7c23fed6b3046f7e52f185b7de6de55bc68a95630c36f8da2921729785740dd5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d56eca3c45e94c3f385f207a830a82ce_JaffaCakes118.html
Size

88KB
MD5

d56eca3c45e94c3f385f207a830a82ce
SHA1

deb359e2ec21fccf2cd873a75dffd4daa895993e
SHA256

7c23fed6b3046f7e52f185b7de6de55bc68a95630c36f8da2921729785740dd5
SHA512

356000e9a53d718f0d2309e48ed9dfac3eb07c4dfa3c70218501294b9fceb961460acea793035de4c49b5e73ba3b94bfa47c9aaa0e89f2a52e89a18fe9fe52eb
SSDEEP

1536:vwgr8VkeO3o26ozmch5fal1Gyy0jsfRcNXICaaS6cgRrGwZBx:PeO3o26obIRy0j+cFICPAwZBx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
3656	msedge.exe
3656	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3484	3656	msedge.exe	83
PID 3656 wrote to memory of 3484	3656	msedge.exe	83
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 704	3656	msedge.exe	84
PID 3656 wrote to memory of 4328	3656	msedge.exe	85
PID 3656 wrote to memory of 4328	3656	msedge.exe	85
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86
PID 3656 wrote to memory of 1256	3656	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d56eca3c45e94c3f385f207a830a82ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc49f046f8,0x7ffc49f04708,0x7ffc49f04718
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1344 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5472 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16289701950329173343,6433628037147488137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
23KB

MD5
d0007015af7e55b5874b6f7711e9ab67

SHA1
fd514e45401ab3c27d2fded42f34024260086150

SHA256
95c98d45b7481d60c8078e04973ca86a67833927fac958ed6d8c28593454aef3

SHA512
375ea404a1c847f5b5e10803277d6a54fcf22ffdde3f41a06efbf4732858d749488b7ac67ffd9461a3d0b7bfd8f18ad465946cd4123c54383a410db6e699a6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
41KB

MD5
a8c2d72074b516f0f9527b492f6e7c4c

SHA1
e9fbccb6f4dc886906aae43220812f8317c2fd6c

SHA256
e61d49bb3bc6024a979c9b8f8941112d2e39e38852366dd5fd57e0613d753051

SHA512
06d09eb5b1ec9e50ce1964169827432f47ea0785103b80e42f77f97dffc128929caf20575e7e076a56e713afe1d24b88e4e9da8222d9946f16a199de15f373b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
9f82f38907a30d7f56f7d5d109e9a579

SHA1
09976196a74ff40767d354b1b069d2992b8bb6d8

SHA256
9aa74665f0b48f439b1231c0b747d4ff9e982230e2314b5eb2dae191d1c42e5c

SHA512
836247f35a6a6d2857c3a3d507fedfaebb6f2ec1504fe89d96cc1f545a7089479a60659a2f170855ee9bbc1888130b6c4199d743bc000f151ad2f6bf2e38a310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
99e422031dba573d18e5c2795af5a006

SHA1
cf81d041d87dcc1dc19ef8e75219d15cf012e314

SHA256
b2c663855521a68926a2e64d1684848f7f5bd8c2736460f4b3e37e1a28f7cd15

SHA512
7db270581b173fbf00edfaf1488d4fd7b20d0b1ed26e9d8b2f846c695a6c76c00601e7b3a8862f2bc59fbb75b144539c3361e1030b2f214764e5a8af4b1e2d0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c0486735efe915c920b8cc723c9844af

SHA1
2e6a589f675975c26f362808d28c2abddef402f7

SHA256
e391bd460bfdc5d6cac2ff098613e315c8f763368edb60280307540395947dce

SHA512
aaf66b4e90ab11d60899ebfded01ada3af7c8c2dc8e46cd7a4fc23252b3822a7f3126ed813165a653e1d7ebd417339d2a001d110bf7e9ec07b53eb6e6a7c3cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
54f7575526576559b047e6c28753faff

