fbd84e8cdce25db56fdaa47a1309bc4d535d40f443e7966b288592b38b59ad4f

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da3cd32857b8666c5955013082c047ec_JaffaCakes118.html
Size

437KB
MD5

da3cd32857b8666c5955013082c047ec
SHA1

c553c0af4663a92762cc78a8dabaa1fb92ebb5fd
SHA256

fbd84e8cdce25db56fdaa47a1309bc4d535d40f443e7966b288592b38b59ad4f
SHA512

b008988604e3589b1e509bf0e69528d948f810c2ca26fe5bd760fa439d5606542e23bc6877c89afe4757a7f24a109f8681282be247bd35cec9b706e67f225ae6
SSDEEP

12288:+r+WOj3kr+WOj3xr+WOj3kr+WOj3VXtyJr+WOj3jr+WOj3cr+WOj3X:+rUrTAve

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
4712	msedge.exe
4712	msedge.exe
2988	identity_helper.exe
2988	identity_helper.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3512	4712	msedge.exe	83
PID 4712 wrote to memory of 3512	4712	msedge.exe	83
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 4540	4712	msedge.exe	84
PID 4712 wrote to memory of 2812	4712	msedge.exe	85
PID 4712 wrote to memory of 2812	4712	msedge.exe	85
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86
PID 4712 wrote to memory of 4024	4712	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\da3cd32857b8666c5955013082c047ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12433339222630674586,14047768017746320363,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
20286ef19317d346b416819407d645ff

SHA1
987d76be5d1ca6b32e662de8e06461626dcf74d7

SHA256
0989b6ab0f685ba9de7840ebf52bff5d00abfb7ba0203d76d638b4c9eb964d43

SHA512
fa2958f605ad3439b7a2d8664d1b1dd444aab6f572ccd0aef4b1c8a17230517dd8b1ae51836eb12c3aa8c645f6b50c71177af00d8d20ec26de8ba43ce98cc177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
9568b9813efa0e0ac78e7ef6c5e71615

SHA1
07187feea1d75498406474cf3b77f0a12b096f2c

SHA256
88600b57e1c87049f9be11d312127396b27538825d4bd36b6c435cf925824785

SHA512
675abbcd5d86cedd04cbfbf38e337ea17e73ff8c8e227960b35a90bca59e8b1b193caaf0544e832850c6f5edb3eb7daccc9f687c9375f95904076b531ffc5607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
bb1fd43017424311e6bc8858617f328d

SHA1
87622e93b52750ba5d29d78a246d43a0ce4d69a5

SHA256
9a7f84bdbf1f8782e58e31090f3fa6d4345ccc734be31759d746483d3335a34e

SHA512
1c67c01f8bd87ee29f032ada9c8bd39111d8912e345f3b28769501a98cf0c8510c05944d073e65a208119248e1b3b9701560a0f17d7739d741821d9fb86e9bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b36918040d687c5ba98a81c7cd562f48

SHA1
c72d93a7a03e4b2c082d3ad51da2bdf9b71e87d1

SHA256
1c382f409cbafaf8747e5b25d29d4f026f1fa94a9f6351e4514cf025e9802f9b

SHA512
c23d11d94e6b8d5a912fedee77d48a6d7129c39020bc3ce92329993b249e8c2c0d37250c15d4fec4b56f4d73d085cc919a06188e350eaddb494a0be92a32493a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c4d975a8fb5088ad3711d0d64ca3d1e2

SHA1
9b8b958ad7d028d60fd46e0307fb37d12a997e45

SHA256
52a62ba41c473335d75fc2cb7c9fa65bc313edfadb8cee7b9998e178db596ad4

SHA512
6f186c7e31a635670508dd6a2839356b1fc638f74d53589b8a302ed57ffad34a2d5d528dc66597a20b029b4fee4f03d0a1f6083c49c7edef3e237126dc02c38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48bdcd758ab0e7c0af1bea5a3c0d55bc

SHA1
e06d0dab383f09cfa8a74a264e663374aa1a2f35

SHA256
4e04d421e56009fcea0fcb944e36047a50a6eefa4d078b53e3bef2770c314ec1

SHA512
33a097957cfe64dca1186502ff16541fd87005c7732d8350be86a70c0bf5784a9a3e89567d627a98cd80e4338ea736e8d4735b4c91ac8c6eba45e62786faf4ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
987c1b8fad3a22a73f4175364f973aad

SHA1
423ed8bffa4b547d1a27b22464eebf5fa45b30f1

SHA256
378935039ab4e51ce434779e4eb92f3d94fae068edded8d345838fdcd2590203

SHA512
f333350f60d732ae34a918f269023f434e1f75288dd77ebb52728be343a90bbc261321a6c578c0dbb4baffc520688142693ffe3f13336b70feb62d9a7daebda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ea344bac82ed7a0aba80927700a490ca

SHA1
d598b67b69ff7e4a4ddb77a524f642a699143308

SHA256
5337f4d20b5bc9db6b1f90b65b845828c0d416523961d793e3fe9f3f7050a938

SHA512
48ce3023c2129a5090340d0c9d719480e5f62a2196250fd52eb55969c72152644573353d1f79219e695fb42323c5ec8360476934aee3c4501acb84d69d0ed808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7589f081601a0fb16340d1077e99ba90

SHA1
4d6a8823ca55556f9bb4a40de9685f0bfdf3ec07

SHA256
05aae2e702dd6c6a13dc80a8ce2bb791c6daf30d96f5f375c7e61393c25475e3

SHA512
316dc8e62ec1c08cc2c7020c2fb69f51e00810af82272296d7b91f02f770466a5ced83caeede3d6ab9f435006691fe0fae6ab0a073cebb2fabfe0763bbbe1938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f608.TMP

Filesize
1KB

MD5
3e97186456ad787c60066b5f77b2e56f

SHA1
575a620c258bf295e83346f3335497e4423834c8

SHA256
a731c7ad02d977436778a0a762dab693e8d807cf6073099176674dc7af9fe8da

SHA512
1dbcbfca140283297f6d4226347205a2d056393ed5960d16b6d8ba1307fdae4aca23a1cc35b647b0efe06dcdef8789b9eb3b643f602284e4df7d949412903d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
680beefd3f3afa4d5da4c1704752cd68

SHA1
78a571f23ef1fdabac0ed634c4b9e98c4a0ec711

SHA256
7be593c671ab899df151ebab4e60dcc952911d4b6a8bca210bbf77bf82c04868

SHA512
548caf74611ebc4a9ba14d4bf0436b5706ff334bc5ed6595dc9b2adf2cc60e2ff00a4720953a4e408d34264d239c800c7e826db1e647bce9c7c21a72bf0dcb8a

Download Submit