfc50b97cbca9f1183c0c38aab3c593f8855847005d1c1694918e26fa3e

SHA512
ce16a057389e547b98c2d9dfc0655523beb885108f5fd34727fd7d96cfdf8d3986c1fe14d4357549920e5340f461a299f816e591eece0dfba3f475601fb0769e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab7ba5fff250ef0540c5566999720d71

SHA1
9441b4233d83755203d68321b900231e4a906a4d

SHA256
3af9759299382da0d3d4c253a0f3cfc08ad81c8d489c380932b5d3951403035b

SHA512
6df75c1a45c5c8cca39cfee1a71c66f6028a44c2523d29d5b418ee5a2fbd0e2704786c373eed69e32a12a948d73755a3c36acae7d4d89550840900a3c0f2bee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
09a02433e16d1a6a0d7cfa0d85dbc85d

SHA1
65479be9c58cc5c62fc9008355d5ad88272335c4

SHA256
8e96ce74d531c8499cf72d5758ce41fe201e45888f3f7d00b5dbfc12675baa14

SHA512
1546a2e86e8485488bf0c3e43a3974f898e5d604572e44dbf3bb80489aac52a23ac053c9199c47c66d03e4717287a808f76ddfdded8704822d1c401c7b61ace8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5ff466faeecbb56ea75ef33158330082

SHA1
7b61acecc0d4beac7133c27a968aefbc79bc0ccd

SHA256
4986851a470591e89d6c6c163765900690b3e4e38abf628c28865f57eee6de28

SHA512
37fdec7e696232e0160cb0ee46d9095a850aefefe84ebfb529726b2e31e0443321407f91868de2744fbfb7057f756876261b86fd44a5feea5730635bf0b6bdf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
832e2712361a63feae648228508e1619

SHA1
536b9868c9e069d016a117fb3da99ed159aaa35f

SHA256
0358c39585426a1f891f88ecccc74e261d13a7d72fe8eaa8db236a03502f1948

SHA512
1601a8682bc8827caf58b68f87b16b300dd79309c4061ae6f1ba85795fcf0273d6b1710dd31dbf30c79541e2e4ccad939835e5cd2f3ff5240e90795da7d0d73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a305ae40eeed09cda4ba9f62ff9bd7c1

SHA1
1c0689c790c5623dd811586c69170dde6222cd32

SHA256
1b1be8388e4b8bc093abe7e17f85939d7f9d3e4204354af4503f2db5427399ea

SHA512
0df6b214238aac63c995356177ed66044bcdbee4b5ea7b14c83fcf8bf173f4e62307cb7b4ade6996a0c6edc4fa4ea24491a85838a36792d5e16c77178ed03bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588e41.TMP

Filesize
1KB

MD5
66b4625955196e753003a396de6e831f

SHA1
deffa9fbf207eca7e96af0c0fd48dd7f99a8892c

SHA256
16a2e35cc797bafc7816c43c4fc0dc0b2fabdeb219417e51f0e70e2b7af9cb96

SHA512
64fe02507aae424f0a2f4580a8b394516e3141f20dc346b929fb62efbfa306c8df0a10608be15a00ebca8ed1dfbeff66528aa5acb471487fc383754df2d97223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b304adf82692f093e914718139c0cf42

SHA1
f010d72a0879807f2964fbcc12d3d564ff0aced3

SHA256
c087ccb81b8d96aee3e8f7eb672c5c738446ee3692f4be0e092e7bc016c3f0c5

SHA512
648bf2899cfbbbbd4603e6abc719a11481a8b774fe36c9ab6ae5d83e2b956ff2138b5fac2559c0bb39186aadf65b8b1834b6a0664fcdf275dc1ff0bd3998aadc

Download Submit