0d40929dcc90d9e14a3fd02563a6d3f11b88a23aad7b743447bcb079cb61b23f

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08b224f441baec7e26c55c893112e470_JaffaCakes118.html
Size

46KB
MD5

08b224f441baec7e26c55c893112e470
SHA1

4b1debb9d34339f7144d5464d40b8b9579436d88
SHA256

0d40929dcc90d9e14a3fd02563a6d3f11b88a23aad7b743447bcb079cb61b23f
SHA512

473e6c8cefc09e2bcbb44a83bdc5d0932f986bb6b76763bfa8e3aae6881dde17ceb48101fe544332e46c1a39cab4f36443b5bbaf38d129d48f0b5fc881686529
SSDEEP

768:GPT0EipBhieHXEg4OITbmEOrBcO2x61VSny:CTupBhie0g4O8bmEdc11

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
60	msedge.exe
60	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 1516	60	msedge.exe	84
PID 60 wrote to memory of 1516	60	msedge.exe	84
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 3640	60	msedge.exe	85
PID 60 wrote to memory of 4108	60	msedge.exe	86
PID 60 wrote to memory of 4108	60	msedge.exe	86
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87
PID 60 wrote to memory of 3400	60	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08b224f441baec7e26c55c893112e470_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea46346f8,0x7ffea4634708,0x7ffea4634718
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7425357748145541113,10695508807516614995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d28b4f5-ae25-4d4e-a4b3-71660402a505.tmp

Filesize
6KB

MD5
4f252b803d40d5b77216c7b8b0bcc8f5

SHA1
e1acdcd588c265d907702327124acd69572b029d

SHA256
1ce0675946fe684a5c0c78ae9a14b76f74d2c3c5c2b404c7b89cb5962896feb8

SHA512
4ffd7e30d53450ab43feca2e006228951476a3c10b73ea5ba04b8690157b5e458011677ec97b1a6639ba5c02900913bfaca8ddf5cd1bedfa3764df5d72aa30e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
21f8c19265a4276d133f50d0ee9c0ee3

SHA1
f9e4cfe606878142449fc6299a37c7461dda8119

SHA256
293b3a37f46ffb3bf9876bea1949e470750719e0116dc04ea8311e1cde82b051

SHA512
cd2b617a9912d9a05268aac9ffcf2c34b6b995bdb6444bdfbfaba795a95c582c190bd04fcd11d6452d667091558e7748fb6a16abe97a5afbd7727c3463e4d58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
8c6079bc02e123ebef227bc8d569b6ef

SHA1
6408c72584e819f9e1e11af6488e61e1ccae8dc4

SHA256
a70cfd50ef2cea10d97b3f5c11621355adb92f00ff668af05aa95bce6d4ac828

SHA512
2e667e02157fe464032d68eee7f18b47b531cddf6832aeffaa3299b939b656e0f843e5576d018461d45ff5c98a61de30aaf8b9b83b9cab7b4e2aff44c5ec8d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e5ae4d5d32770b4f3a56cde3f33d3246

SHA1
69c8cb5132f98ad1f47daa35d4c12ac27fed344f

SHA256
7d2371bd5cc52abb3648afaef647e6de5df408d2f989e30df18b0c53c8cdc3b4

SHA512
aebc6692d988b20884a0db5f3fc3e6218a23c8ab14082058855fc07c2da3127e049b62df875dcd10c401f58bb9f14454ec465aed38299c6f5e23a426531396d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
99c0b74d9cd98adfc59a64262e1d50da

SHA1
89e36a9de19ea22a7f11068bdacaaa9d88059cfc

SHA256
51ab95e400ac20319caa5b15af437e298d660f93dce55587c51c56bee8f38e55

SHA512
5f196caa4c285d24053930c668bb54e9711efd7ab4b6173012664669525e86000ca86cb018028689d02fad26e5f9a19afa79b69a047b935a1058559cb73b97a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0c9637ffc755d8643e036493e94cf110

SHA1
b166447219b3f61f80869bf0fb8fb05b207c875f

SHA256
a878e42b1dbf7a81dc7ab2734a5f5a7c3eb6e3e967f9a8c2b80438e997f012fb

SHA512
960010b69e31d02c6197a2e62a5241add7c19ad7da3b6a369d77ae219f7ab9a03b0ffe6b23139dd79e7e669a90a5b68d1ea6b4a145b6f87fd42750919edc5ca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bbc0e58e2314c75d45c327da98d6de5f

SHA1
386a4d6b9cc9e3c0c791d6649c94ccb1ae2920b4

SHA256
724dc3c66ddab7b13b0e4dd5bf89b494ebd0200b2d5f0002625c821888bd64fe

SHA512
26c14c35a6be0203b558aae0f4a4fb7a281032d1403182d74d659c942bc5049efbe537be7954fc2942c3a4f73dae4f5fd2d200c912659d6a4a19eba246efb55c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
942a93f114387e7f4ed7316215922db3

SHA1
35ea9866cba3c33ed46b265557b58fe5f0984256

SHA256
4c04f26794455bc79bdc7429fccdb3aa29dc005a7ae44f11f89519cf4a74a1e8

SHA512
3a882044c004a009b72fccf7c8557ef8ec22a4697d40cdc6ffe541aae7752f8720add8e0d4f4d632992496cd0e59d575863d66a39e3f594baf3020acbe515379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579710.TMP

Filesize
873B

MD5
c9f02dced92123c208f92b2722ed5ca5

SHA1
877b7dc2f6e1e40f2042c06e5698d41843f174cc

SHA256
cfc5be39e777269308785aaf63c8c140ca20dc6dda7cb8f65da4c31438477089

SHA512
fd7f49cf558054cad509275cf5aaa1ab01b980ee81214ec0cb8dbc9afcae085b9ad6c78ba29ea2e6576a457a2a3076f69e0ae48a36c995bbeb84dcb348db3741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6509898834c9a5655f860bc1cd9aeb9f

SHA1
70e2527f703909de0eef95764bc92f402e665d22

SHA256
cee7b2c7bd9acedbee637b6e306e27c6b3459569a6fc8abe22f6bfb85008ac69

SHA512
9f0cf8f466404088ffea0201f1c7f2401d3b2bcc1d79e3e49d01f5eb73d26c9e729c5c695033362485c167280c3be0a14cfa30613c859d5022de27e08fdb9923

Download Submit