ce8f1758155573a5375c17899a493273acd1673820ca1f63c75a2c733a3dbf2a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e20ca23158edfe1112efba1dd77e6a56_JaffaCakes118.html
Size

49KB
MD5

e20ca23158edfe1112efba1dd77e6a56
SHA1

6326b95002073e8157b3c0eefd709fc48b6db320
SHA256

ce8f1758155573a5375c17899a493273acd1673820ca1f63c75a2c733a3dbf2a
SHA512

ba84389a7918b77f53e61b7a2dc18c24c11c63f6c17ec3c9a3868b701c47342930a944a145030a7d2aba0b6e2b6abbb0eb168b1c2a2cb2236b2b4ccda110f8e4
SSDEEP

1536:Q3Xci1qv7JYMRBdUDcI6zc8Qlss7yhsOwAf/FdHySSuqpaqYrqZecFoiKMtPEU3j:AXci1+YMRBdUDc25lr7yhsOwAf/nySmP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
5084	msedge.exe
5084	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4396	5084	msedge.exe	84
PID 5084 wrote to memory of 4396	5084	msedge.exe	84
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 4828	5084	msedge.exe	85
PID 5084 wrote to memory of 2824	5084	msedge.exe	86
PID 5084 wrote to memory of 2824	5084	msedge.exe	86
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87
PID 5084 wrote to memory of 4688	5084	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e20ca23158edfe1112efba1dd77e6a56_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd73946f8,0x7ffcd7394708,0x7ffcd7394718
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,15158712693724089926,13908307155424335187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
da98b357c88ce9b1c69341beee2911c9

SHA1
01bb768d65d16982f24ef4ee8b3dbc86336f0bd5

SHA256
5adb4ac0c1dba469465afca653dc08017487ac88a109fabe01399026112cccce

SHA512
b74f6446d4968addfc7c40cdf148fae33208b7d7f0b906f358b9d683c45c621388e2de6e28dc1f28039979ed71f6cbdf259bdb7550a86034a4ff5cd4ba23b9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6c7a101662581eeb7c57f2a0fb564222

SHA1
0f3b316417e41fa18935a69dff2ac138e3b09bdc

SHA256
85217573f688b276c05efd358d31dd7ad092f14aa2374f5d1b48fb3796e9f9dc

SHA512
89bd0900aefef6c3708c46df715c2f6069f165ab9d0f7a3b07660e0efe2d8120ba2eb032bfe6bca8d8b98df4da32b9fbd227b0b8c56940cf666fdca8fcbb3b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f0b162615091cd22502442924933f851

SHA1
3eeee020656ca9474342cabab37a3f5718c1843b

SHA256
1fd4faa5064fe772b3c1828645761714e3cf6cd82af0eddb51fc9efa0c748b7a

SHA512
52ac56f4d3376c8d997dee4faabfd9d383d1e45ae6e4a0f1eb694c634f278d873df9ae56a00c0658ff74c479bb80c74a2cfca0792679a148f378fa8c24cc3a09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c52d540aa684e7d1ca467c4c767a933d

SHA1
d7afd17e9e23bea2919fd0b4d34fa99263faddb5

SHA256
6f2c67e955f8f24d330334cd579fc16920ede2a3a450509fecbc597eb9a6509a

SHA512
868bcceed76164d4fa11566deb7a8a6d7696dcc88c7820d9c49b6c1cee9e4e03a1e00afc58665739b904c020f7fb959eda9af5b7d4ef21fe9c6e70fd1e804475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63f04a9414ff3e02f414ae93d84c5d13

SHA1
244a5ed9d570db3f46f44a4cdf821ee6250e9df6

SHA256
602aa01b226859d0b0b2901b9176da245e978f8fe16254535f6f81e0bb3fb8a3

SHA512
a03fccc5af448ee9fafbee30bf782683100b3af8200e1a421c72c1147ef030296b65859833fb7f89e5540cc74073bde1ef668eb8dcc27a6815d0a723d266caad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
40c5d48f301f0caf184ff08866a35b5f

SHA1
05a59f25129c67c55cb3571a282f686aa5424edb

SHA256
ef30a89a1db81d84bca0a9f7ccc97131d5f510b05d4ce07767afd1400d96fa73

SHA512
882ad66a018b2ead4dd8658fe988c349d613c4c936263c25e759fd1977292e03377d4a4f88037c58f9d002547ffe9064ac0923f249a93a4db18d2bc433165573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c41eec32e9a98d99f853412411758a9b

SHA1
1ec00feb978d2a6d132ce51a54c9976f701c027b

SHA256
67437dc9a59ddaf8560858654e78a692841583c2e35dbf622a4166d8c8832d59

SHA512
2023293d818c8f111c770a3d73b8ae2db228a3da432e5bfe3ff360eecaf1606c27bc1a509c45a6fc335687f646cbbba83d13a84135f6e96928f41947085080a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5fae4dc44c0e765230e9009805d4013e

SHA1
562aaf5ac85ff29c7556af5d717d44cf721eca06

SHA256
e7743e13e78dcdac528fb03f03f5fe3b36f141444a544519202a9ae8a7b14cf2

SHA512
dc2c7dfcddec7b52b2f848aadb6b3ec68867f473df11bac29813785a98fab286955ee354f6293c422965477eca1e1810d3a430193a983faef80d567e51563ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5846f7.TMP

Filesize
871B

MD5
c938b05dc04dbf4d52c38e93cde7efac

SHA1
c95893eb67d6eb27dc3cc8c8bc888213bab330df

SHA256
3ddae7e958efc0481b79e8616565a881cfe3df04ae00ef88b311f40dcbbad94b

SHA512
ba5a72a186c9cd20003a19dd574b8ad308c04a39bdae96655ec11b988bf6159c7801d6a2101c944718bad00329752c8e8a59b35595f66925ab7adec0a146c25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
21805583e24063d6bffc41df104ab0d7

SHA1
48df48904370fc830232a2ee5ed7b0ec158a279d

SHA256
9fcbbc8a93f9331f1ae9fbf0022f46ed1c1f430825d21eadef2964760cfbeeb9

SHA512
2feb2faa6121c3572e8f39a0014dc48e3d4f85eb02baba0bab93e721df7ae33fcd6cb5617a4ff07886afe6392bacadd7a32d9f0d2b55e1bc6a7fe653a54ba23f

Download Submit