SHA1
59eaef43c86218df011daef63e12f98449c3729e

SHA256
6ab4e3b9f5ecabc0006a9a1389edac0a2858e182e12bd4a8d7e03f72d25290a1

SHA512
965460c29f5a9834df6117af1879beb930ebdf3778906e471834f8a68dda794b8b8e583d3b701fcb1910ce4770c6f8634e1f0d029a62c35a616bc743a8a87e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d4abc6671e275e5f6c4865fd2e9ff6b

SHA1
f9047f10668dd54b31f4a34d5cccafc1b107f227

SHA256
8ec316c10f494c5721a3339f36d1a7b82b82d524171c0d37dd19b339d39ec2d1

SHA512
1f5e58314fd63dbafe9211caa165a98018ce7942e5bef8ccbc3e50c7e564afad091d58b3de232b100f7a41ed301aa7e353b1dc84ae36ba8ff7024ac3406afec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03412d12652c52d2640e6583879b7a55

SHA1
e053879c1889916a62c6b5c3b39e91c6da1ca92f

SHA256
9333cdaa4b4db54fef1e2b7ad57eb88878a4fdd450e315209a204d3801e4d92f

SHA512
d8249f1ddc4aac78f52a7ec23245a8f356eb9f2a4acec744c5b14ac8f24be06449de6e302b0343dbbdae295431ebe33c5965f030da9525ebac270347ebb210ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a21fa54beb13e564f5ff85e2d7bb8d1d

SHA1
5ba04c2e17c8f20df6156a511c3c68084b9cf4bc

SHA256
a88608d64a880ec711c8ecb813781aa11ab87a5c790e43d6dd75784767009ee1

SHA512
5d187e75b6c70c074c0b4449b364669d5d05d5382032f892fba9243dfb88dffba50a4c40618071955cbbd1c2064d569c74edbd305e75375777e3d0b5c4c2a622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
67bcff00472bbc4d5208159cd292569d

SHA1
d8a5e624e392a045141c1eac76766591c933b51c

SHA256
f50f5f8ebabe7499439c911aeb93d23a1f95bfe32344512f32646626affd3c10

SHA512
0398759ae9232d433572ca0d6bd0098396d03516a88ec52cff950faea5d48ac7d8f254ad8ca2b33009186c95bef4e8272859fc80c9544ab439d26de8d4863bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
25c5423beb74eab08218a2c63543a768

SHA1
33976da3b59ab38a5eeb98df0c6c846d7a638730

SHA256
031fcd6f916c18c6656c451a62751fbbe9f659f4e602441053d8023a19139807

SHA512
62677217465eb06441ba8537654fad152995b72b69eced4e2cafc0a55478b8d091370d1894069e5016f9679b8f550d8125321594d87d610de56c1b8f9e855244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a166.TMP

Filesize
706B

MD5
4df410deb7f9babbb35ac4b9c988ba9e

SHA1
1fa2d42aa524f7ae309fa21766f0268e36807b0b

SHA256
69240ac0eac7f00827908b27cc149d233e8c9c3fc9253aabc6e83e7afc5a484c

SHA512
ddff21783e0d55ddfead39839998d51bd88197c1c02687f4798382a30b4561a8e57596d195a3be55992de6df08eb9fabb0baa1d5f736d17a191f2a963723cbe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6d295307c942b8d5a7bf8a5ae172ecdc

SHA1
8679d66ea0eb510ba72692a0b3d75025e99ba8a8

SHA256
bdea25062e127524c1ea503d00ea12b99981f530770fffee25d62e50d4cf4b9c

SHA512
1d4a3dbda1a9f93e97fd8fbe444f3b69321dcd8a14ea598fc4e12a02353efc2f0533a07fbec6f4bafbd59cf39b0171fd3fea6ad43dc213bf0e20fe4b714d33cd

Download Submit