6bb364ee278167c4f1a6b3e5d417054d4a3d119c5da398f4419715a7ad2d3250

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a4e10408f9f89b6d4c6acd55987c296_JaffaCakes118.html
Size

152KB
MD5

6a4e10408f9f89b6d4c6acd55987c296
SHA1

d4ce5df5d0de8c8cb0f0a73b9fc21a4f345ab641
SHA256

6bb364ee278167c4f1a6b3e5d417054d4a3d119c5da398f4419715a7ad2d3250
SHA512

b8f23aa0ccaf4751f626618864f11968a434b0f361e09912a808246ff1d79a6097ad6d090c05378de98b36c70f4b28664e64cbea277939099658d675cc40d66a
SSDEEP

3072:0JUkSw1QRY5RB7a5DJHe/K9od0htPzod0hnod0hEaXg6CnjzX46a:0JUrw1ttj6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
4408	msedge.exe
4408	msedge.exe
5988	identity_helper.exe
5988	identity_helper.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe
5684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3728	4408	msedge.exe	85
PID 4408 wrote to memory of 3728	4408	msedge.exe	85
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 2876	4408	msedge.exe	86
PID 4408 wrote to memory of 3920	4408	msedge.exe	87
PID 4408 wrote to memory of 3920	4408	msedge.exe	87
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88
PID 4408 wrote to memory of 2980	4408	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a4e10408f9f89b6d4c6acd55987c296_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc27df46f8,0x7ffc27df4708,0x7ffc27df4718
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14855012220770244056,2568568289518785553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ae0b8441001d8df3bc4964d192b95717

SHA1
b9dd65c69ac9cdd697da78dc8b06f234a0a573b0

SHA256
b78bbd6fe3985cf2d9075dbfe3d22781f66f45955cf87d5f1acfe45510bd9e12

SHA512
f66569ef48818428b5c5fd9248b1e37d3b62c8200f60acba3b5771a199e6535ec482fd91404ed39715696842edf0beeb7c9d6d09844f7c4e4513164b136e66dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3271344c7986f149f8f0c648ca1347db

SHA1
b83688991d5c5de9b6c609d287f1d587281b540f

SHA256
4023229d9fb375b3158d650d673b01bd880466dfc2b6d7ed4facd92f2f8d2539

SHA512
4a78824fc29de9a3ddad496fa4c8c61ed6bb685234f3c0f88b7109fb0ee907b37bb82032b236c16ea74917bfe53a107f7bfe7072a7259dea3e45c5384746b234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b90fec59a93c4863b54440ac41fdcf8a

SHA1
0180df5119b181c7091f0018aec44a14935567a2

SHA256
c8a872f753e25a7157937d958c6211ce7bf37a468fd95b10d6e97f763cf0c1f1

SHA512
945372f9576f3b32de21fa27457f3e51384061a34690ca05d925da081c86201818406ed8d3d67484d44ecce66fcdccf65a55eadf700aa690239b0b4aec2fe2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
85ca397f61b70a5a36a36548b1134790

SHA1
e12875b46657b9a91e320481481db4dfa9a813a1

SHA256
4c5020dc9ff297fe2e13232db564e509c0b284d0107d907a1eedaf8ce03d6f4e

SHA512
7994ce2caead9867843b86f0fc03538c9fe7caceb84a26e3196cdb932723ccdb13017fee0cc37a033c9297e87e974ff3d4ab6bfc15262ff4e0def712a5fe4d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0709978c140adef6becb85ef446509f

SHA1
b72f75ed5d625dee102a682d6dc6f8439b4ff47c

SHA256
86a4ecb32cec9deb93d8b7480e54ddae615cb23124b2853c30f25dbd3edd03d4

SHA512
fece0bd1718367cdee2bbbe3fe913510bd544359975ea48a57f82091c3dd02034dceda384e1d427504f47ab05a88afbfd67dbb810db2a9fc219737f96e7ff953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
558c2646e4db4c41572153e4c9938063

SHA1
32da791cabf0e60090329cc8b78bcb5e7532f529

SHA256
b14a0827966785a870b5b340179df2f85e99fe1a8edbea16886ce5cf61579bef

SHA512
b0c2e2f6e0d1567eb21c231995be9e837900e1f8260892d3e1f2f05ab4029b82341f2f3bc3bbe3fee4e36a6c0171b58a3a46c5cb1c74cd206d18396d4288b87a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e665bfe866bd96c6f285b5742b450b78

SHA1
62c784acc08433366ffbae23b173fa6916f9f90c

SHA256
20bac62b1ec4b1de635a7e6fade31bfe34997607d6d3fdffdb7bd59d57c9c15e

SHA512
66ae8b2bae486b75c11e695fea019664bae0fff5eecc99fed2402ca0a153544da60532a096664c937a9327fd855e5a3d1d817ecbc203bb937fff2d038ce42ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1b0e2e3002a371eb9953a1272a7ac39b

SHA1
6ac6d86db5f96f0b56d49bf0ed6fcafafb539dfb

SHA256
117b48b1792421b342fadd4bcedaaa53e62639f1ed023ce19d1d9434da9a7216

SHA512
cb3d74f230b50e95f4c99e0451c4ac76cfcde18e45e17e49992ff583ccccb26fe52bdc645961e33d9dd671f92b4c2351f8e99d323b2d4697645342ade4bb6086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
7e0de80b6b5be9b087f4f4db40e5aac8

SHA1
c19ac805dfbc10991bb46d7b2d48369c9cc983ca

SHA256
0b8a9ec7161c0506beedb6db2063e42be403b40d50cdd4815f8a288cdc7a7b6d

SHA512
bb1b73c1c363f30e049dbb500d8e86122598494b5aa026d547d7f2851b46c842cf677ce28575999e36d072174c251afc42399c48d20bbb34f52e4c4308256621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58170d.TMP

Filesize
538B

MD5
ed48dd38a81b26594692134e71fb9197

SHA1
06e0fa8b7c1b8a6273918c7e109b65ac008982da

SHA256
f1507047c2646c10370f04934a6b11e1b3e761a92fcde2f86a31304adf6d0cfb

SHA512
bbd15f5988f173f5c8ca093bf3f3fb0688684e6d56596c1a5847f85887e140c66011d420b18fbdcfcb71d1a2a718a527d2d6a5feb9166b929542c94bf29c05d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f3dd2896345a09f8b9836f3422fd0b2

SHA1
d66a2fbb44c80209798c940e55e42e7a4ba4ed77

SHA256
eddf54bb400a7efcd92cf20533ee0ca6ed5546589ac8f478ad0a594a17d1f49b

SHA512
c2858ad8c82368ead5a39f6a9e73d53703177cb52fa016fc6f01390912925fe2dcfc70aefc42a5383fbc81b9a477a2bf3c5295f91b770c1329775c8d4fec91f2

Download Submit