cb145b894c98cbd5ad1504bd465249ed35e16f6b3cb3a1e2a37d4754ba815856

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d23f7ebb4374891b72dc8a469414e30f_JaffaCakes118.html
Size

51KB
MD5

d23f7ebb4374891b72dc8a469414e30f
SHA1

5fbe079a1605019186b23325f966052fb62b6330
SHA256

cb145b894c98cbd5ad1504bd465249ed35e16f6b3cb3a1e2a37d4754ba815856
SHA512

9603b7ae4cd299d2da4c2cf99aac6de963fcc7575b735d941ee43f866757a186407738d8621ab461ba5eed8c6cbf45a8c56ad5a9f7b09f3a880265ea2f32a205
SSDEEP

1536:cTupBR+CCPXDAcfn/ntngOk8WU7Dez5Ua/:tpBRjCPXtn/ntnPvWU7Dez5Ua/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
1728	msedge.exe
1728	msedge.exe
4756	identity_helper.exe
4756	identity_helper.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4376	1728	msedge.exe	83
PID 1728 wrote to memory of 4376	1728	msedge.exe	83
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 224	1728	msedge.exe	84
PID 1728 wrote to memory of 392	1728	msedge.exe	85
PID 1728 wrote to memory of 392	1728	msedge.exe	85
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86
PID 1728 wrote to memory of 2720	1728	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d23f7ebb4374891b72dc8a469414e30f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6dce46f8,0x7ffd6dce4708,0x7ffd6dce4718
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18145227642418157457,17331283229894786622,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3973bbe9-d1a7-49c6-870d-5cc3e7f354bf.tmp

Filesize
1KB

MD5
9748124a1a7ec04a58005319bdb29f46

SHA1
fba3310528ed9f633fb9d69f276c3bc941f00806

SHA256
c1769f61f08f021ecb29620fa8de3ca35600df698ec5ac34c7f71249b59c0648

SHA512
ac629f0dad8d7bad89552f24a13d19f6fa121b366628b6b40ef647961051ba5464535383686dce5d33b165a79fa6ce606171acb5c74ae6dc8ecff091796b9f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e2d845e1dcd361cb8c73a18a46fca143

SHA1
32241eab14e66e648963d8a71f1872919097da6d

SHA256
61653486c82a8bbc15312eedbdf07ccaa82618f441f6428fb974355b01378cbf

SHA512
d4dee70c807900f088307f013329e06293988a1499ceed9dfc8ca5bece678b5eaf4207e9a770ac19746e7ef56e2bb0d059a4aefb2186b3adf71b04fcd1a63dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
adc00899eecd04f510605285804d40d0

SHA1
2bb91e695f818cdc82160d0bff7c670ee09ff880

SHA256
205ac04304d4de2a04a6552ae96dffe9ddeda1a37ae40dfbd48fd52c757863b2

SHA512
7cffc0c410fb6e0717d48349af76c898d3093de1de588a99a468dc8e592d44843dfc529d7dc6dabe23d0f770200dde5ba05213c7e3d6d3cb7b764e81d517a623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8805613b4fffd0e47e0a11b934b1394f

SHA1
29f5dffacb49da5461c0b8916800fd59949793ef

SHA256
7e0d173a19d9f1a70504937f56d650841bc94a03e7df2e47a5fba9ef1adfa7c9

SHA512
f478a8cfe5c8b2c2c6eb11e213117dd3c1cd1aae6c67f17c61266a82176517da8e8b14899d6834ef477bcca183062fb763eca527e058d3105ec2558ef5c0f4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3d4647c67536db994b627be152c3eee6

SHA1
4fe398e8eab78fc6cb5b3b904322a438390fa19a

SHA256
db097159cd38ef991919c89343b05b17ba9585b7d9c422086f33c736d898152e

SHA512
269904864ccb1dff843a99e14edaf2c7f1d6397de777a2a70581a2c8680e97fab171193afdce6973a0cf2a4c8b6c442d10a5ea7a6986fef3b04dd7bb9821591c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5625b07607ec2926c54d3b9f5cffbe45

SHA1
e3cf901665bbb2a0f3fb286fb2ace79eccdf16d5

SHA256
103f10cb0a3adf4e6957d539e0abbf060ca0e0e869697a28909834e4c4be112c

SHA512
d8db0a08a09be640a78d327535df5ade11f1df8eb4fedee26ee79a0918cef1fe1a8f0cb4a17d047d01fcf4107982e06c223466bc8650c048fc84e3ed408c05a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc1884b579f808f6164018df16921913

SHA1
a5bb6476cd5c2359c88c70d6a7af75a2a1a16815

SHA256
3d684e7fda64defeb422f4cf425a2d842861689dc2f094f381a86a3a3d660f44

SHA512
a04db9bc92735aff447e0cc8123500aa6423ab76a2c1e4478aa4d631876ee03aa3e6bb4c96266da24c1c5930e6633749d719081af3f8dddec2dca4210ec39be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b967b9961892848df2f8ab74efdc24a5

SHA1
3a4365758d9e07ba97f514c81a0afba308af8857

SHA256
2e15f8db9cbac148d9c921674b956874c0bccf2fd4ac7bc07331668418e38150

SHA512
988fe66f7f5817be3f49d2c85d196b5ae035f850226cadb8889b3a18509046662a50e32cf5aebf5391eba76f113ea0aaee32c7a24887dd363747fff666576b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
043df22338af48caac948954c8a0d5d3

SHA1
2c20ad7fa2b602b5319716b834064f1a918f22a3

SHA256
46177d5a244c072c7338d1344d14385f0fb02f64e03d8840466aa902c1943356

SHA512
b4e0f9069c358d4ec23223335c77785599a2e5ad9eea82e3724d1fcfb8ce09180c8e24f7319af6a0285dda9508b65b5517f994d371416dc8ce90d7ca08b24dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584457.TMP

Filesize
874B

MD5
c350858aff908369993d3b8920ab5afa

SHA1
b4f443c1944e662d39906eddf6e9569a207471b5

SHA256
4e163f4fc21e17f5948cb1cf79009d4469a7b80dba4cdf55321432a7664f37e1

SHA512
72874a9b49cd4f5a0c559f3c69e1c5531c17d041306ac8c8670bf03267b72e46eafc13fe0a7216d1fc6c5de59bd2e24eff370d817b72ba040319a49228168888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c3c23c80411b9c7349a441f11d1a1f1f

SHA1
4361a6ea782ab8a6febfbf8791bb6202b2a499ae

SHA256
bb5976e57a25218e0ea4bafea96bd5a08476a67c99d72b8cf9f153a8f84ed72d

SHA512
f7d640c4279b8f582305f9fca2321444c44b1903c050bb9b4442b901360cceb3a26d0dab40730a92d410c4da42243d8a2a1382bff0a0a42af6446077288bf686

Download Submit