0dbe630f37d3ba311dcf729f2ed598af0ee54d7fb8af0f86306528b7a5146b9c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d3bfe617bb07ffd016b3919e53a937_JaffaCakes118.html
Size

142KB
MD5

c0d3bfe617bb07ffd016b3919e53a937
SHA1

d03813062b913caddec31e7df9a015da13cbad31
SHA256

0dbe630f37d3ba311dcf729f2ed598af0ee54d7fb8af0f86306528b7a5146b9c
SHA512

8d19d2a9226c70d54502980535fd2cc85d75ce554efeb87e8402c74c95c0c8281d3777a4fe4b957935c4b2a62e311fe307b432105d856696895a0b873b74da33
SSDEEP

3072:wkSc3z2UP13G4k5QhLpOatVr7x7//fNbYaaLStRtcxWUu/v66sbsGon4G59t9Vcq:wxK3G4k5QhL8atVx3fNbYaaLStRKxWU2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1196	msedge.exe
1196	msedge.exe
3732	identity_helper.exe
3732	identity_helper.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1180	1196	msedge.exe	84
PID 1196 wrote to memory of 1180	1196	msedge.exe	84
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 2628	1196	msedge.exe	85
PID 1196 wrote to memory of 1464	1196	msedge.exe	86
PID 1196 wrote to memory of 1464	1196	msedge.exe	86
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87
PID 1196 wrote to memory of 4800	1196	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0d3bfe617bb07ffd016b3919e53a937_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcad46f8,0x7ff8bcad4708,0x7ff8bcad4718
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12038190386920467750,17779934198290148351,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a31260b89b5a544e25eeb633ebe5b774

SHA1
adc1e35c468a59789244ebc913b0abb9c411a51d

SHA256
19fe36e4538f9385a4ba1e2aead188cea51007b431b56f2b7c62a235795daa22

SHA512
f157169a652bd7dcc96ec97ec24b4c956cee1612a3dbb0d618e82e14dce8f8881fa2b3f64035e594d47ec1be52ae983e71c6c8091868134a7d42c8d305bebe46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ef08d3be6399880d265669b726a18dc2

SHA1
7cf76401ef456dc4ed18751bf22a54f2764ade56

SHA256
b5f3fb8ab159e4aabcc46214b663692c303bd2d31e8d36caddf73a119c58cc45

SHA512
729575cf8cb948c22d0b5000d84fe39b1251d80726ad92e0c9e7659fde1a2f2f928d0940536e01453aa14e7a8d821c842e9090a874dc76789a6132cd91777493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
611b4b00440ee07531f8148728816659

SHA1
e513d1a9f470fb608c602de8d056fcd5f29fd814

SHA256
f7666200c19bce2a1be231b883700126f4f0c835487e44954898bc5ebf6e45e5

SHA512
8aea7d457adfeba63c7f0e2724efc73247cef1ff1e4b339e20241f4cbe55c15745af1770ec2570176adc3f43eccf6e727c0f45675746d8310a447c20e49480a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6eb30e1d2044d329e4548d0335f9b7e6

SHA1
f8be73003d9770f32f58b374c3f5bf8304f25eeb

SHA256
0126d91cc9e7a45535a714bba2c0698f00d7162d871f15a644013033445deec3

SHA512
eb1b56bc4b7c46f8d0890848c919ba1db1fb43e308500d26fcab51930380f1455ec6c9ec8a63a62a597c18cc318eaeb1e952291d13bf16c652ad0471753ae0f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
caa8ce6fa02521891ad9b0ca1229bb3e

SHA1
05ee8e19d31ea5a04bee08a226f409a4e7a80c8e

SHA256
887112f5efc6cedec50df016a17ee5bfde31a913d34d3c8167ac396366481d1f

SHA512
4a1bff9347a368d9ba8420797e6d35df829f3310ade96fac5cca7125b2d8408f0bb4c036cf855a7815088816360229eb43d68d5a03d3c467a1277a085c88aa1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d969f4456da7c365b2e54e101bbf7ab

SHA1
1dba3d3a7d0bd7de6abe932b20732e5f9ca43264

SHA256
cf27c96ce19ae9f94e4ad7a5248fa57414d907c14274eb311ffcae5fc43c13e9

SHA512
9ef9021cc085a64d672cb6e517c8e18f40b95c35a9a84d51f1b52dc0195af5d77df6a9c7784245f26aa2afb713800c78dc4655cb444aca2b6a7435e70b5f9988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6c2e15464f676627793760d6aad639c

SHA1
308bf1b6384cca2a5f4ebcd4725c5007bbcb2189

SHA256
619afaca2e18d3f3ce214d7a0be2161b17e3ccc1586c5298919a2fce8dfddc85

SHA512
71e0cce21ae883e6904c885ad9126863a3a19af7062b76020567ae5b452203d115f1ab845e96b53a5c95081eeaf0610e5c6c4ac55cdd67dbcfc6ca461cd85fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5d65ffc2548355ec0a19633da10f2264

SHA1
c4bb0f01f7ffb72ce567bb86b04bba710cea364f

SHA256
fc7e1ef72d805d3b3e0e21f061ada4b8f3deff4314af3ebf89799a26e29721c8

SHA512
49151632117181b504a54c2d9a7eb93d1e94ead84a34b4149b1988000e025bd3ff4908e8fc8f934cc0a27e0d0d1d37c8a2bc0f2b4b02fa7928899b978db4c602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
1468508e542a060332f8bb447832bb43

SHA1
782bc7804386528aba28d127f0895a35cfb5c1d8

SHA256
5aed4663394815f57b83389ddf4d139e10a3215b19484146c831aeb25b22aadd

SHA512
6d75273e9d9a780b406615e995062b181c248f873ed1011d9af15fbdb35daa4fcf2f5d0712476850e5199c70350554d77ff578050182ed9cc42df625b9f8c0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587af7.TMP

Filesize
370B

MD5
d973a897c2038f0f3e91d7c6916d1601

SHA1
9fe4144715d83c9f191b1229239f541408d7e70a

SHA256
adfe3b81309edbca48617a5e86a9920b237b588e0a6f9c34768dfd88a0646bff

SHA512
f63331727b6c3df5ae2c5ef695c3acb6fdae201ac10390ffe339a564f0753d66fde6d273f1a6181870b1303654bda974fa55e16185b942e96ec79a62a9e779f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c892fe336aa3082bd467dda9578183ab

SHA1
203b1404e16e5af71d283e1a6a444d94ee20772f

SHA256
5fee19a4664c11d0a893e5b696a32d848f4a75c9db4dc7134ee3a963f71b5e48

SHA512
0c63ab2ca62df256b49ee6646c776a4656ab6e6bf1e5bad86eaa6300a980dc7184dc1e07792e0df0d035f8c46f8e9c980c52592315e37c10b6e7bb8f019dca44

Download Submit