d7557af96b7a4b5ac7c496ddd9e1d37558c176505a2de2196979bff3b04e8799

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2636c19b07059868ebb6cb3623be91b0_JaffaCakes118.html
Size

159KB
MD5

2636c19b07059868ebb6cb3623be91b0
SHA1

c19af19d43007a07d7ec1c7aa77424caf54e9be3
SHA256

d7557af96b7a4b5ac7c496ddd9e1d37558c176505a2de2196979bff3b04e8799
SHA512

8699bb48472208ac348e4933d3512799723b10dc7125aaa149b04a63a4b5e3233b0324ac25b546394f309c42c8a57ef8aaed2adb70abe9e4dea6c15c3f33c79a
SSDEEP

3072:3pBVNdQZ8oPp5s3oRWtsRJoJ1vsm4jqUlmA/YQMG/HrueIpBm3m:3pBZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
1228	msedge.exe
1228	msedge.exe
5012	identity_helper.exe
5012	identity_helper.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1392	1228	msedge.exe	81
PID 1228 wrote to memory of 1392	1228	msedge.exe	81
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4072	1228	msedge.exe	82
PID 1228 wrote to memory of 4080	1228	msedge.exe	83
PID 1228 wrote to memory of 4080	1228	msedge.exe	83
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84
PID 1228 wrote to memory of 3720	1228	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2636c19b07059868ebb6cb3623be91b0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffe346f8,0x7fffffe34708,0x7fffffe34718
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13230195082578381828,15185882533963410396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
03357c75de618f0b3e134c5bf6db9dfa

SHA1
ba373db7362881ab6b40f16920859630671133ba

SHA256
7dc1f63480c37df9799d66094dbdcc6a1846dddc5cafa5d8e0ad708a1bbd09d4

SHA512
a168d590d108bf838db99fe05ad1b92c8e5a4c24cb124072a82bc4bf75c126e56eb237fcc21a065e224f506f53c7dd72ea332cef9871cdca3eced264a805f817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
b038972b5b25837179e3ab17c18e4b80

SHA1
95b5b8dfe456852e52689966ab0fc28644d5fbca

SHA256
1fdeacffd2eb5f01baae619fc3de58228a787dd5cf3ad23c0d94d58399335cff

SHA512
5f35d39bd56074b7ea617b22bdfb79181bc2b761da5d875740dfbbbb264ef70d45df90483a67b82066ffcd588b03129a11eb9fe1e01d62c69e9b4ee2a8637da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
58cd5c7c02eaf067ba5ad173d4a7185b

SHA1
1a791615f8ff0a5ca624d918fc84329955586d81

SHA256
75128381cdee9e2bc8b04964aa52e387ecce33d6e588d92a93c93e4d271937b6

SHA512
9f61fbefb65ac9fa562e2633ed9c60a9bd4cb7a04eb106cc5978a9aa2bb14f1b7ae072d84e074e0a3c3b417389379ba41dc3d58fc6acb877c24a6705c04fc019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97e71d295a179ea99f9f96a96ec518e1

SHA1
9bc86e264260eca92d63518861f058f7c2445246

SHA256
99e7cff6adaf7c1758d94491b1723fa79e95b808dedff243eec3c2b9b076e326

SHA512
5d7d889c47d27ae1031c476a2dda625a78c9aa5d70875542bb1ea62027d6dd8f8c6f8a2335778427dcdec95fb1eda73e99470959c9258c93fae797cc3bc9b531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fe2f8e88efcaa31d2d7be9ca8222d48

SHA1
b6e7da8cf937083a687d7535d8c2f4beeb43085c

SHA256
25a2955788c42388dcda9daa041ea9de3f619137947b17a81b251b727ef603de

SHA512
11558acb50dcfaaffc690127afa5c28c13483c193f86296a89361a7c8479cf4d76251a58bf93fd051e2b0a828416856b2e8ed1fc9cb95e82339d775b896be0c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a2dcc50e9165cced9ad9e3445f65725

