e0ce4f38e976bbaf2f0246b105f0c622413be834bce64db268c00f6754643aa3

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d52e19a98e424a018c882522f86e3656_JaffaCakes118.html
Size

55KB
MD5

d52e19a98e424a018c882522f86e3656
SHA1

1d645e8305d77aaa6b5a8e1104a57744e57f2204
SHA256

e0ce4f38e976bbaf2f0246b105f0c622413be834bce64db268c00f6754643aa3
SHA512

028808a93b91a3235e880c2ad0d130e0fe6e83f41d31ad9cd353e303d67925692b2593b2b440ad685ff404e418689faaee645821eef5fdda8f0b9aef0428722d
SSDEEP

1536:n5gcRcOcrMeb5sxSUZ85E1Ad6INkNm7Q9O7f8sJ8:7RcO65oSH8sJ8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
2436	msedge.exe
2436	msedge.exe
4912	identity_helper.exe
4912	identity_helper.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 996	2436	msedge.exe	83
PID 2436 wrote to memory of 996	2436	msedge.exe	83
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 4636	2436	msedge.exe	85
PID 2436 wrote to memory of 1136	2436	msedge.exe	86
PID 2436 wrote to memory of 1136	2436	msedge.exe	86
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87
PID 2436 wrote to memory of 3524	2436	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d52e19a98e424a018c882522f86e3656_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1717741136524784346,5404092539570835602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528 0x430
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f041ffe-6ca3-4580-bcb4-e8d9d0f30fbb.tmp

Filesize
6KB

MD5
cc3dc08456eadafd726bd15cb27da6bd

SHA1
9d312bbe196ef2ce7e60491a906e2c340b13bd44

SHA256
1e6a691b21163141178bba0c18d0675ad1c1afbd1ec72b65b01c31cc5ad2a7cf

SHA512
ccd54b7bd3c61e62da2a2dc03987010ce960dee5f6732d3c499e722ad8990c5f41db75f06fe81eac55782beb1c220d49257844b4ec2be5a241400a55ed7c0fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\31319f53-f3aa-47ac-bc8d-f71fe6b28b4d.tmp

Filesize
6KB

MD5
1e9de6c77e259dee788b78349277420b

SHA1
84afa2e3392bcefd5bfcdd254dadd8ea081abe85

SHA256
1489b0da7876daaf2e05ebe4d00eaad3210fd213c7fd58f3615ab1bead04c751

SHA512
e6360fdfbc56d9aaf192264506bebfe998081f86abbc514ba4cc607fe037bf6bd3bc03f791d516219f9983cbbcd9cb1cc0fb4fbf57e527d8a5a90da4b4200a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f94b4e9e135dfbd7a36c0330e79d5d70

SHA1
ab2d17827afca4c4348f07127b8a62b94136e52b

SHA256
6f58df0452c9cba02daeb177245991557d0228bdc4eead7372e3191a45160579

SHA512
99d009dac1e862f592ede70bb80faf143e4a294c7b90710b99932f0db1e9a1edf4fe6d9f03e90265d689e28be80fa6ad614d6e06c9cf622eac41d268779f334e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
554B

MD5
0c794e2ccce4b99f6ce7ec47d6b73c2a

SHA1
4822044526de39dc7e94bde7af7267c25e24f232

SHA256
e46ff349ace2068db86ad8a7ad762c456b7b1263179c6c741f3a0be9ab1b944f

SHA512
21479003682a575d4d9f09e34469d4112e9634d62ccf12be8bea4a2795143db5e9ccee5a07041a013f19feffdd73887a0183bc4803685b0c06a435b8e4c15a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3498e4ac7d6b12287bf1596ad5b7c912

SHA1
fb358ef268d28ea7cae678ff6f3428cadd569aa8

SHA256
843608b61191386568f4569f343ad8b3c1d1025e15768ac1d00c323af4ffc975

SHA512
6085e27959a9246d9b05b4c97789293cecdba33ea678d918893c3f468ba91d666fdd548a7f38927d17e7ba621d2622f36fa38ebba61c69b23400733ebedb51aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
797a3fec6e1bdbceeb6dab654c859a90

SHA1
3a2c40155d4a3cf7286ba0b04226cca2d873eea5

SHA256
8a3c7e783402b9be34fc4a419ea9b4b21ade29e946e2a8cae4dea5ad655204ac

SHA512
38cb994081a0f78e4194dac1a943fc6a15218edad20abb1994c2b91445d83d8a646a48b27d04c096439b656db920df9e82acd0d8800cf6b445f43996f0082eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a5d28314b316b4aecbd750e546a480b2

SHA1
5898e0a437b6fbfb949d1b65dabf949a45b429b7

SHA256
9c20ef41c294ab71ff7d6852251f2d65368cf52c4478e42afb5a7f32c853506c

SHA512
8c664e1d20e78505b2f24fcba4993532967fb4e5ab7dc3c7d27682c3302c3b631ae85cc6af3f6bd24e981438d9e28ac5160b456597f182dcefcf6cec7d860c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
b023c9352a5c450f7d9df53a691c8b59

SHA1
9240ad1f20255aca7fb5c55066ee2ee391d483dd

SHA256
665a96e508c551534d7c4a86d5920493821f3491b15a9106324a5f25835dc83a

SHA512
6a50c75b35d98a4a7a27ce9f32463437ddcf716860423f06d45f2cd9b85d0f450657c3246b697c9dc6253b75bf6bd03eb6328dfad3451907d20fff352d187718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f126.TMP

Filesize
204B

MD5
b4a468269963f183dc285ab381cd25b1

SHA1
5101c7a214d750a42b1e6ec2a44e0b8fcc2a5aef

SHA256
c9b3c1dd762aea4433912ca5903abf9c3e61b5227eae9dfe76698c3e0e1c7a23

SHA512
0ef951ae1e710b4ccee81c93d932d47b2640f21842978a73e351bab682aa484758aa4536c2d482de28fcc07518265cb07badf1e3dd3c07b089174615ccefcfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57be6eb21d898c8250cac43a864470ff

SHA1
c2fa0ee6ade21384a2ee9278a6edc63d26984230

SHA256
d04690b9d489e88b94a5ac6a7afbb7b8ff64c72e26495587198add74f14b0b08

SHA512
6de9509cdd5ff7ff95ebd2684d838fdade8a12f96d1f0a4e142b83941afb09ee3e7080c3a46522f6bc3338ed902b7085d77f56a520f2974405f45a9d42da7626

Download Submit