83758d5838715ee5768062170f77a422bfba384ee94d71fa13c19a9acb5bf8a2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

452e878f634975b46a5562374a4efa56_JaffaCakes118.html
Size

8KB
MD5

452e878f634975b46a5562374a4efa56
SHA1

ed2c1d78152ad667294ff0c12679d4ecf8c9ef63
SHA256

83758d5838715ee5768062170f77a422bfba384ee94d71fa13c19a9acb5bf8a2
SHA512

33c867f9aafd68ddc95abd3bd2d330360f29d3ad45bb6c01c5b6857d1bd593ff047ca745c542247ed695dba316af4bc9ced7f497d93b9005a52e4d3c4a13c6f8
SSDEEP

96:1z7pThpcr7FHT1gYuiWGobdsYGU+jiIaLJPUt0WpmS/IED1MKWIFMXgYraXzZ78E:v4FHRgY8PD+jiI0FzS/IjIutraXz1N

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
1980	msedge.exe
1980	msedge.exe
3728	identity_helper.exe
3728	identity_helper.exe
5296	msedge.exe
5296	msedge.exe
5296	msedge.exe
5296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4800	1980	msedge.exe	86
PID 1980 wrote to memory of 4800	1980	msedge.exe	86
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 4476	1980	msedge.exe	87
PID 1980 wrote to memory of 3408	1980	msedge.exe	88
PID 1980 wrote to memory of 3408	1980	msedge.exe	88
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89
PID 1980 wrote to memory of 1756	1980	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\452e878f634975b46a5562374a4efa56_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e6ef46f8,0x7ff9e6ef4708,0x7ff9e6ef4718
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9910800825797464828,2900456642181415760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
5105eca66a4de3a236533779c9dd197e

SHA1
b98dedefe96ad3d19a2fe7a39f7a488614f940a9

SHA256
733bb55583dd9e1d4541d4b89633508b9b4fddddfac14124940e80ee2934b455

SHA512
7be7d638a0082ffe791d86a56ce3c76bb1b3cba9df975bd14a6bbb168fc074ab08d2ab9d1568ed0af662853a79fb61c4b29723b0e9d500b86628170f58111c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6608e37aca6362b5c3a73e9b571e24c2

SHA1
5336dc21b23008e06d6a566c06ac90408c0278cd

SHA256
fc8f86bbc7614932580005bbdb75d7dcfe1643c4dd225b718d5194e96090df31

SHA512
106e32e9e2670e60e16e36578f5d2d10dff71672246bd02f6034a4d9600b51e32ac9ea1e611ee4bc884092aaf4dc200a41ffed678d9eea3fcb0dac2ae1c5f99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
313ab492d9a60a3a6ffa8f88efe3ffed

SHA1
8c0cb2b614e0b92ba850fe73553a5477dd6085b2

SHA256
f2adc72d82f22df2babf47dad825196a035373648f1a149b33a5fbe22588cef5

SHA512
f6732a4fd9b039b8394a1eb9c03d711c12af64e85c013e85c9bc4b8b43fabb4ac94e8257d078d502d5d5c23732cdde90fbce973a372af2fdf4d9874baa5e0f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
84f71bc36cba8e662d19400ad96c262f

SHA1
e64474003f1edcadafda0228d4e0c77e7958bb68

SHA256
a753fc8563fecb04585f759802d84834a3f3c837cf88eb57f6d1e3e032d423de

SHA512
0d485e273d6752f08b061f57a371587ced73401f28597caa22e2d4ade476709c5db3273604b7818c1a84ab411d0f3bed747465202ea27b842a88e137ff2b54f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
519a2fec17ae78a5d894b3252b6e8bb6

SHA1
87d70bdbf190f788514d4e2c9a6fcf707eb05b05

SHA256
b0bd5215281dd36f53fb0ae1b0ea663018ab820a34a9ed0a9524a5c7821c9990

SHA512
199d9700509cf1ac2202717685e03f0a6a4d83fe9ab09777ed732b252e18a19ecc8e1fa63fafc37d07f57e067018ac7f0b400da79ca2b3bf94021d9f644e3365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
043f4f585cdeb813405903c65e80c6f7

SHA1
13de2d32d1d4bf4a3a7e473a0433f2ae6d738708

SHA256
7017e5cdb48f6afaf44f5b8b60e84aec38ef8109d29a67a466442014063c2d79

SHA512
f64404a9f780c2503e4d79ceab199c774cff5fe36d9ee59ccba041f0f4893e72359d93535aa6f2493dc06a88b8f6b6a499c28eb782242fca0e82426f742c159d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cbb1005991fbd464291a39d6116f4525

SHA1
2c0c4e8b04b137ea1e47fa6d509853fa84e7468a

SHA256
aeb2e2ea396312f4ef61a10a48be773398804ff741ad6a30e91e260fe9cde8a1

SHA512
0f2a5ba4f3cf85a7b68e3ceebb3bcdd5092d862ca2f8878a9f6d8182e974364d1dda386d10e38b38c1dba425decc9b38d65c1946ee25b429a5642033267b47f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
baa78ca87dffa435011d22fee6a89004

SHA1
4c4f7e5fd12a55a9043a0f86e7702337e7c992fe

SHA256
8f0b1be9c8c171594f9a846b909376fdf792de67cce9fba78d92000c39c1fa88

SHA512
dfae5b7d5a49d26e6fa870e7ef4fd225b9b130957243f721f69a42cf3697d1f63868fae3114fdd1e8236cc27ea2dfbcbcec55859436ca27278ebf2c052e239e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
b560a6f590579120200e8fb1760d4a95

SHA1
7de7a3bcabe976c967c10f473de2616c6f30e540

SHA256
91d0d8eb415309979084a33919aa481b61b87da53701ca14246e8c76403d5397

SHA512
c3dd11b72c7bdb2c1558adc24aa87f1a718a50ca21b9a6c60164eeec84ceae8e2bf05b812bc8952c0a9a55390538fd80707e1bef3e976b872e2d7129bfdc89de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b24.TMP

Filesize
204B

MD5
46550f1ada6d2e56e36031a34e812a8a

SHA1
26f4cc89ffd4ac927f3b3cd42f8fd9e2489f7ef8

SHA256
98fe0f5246dcfbfb8a3839fa4c486e03f619aa8607cf481747a28f6531b7ac4a

SHA512
bb2abc163f7cf952a5739aa8373c7ac6c15c964d9c7375b7333374d0fdc236b70b092bb82814199eb72dc3ec091b1fa3b8b4035d9022e6e98f025feb6ac3bb3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af346aa0566a1c23be296c55551fbfe4

SHA1
9d2b818dc4656acd59a974988ada92f19b3e916e

SHA256
7c37b224ef5cf3cf86b2003d13a2b86d84435eb5d79e923cbd81140af65327dc

SHA512
ad48088e7b8f7b5c80a2e5a2e2c31fbcadd30bb9f106700ccfd25f3da67b60c07737ca19aadda439c65379aa8050a44b14c4ef3143966d3bbd7ac010f0bb04ba

Download Submit