SHA1
9a4a382f218472bae1a76b67d848ba73d98102e1

SHA256
24f311b4945e8da93c33c2468807b737fa6e71dd8a4a43d53b333eaa771ab8fd

SHA512
cedc583cf849316565758ffa48f535aa26bc2abedbee6e1482b7bffb21675ecf2811f62178c35d268d6ab5f3deeaab8db6948f5f664a1927cb614efe419ff81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
1b54b7b7cacf20e4d082e9c97d7e0355

SHA1
507223d1447b29d9ac68296b836c29d5fc060424

SHA256
f05f383286f0a13d8f5b93e5ea42dd260a7d26bcd4bbe203f3b896f91cb3e535

SHA512
ac7770e6d2bc780487ccaa3cb449f97512a613ee32f3d16425a43c76060eec41e838b153657a8a9dba74062d3ffc82db4066da141b0ac2199b1382de96d66073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
e962ef816f0b9560b6c521c78ebb740f

SHA1
e59d3f3c71fa5045c4936afa904bb5e0c056e47b

SHA256
2eab133190bff3aa71b82ef58ec51b06b42bbd55b48d0f66c85dd6dbbaab1a27

SHA512
0b177a7fcee42df6987aba4570bf9674dd49e159ac2052cb82f944d8554bf23c4628e1aa4c9455bc5e721b8959cb8e35dd2360c6389366f1d4babfe7478f3bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
809150e94436548b2534fd8e7dfefa9a

SHA1
e53d71da65eb76aa80f1aaccb1b684cbcb032fc5

SHA256
72fb2bd488927b3c5f0eb48ca87a7518f53747846ba29b623334502da734579f

SHA512
d3c65e4988061d2ecbec2c8cdb1705449f5b64b53a0c34877b89155ea92df03d9e4ea4c066d4598a205e4e48b8cd629da37b47842308724cfd64c5d3dc8d4ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
54a84842786f2b9909b1b934d66f10e9

SHA1
6ec5c270172c015dbc863043e3954d05aa7e560a

SHA256
9662de29808973ba7db82c554dd0f5acf5a44b98488cf5b8e7e803eb4dd5dfc2

SHA512
191338d704072d7c5df29c68cb640a1597541da9e5e830c4867a8b7bdb458bff090b59edabf7b6ca6178f34725d8fae20ff1c69ca5e866cb5ce191e0679cb2c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d5640555faf9dd024114a415b2ab3b9d

SHA1
7263862c4c9bfed08b8e5232735f38970a5b7e37

SHA256
e4f9c81f1c884a5a0f09386f86c8140ef34ba21082fa384447a3eb44dc7afafc

SHA512
deefa94171abb6ec09bc3b71e6ecfcaa8fbdd78d40beb31402e55b780b015fbb685cc04391e6e3f97365f97b569b3f7af1421411712706881507eb4cd4038752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a4eb.TMP

Filesize
370B

MD5
252aad82940aa6f5284e49620b7a6346

SHA1
faa12162da827aff4d33c94af55ffc24dd733d9f

SHA256
39b1b32f075eec0c63ef6ea692cd2c564e5fd5b499f9f31abeac3e95d47bac70

SHA512
550ea34d21c98a2b1662b8d91d0dd35227aef2e9bc8e759cb9d808076402b979a474584625937a7ed09184998bf7a7617d9a68dc6f640b192091ca03e249fce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2104b6809fe3e6ccb25c40d5cc1bc280

SHA1
f61092cac49c440e85d7f31bafe78dd73b7078a0

SHA256
4def0b54a423af623af772d20b07f9ac7523543ba798e42982a528be3e787d80

SHA512
9c2d8d967698c1d64d9bffe161bed525143b8fe5b07aca3ccd9c0f7c2d7647a581bfa11e9852c6e4b1fe0a374daee185906c0e5f4c0cefb276bed03d4b8d51f3

Download Submit