0a61ea650f92df82154187212002e7cbfef7d3fac63fa3e2088d84a471fc6c41

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

813d8a8e008349e36faf35b95e2e9e0c_JaffaCakes118.html
Size

63KB
MD5

813d8a8e008349e36faf35b95e2e9e0c
SHA1

a274f743542bf1d102e3f43474628f5e57fa9235
SHA256

0a61ea650f92df82154187212002e7cbfef7d3fac63fa3e2088d84a471fc6c41
SHA512

5b3f7610a6a735fbf7df11acf1f8e34f0c5dea7b4773e770901abdda76ac895ce361e57cd93710eabd428f2ac87fe3a76b40704e69aa0577c1f27699dc09087b
SSDEEP

1536:Z+trPr5Mk5hP2znwZmZyNsZPmt+rz89rCX7CesY8se2MtQ2Lk5D:Z+trPr5X5NynwUZPmMro9rCX7Ceise2j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
2060	msedge.exe
2060	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4764	2060	msedge.exe	84
PID 2060 wrote to memory of 4764	2060	msedge.exe	84
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3028	2060	msedge.exe	85
PID 2060 wrote to memory of 3000	2060	msedge.exe	86
PID 2060 wrote to memory of 3000	2060	msedge.exe	86
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87
PID 2060 wrote to memory of 1148	2060	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\813d8a8e008349e36faf35b95e2e9e0c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffd0c6c46f8,0x7ffd0c6c4708,0x7ffd0c6c4718
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13035774032081368457,11774925556093635328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
318ffbb8b70b421abc02996dcfe8afc3

SHA1
4240e64a8604fa36481bf24471545a2c7c10c89c

SHA256
fba866aea3cb0fce98cf10cb57975933d6cfaaed27f9f25250008814c9bf8e95

SHA512
1a0f6266836348c4ee0fbfdfdc9197b66add2a5b150ea8a1205b4e3876eb5c82d7404bd26791de29ff48004dfed187d9bab5a9678dfe1c71cf513dd49abacc56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
23d8b773b5fc8bc076ed9c885798409f

SHA1
cab7faf8b314c17fe776fe347a13fe9cbaae5a59

SHA256
d73a1aaa02d14097d5a100608cb40051f2e8c68337afcf860908e696f22d1a5d

SHA512
52a6f221bdc4314694f68afa61b7a85cf65c1aeab19e4e7a01dd14577a2d790af65f93aa9f70cc54db7c47468af4d33905f20ad0e2b92ac0247c68f7afc67791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f8d895ed414ce2e8e6dfa5d9b5a5cc26

SHA1
51b9fa91288833585bb65a9a981d010e67b9b39b

SHA256
e473709a931841193236a6d12cae2aee27175c743b34864bca701895f7457ad4

SHA512
05ef3f4f555f1f8a0534747fbcb2465ac11bf9946de4f87418880860ef2dbd33262e11c53c4abb6880f2e7e22cf8d731cd5cf8ca217eb1e3bf5db43b68c6cc2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
135c51337f73193e1ce9eaab22eca87c

SHA1
737f1900377949b9742d46be9494b5b4dab65761

SHA256
2b2ca28458ad05e555964a68d7710d6c948dcf2eba2354b33e68b9a442a0f9de

SHA512
0b6ffb65ad5c51ae3fed3ad31a9c669982a601d37bb1d89e875ff6e60e38e88fd591e2a211f623b4b2dbd08606a67f171a4e5ff8466b93840ebe0dca083bc438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b5030e0059b419771b1a851cb1d734b6

SHA1
ec6f808d9b2b1f608c244fdd0c00663b88f9f7e3

SHA256
0ac579c86f4b4473fa2244828cdbe3e79b76c31878c3f243ad04ec5e5c2df8d1

SHA512
f47890229652f91d32077b3995b58fabe5219ab265bb8ecf60607b88cb32c6cc2e6a8ba7d75a121c4dd927663447320e086841c68c7c393ff320ef711bb249e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2acfa32dce7da289f942632132ff5d3a

SHA1
45e2ffa7659b4bd567a0305480a15a9a02eae141

SHA256
64e0315d5130c75d279ee8f4c0bde184f19c28cb54d9a0d36b0404e651af7926

SHA512
4ec51fffa03b27ad4e5e44dd32aa05a2475c62a94b1c41e402050b5a8725adfcf9d56c96b21a41921e6d3b28711784878f8fe42a03a0d654373fc1a161b909f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2732cbefcbcbca0f5b8967378b3605c2

SHA1
2b7f1d71db734f07d406e9de4a39e7735ecc264f

SHA256
149a31e3046fa1565e6d35020e04cc617377b86145dcde53df340aa6e618394d

SHA512
1d5790fcbad2630c58c41c0f6ddac78523daa25f717070056c2338218f16ec59b66954c65a855049c6be0b7c5c7d748bfd7994f2259764c85ca72da6cc78024d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
fc0c7a7a3a9b725f9f3c3962dc91f38e

SHA1
6f442465c084179e87bfb0ad348bdfa55481595e

SHA256
cfcfd3b71088c86d0146e347641d069ba4fdfe78aa01018fcfdb22184e0a6cf8

SHA512
6271897165651f1963170b17f74a519f420edc4c66567456d7d2d1a3aa2a2f72ad467979ee18753b1267c31b4429a71aede303b75b7025b9bd22a3c6e1281a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581c2e.TMP

Filesize
370B

MD5
4f731a94026d9a06f4ebfe36b00e64d5

SHA1
dd44f5133f7b661340e5fa7d638dc17fce192608

SHA256
9ee9cd7f77d6c755a43e1801bdb4756512a46f76d36a74998ff2697b8d44a2a3

SHA512
bc253b70286d948c1a6adc9246ca005f9867397c098dfd4e3576e496bf9c949f4c6e50d32a36fbb1532853a61f7218b4445a2a2fe743eead8d9af8f5da47202b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e97f30ce2fc49224ac75714d64551466

SHA1
90c9c77e368eddea138476ca46f337c0cb490530

SHA256
455a0e304f5b58e2a46e1f58c84ad976059df0da31eff9bf35e7989705f78cdd

SHA512
2a81d284b1226419fe764b8b13d4e59b3d018c403a1a227bf1490b85ccc22296c7e11fbaee8c114240abe5b8e6f018f12da2eeccbdda18f7f2fb036c23d72239

Download Submit