141052fbfb54ea9e62fe633c68f62f30245ac59816fc065f45f390bd46adb402

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36e18def2a78a3942b2ea41c5c417a99_JaffaCakes118.html
Size

116KB
MD5

36e18def2a78a3942b2ea41c5c417a99
SHA1

9f718a1ece9d7342e095e98c0e829152f5a1e865
SHA256

141052fbfb54ea9e62fe633c68f62f30245ac59816fc065f45f390bd46adb402
SHA512

167d7a14a4338d14c2dd4c050fd4f6fa90a54cca94b6d69b961879191cb0817b219d60208f429d6df60987bbc9ddaba997d0f0cf0b770d296f745e4c05bdcbc9
SSDEEP

768:Vuoqi32sEXgK7GPuCB59V3Ktdw8U9pMP605H2OzO5Q95bPIdzIlPYUamPH0uCB5m:VosmgK7GrsljRqsljRJvS/iwoz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
4956	msedge.exe
4956	msedge.exe
2992	identity_helper.exe
2992	identity_helper.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1220	4956	msedge.exe	83
PID 4956 wrote to memory of 1220	4956	msedge.exe	83
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 952	4956	msedge.exe	85
PID 4956 wrote to memory of 2712	4956	msedge.exe	86
PID 4956 wrote to memory of 2712	4956	msedge.exe	86
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87
PID 4956 wrote to memory of 4268	4956	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36e18def2a78a3942b2ea41c5c417a99_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc068446f8,0x7ffc06844708,0x7ffc06844718
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10924618851792915940,7181330978308305820,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
18KB

MD5
844dd813e266d90fc010747f6edf9b4f

SHA1
6bb8dbe238a0196e3482fae7040c87a1b8443181

SHA256
456017be1dbc830647e96ab35ff078db4cd62474c79be9fa948428a79c877289

SHA512
c456a75ce6f36a5a6164f9bc1b414691fb6a55c6ed8209a9014491f9989e8b8a90e2167e7be0e782f9764dfffe04c7424b73b47f456ad54f284db81751590502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
28KB

MD5
4a2394ccfd064d8a738552fb839104a0

SHA1
52f2ca35488e3e700a90bf965bb4cd979f13d03f

SHA256
7d2aed449b1256f28070afef597daeac695d3a543315e59cedd4b68e5fc485a7

SHA512
7585e5d54b5e58d856c98a22039f4c3fcc3e372bffc6417c57978b347a57003d3aee51beb68b030d8fb38c63b7396657d34762adc9fa309878b6c6e68f8d0d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
23KB

MD5
ff4f300bcd47c4d710f1e216ab970f57

SHA1
7f062eb2a4239d5aecee385fc5b638e9a7fec60d

SHA256
3654fdd73c2118349a8b2affebbc356849611df54354d88a4207ead7b8c6034d

SHA512
b110cf330d2e3ae32d13b949235f8873c3218ac1ff96295987c2b902b62d860e6d3562a46b77d6454d642f144b57ebbe6009411be1896d505176581dfd1e68f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a15b48ba9d842a87267d9617f6f6f0f4

SHA1
3236e1ad20a2ffba917901825b46f241575c9fad

SHA256
78a07c0320edfdd6c7940447ee45e03ef7348fb16d23fcf9b6bbd5d9cb6b2d90

SHA512
e57c38b46480e2cf1fa090cc470cdcd6c6f8a67bb7c2ce4239f9dff31661a173d7e681c57e30b7e2cd5e3c2fd8585e66fc6a95454e3e0c88aa9602c9f3c6ab88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_devicebind.ebay.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_devicebind.ebay.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
720B

MD5
84dea74107e4d91b4c2aa206d73b08a3

SHA1
813d2d73ebc47c6a1064b5a4fdd2221fa6ac1766

SHA256
d8f54dd19f4d50f02f8fb0b396851e39084e7874f5df605fc58c9ceecfb5eb23

SHA512
d437eb9cc24e01c8f04cfbbc41d5feb1e0c0c97f65577afb09b04903fd324a3b6479f1057ad4d52fb1ca22266acba13c1435eafdff76b25cba26aa937fc47878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
793B

MD5
f23f092e489975d763c75df2d5640094

SHA1
8eb4c77d564ffe779c0eac0438e45172840dd2d3

SHA256
f8bcaf03efd9d166be0f769906175187584007c7f2dfbfcf1596561bb6605c79

SHA512
71fd0c4ae08506e03e11169983551415842337deeff00eae1b67b45f93886a96268f6e8f699eabdf7bdd6330b0bdc6679eb91f818365b9f9de5e405587ba8a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56aa02f3feff507424df5d609d37d431

SHA1
4f6f9014fe7530e0e5635eb1a684507752a3ebc8

SHA256
9034237f31f13bdca4854b4d7ef45fff56b777c7eb4af21321cb00d60ab60578

SHA512
fc749a2aa9323738f439f2737a4ef7c9c4211fb87f58d32e4c1574f29450cd8881b434db20ae8e505925251dce003554ca73ceb36edf30627ce9706ff00fcbb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3274ea210b0cebff19b2c59c1ad80931

SHA1
230a995078346c1225895887568f3ffe167a0419

SHA256
6f2358ba204a743693768563c58897f4a5a76148ecb7ae0b6ffa354c952e05be

SHA512
c3958cffa623d9c5d64c9879537980b34daac1c66ed007af47258bc12d304f859a7c566e4e219330d052d476b350b132dd33807c6ca7ef96e4d25a53e6802862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d75fe75a0208610b467be510043a63e6

SHA1
7b2b235aeff5ec31510a83e7cd20551b562ca4fa

SHA256
4c037dd2ccf789fd0531a30c43821ab79e1356e8cb1a4e1c521153811c5526e7

SHA512
d2a5957bec9ad9c2f16da5973158bc4973ff3a334cb753a7a091eca60423465bf96d059a61a6b2617e912b1ef3d1f8576619eec5b78a0bbb37dbd3aee5d69c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589edb.TMP

Filesize
1KB

MD5
797dadb6e3a4345d0b83007f42664ebc

SHA1
0de4e2bc9150fb540dec658843369570048e214c

SHA256
34082c47ebb51bb8d7dc7cd443ad24c0ef2aad46e7c9c945be07b73918dcbae6

SHA512
f66127de1cb07916b0207fd41a02d8eb793cf4c2acff53004c0e00596fbfe4f8e2ee97c7134393a008fd058ed73ec5ba18a8819944fafd2c25762b12f02f6d34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57634dcba6fd4b1f18932c0ab5b2bbf9

SHA1
3c18b0289939878e1eeb214a6d94f592385da314

SHA256
a8366b97063e04f7c6a6aa2cf19fab42dbd0dabcabc97aa4383122bd80b76ae3

SHA512
ef9bda43e0058945fe210c33f4010729af85de5238267744b5abfa6617c2c4b98c7cae7d3f2408b81f9ec4c5f2f1ef0bca8daee5479827720590275463a682c3

Download Submit