b58a0a37bbeffb4bada59ae601668cc2671069acb387e8934281f06a88638812

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0c454922a2235ca1b6c10844348915d_JaffaCakes118.html
Size

117KB
MD5

a0c454922a2235ca1b6c10844348915d
SHA1

c2a0876b1785e5b6d63141369369c5745db48cbc
SHA256

b58a0a37bbeffb4bada59ae601668cc2671069acb387e8934281f06a88638812
SHA512

9a3baa9dc3c99e9a963d4e34470ceac1d69914cf39231ba479d91bebce349ca34ace8d4c6151dea231f5546352a0caae2949f36c69521e89b3832ac79273e929
SSDEEP

3072:yEa+DKnhVF5UBgYb32EktVbDL9sucIQ2ytMqv9MC/BA:yEa+DqfPPDL/cIQ2yS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
532	msedge.exe
532	msedge.exe
3008	identity_helper.exe
3008	identity_helper.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1504	532	msedge.exe	83
PID 532 wrote to memory of 1504	532	msedge.exe	83
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 1948	532	msedge.exe	84
PID 532 wrote to memory of 2776	532	msedge.exe	85
PID 532 wrote to memory of 2776	532	msedge.exe	85
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86
PID 532 wrote to memory of 3556	532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a0c454922a2235ca1b6c10844348915d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e5b46f8,0x7ffd5e5b4708,0x7ffd5e5b4718
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3715083506533026250,10405092509006014996,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
41KB

MD5
9631c594f55c395f07b12046cb8fbf9d

SHA1
cd6532d1689166c19477923c73083eaaf8cd21e3

SHA256
a56a5d0f5f612bd39fb02fa1ff7a721a33fcb841f40c48757381b3b7c4a25726

SHA512
5d3bada46dbc583755c279b5ff3c155e15f16d51b6522752ab289bdb62b71abe1d91def5733ef7e77fc01d127508d07e2c67e731bde26a478c4780c8918ba105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
66ed7f40e72a0150eeb42fd7ce83c4eb

SHA1
8e7ac2c0964b85a2d1ac478400e6d4f9d11ba044

SHA256
108111e855e5472fe5991cd73f81ce11e4a03d3ed2031f96587a5a1e1ce24560

SHA512
146b82266d746d632266a4635bd248fbe8d8f82a59f4775d57bf608e099bea71b8b9021956c36d3f12eadcbceb7115027953d49ce9567adbc478994ccfea62cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
76a6bbec6a99b46c65e03e83c30f1cc7

SHA1
d5727d061ce9741d98c89e61e739a0dcd5a87640

SHA256
7c6c18417880532db932a455ff8064efc3770fc571cab81fcced10d211ef7ec5

SHA512
6dcc5da27141ea7e8e74e2c565178cc5dbb48a12671c38bdb024db2eeb910da6418efab011f87bb7b4d11dc4c0295b29b134f4633e5d21b94a195bda725958d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ee64b436df01e665af9cb207c7623575

SHA1
3bc6f94f24cec5bb5cce4f26887f8b28af218f54

SHA256
aa8e584c79fa20684e371cf4c8978ba8bfb8f8b629d5d49b0fd9b0b719f41819

SHA512
a1223142d22ed08d9a5d030f51e7873b9e619328a9266521b7102909da83a8e9be263417f20e1a03f4fe939dfbfcf7f45600072cfe89addde036a4bde83258e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
144f9ef54e384fa5a6d4566c36b6c028

SHA1
408684dbda0c33553452a389f87c4cb0e538cd21

SHA256
e997cd11c0fc85213d90ab7f523e98471422998cee5afe3d2e8b21351b8bea5e

SHA512
3b53a1837087b1286d90e3ac72a2fc233b47c1e711e5448da0a3babe3b01acd6be41f8bf1b62b5ea77f2cb70f50e73bfad98329a306dfb027f00d8e36ad777fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3eb9207156badbb2230cd8d92d74cf89

SHA1
8967b6c9832e17e6f4712ea9ca49d610a98c0290

SHA256
a6b730fdc6bf588339a668aad0cc3597088002254eebb0dc572bb7e3c1810e38

SHA512
9a619f3bbd42b3023301e5aba43b48a4742f90370e07f77e38f17a62f48341d0b09864529d5a4ecb3599da468933f8c40d300136da64acfb94f6d36d99284817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b490b5231107ab404177618611e1489

SHA1
d308889ffc1f1285d85e4a03aa9487ba847c2822

SHA256
dcb70cfa9173f6077dd20f6a46a3ecdd755d2a82783b0b2000aca2d2441d92b3

SHA512
c06f6547886e103c954a46c2dc0ee40448ea403a2bb73e8b2a32ae369f87a2b3cdbde29265500505af244d9d12bb2fee9cecf9c4763d55d6913e5b38549daf9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6fc975a23622f1c87949a71fd40b7e72

SHA1
0beb157969854a1bbf0108ffaea43d524c111e5e

SHA256
573f3c9a7ff30d8cde11e326636d4072158abeacfb840067d3383e0094cebed9

SHA512
ef5e75042f01480ead7e03252b915c007e8d435a7dcf886fb5d94cdeb8cad23a4a3089d63be277b2b282870dd85617170cda6567f327fc9d1992aa0c0c078630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
94f8bc4b08eeee4c0a4565bc36da5c22

SHA1
675692729e9c0538173dd186b92e0dd6676657be

SHA256
c3a5ad261de88726246bca0c8de1d5934ae5a4b0b5243f8e73c113ba0621add8

SHA512
6c178daff50550c2ab7cd4b0293ca639a49556120b2e90aa643880d7b4e3f7bf133225bf7468201fbe3793cb0eb99ed34513be0055b13775c153dd1fa7d3c62d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
107002396fd0114b42c3a3904dbc9967

SHA1
d7a362fc522a6a9c32db945935b47096abd952da

SHA256
baecd508e72090a6964bb6bea69e9360b14620b5f9e77e5cc5982a52b2ad5b34

SHA512
9339a808dc0429c8058fea96958965bace524d71132d528710101fd58d60540eba5ad2033d202fb4a60fbc320c553f1b676fecbd7713785c8643a7d6a43f0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589798.TMP

Filesize
538B

MD5
f008c5408de487be2abeaeefae381d26

SHA1
1d564824a8f55b0922184aa32dd38ea5baec1f25

SHA256
c7d36a6de146b0710b7179d774dae86f4446557094c0a39c1b7dde51cb843d20

SHA512
bf0c092ab01dab4498f3017271d56b7009ac5c9b857530950cac6071ab74001f96b0d0a72eb6e2b0947b1242214b212e796453aee53c054b29a0e66f4320699f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf5282e6a5233582398381772e3a45bc

SHA1
ddd093c62ca725b28181c4d31f471943df7967cd

SHA256
81163355767bb42fa15cf0225e30b22e8ea72a8f5c46a5008d072f0061595623

SHA512
e2464ae9291d04c0f36622070235c518c10fce37618c29b6e4ded14ae323f72b08579b692b3fb2b7d311b5795b828b225f916ace7b7c0c8730d3f17a2246c7eb

Download Submit