d859c8b7f744b460008d6132f7f79b32c49646e45579488279edf38701395f90

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f8fa8c496a6887b52d628fa6cbe231c_JaffaCakes118.html
Size

155KB
MD5

3f8fa8c496a6887b52d628fa6cbe231c
SHA1

a79ddb0afc59a4a5d1dfdd854eaad2f4d3d17fe3
SHA256

d859c8b7f744b460008d6132f7f79b32c49646e45579488279edf38701395f90
SHA512

4e88b0546dcaa13f0fbeee8e63d8532ec6f07de85f4e72f30d0d0f11adbe85ad54c8e386da1ae3cdfcf581f9a051d634caac8258bdf7b24f7524e7ea35d41028
SSDEEP

3072:H9nx9m5tlw3OgvCpmNoAA3ctCj8tFOLW1fVw:5x9mStvCpmNhOLh

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	sites.google.com
39	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4284	msedge.exe
4284	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4052	4284	msedge.exe	85
PID 4284 wrote to memory of 4052	4284	msedge.exe	85
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4324	4284	msedge.exe	88
PID 4284 wrote to memory of 4824	4284	msedge.exe	89
PID 4284 wrote to memory of 4824	4284	msedge.exe	89
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90
PID 4284 wrote to memory of 876	4284	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3f8fa8c496a6887b52d628fa6cbe231c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff968ca46f8,0x7ff968ca4708,0x7ff968ca4718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15651257694610743080,2735451357793577633,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f08c071-949c-476c-ad5f-992543ff9318.tmp

Filesize
3KB

MD5
1058093d21f86d44b1f9ee0ee3395dd0

SHA1
1db77d08d828d2c97a258557063ccade0b68330b

SHA256
5318679c9ada715c63916f29abc7999dcbf017867189346e182640b55fada754

SHA512
b99374f05ca1eae86a6dcaece337eff59c70c70c4e996f673afd785f3fc792c916de75ac8926d9015d9893999e6d5bcaa93366ba0235c629f789122ed84d9490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f6a4168c9a8edf1253102fb73af6037b

SHA1
514b0a7ff9782f6b2a46f2679f5a46565527161a

SHA256
1034140ead3e186517527ed6e448aa1e3e652944a107964f0554f02264fb328f

SHA512
4d3f196a16367362ad7f7da5d750ab14bc32aef36e239885c605d1eabfe48723e2448b00152adbd5d2a54e447e1d3d8b89414a1fbefaf5ae79d25df98267b099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bbc140b968c47c37b6f704b584a1e257

SHA1
54390173e73a4535a51ea28918f5c10256ad1425

SHA256
bbe92ea9af0a4e4e57b21e3e23ee912d62335b262ff8ed6c800d05dbd9bb20d5

SHA512
61a70edecae88d7f9c3ae5f37442f20eedfd895c659ed8e94a2e8021edcebd91b76a864500bd3b4b9144a11986ad513d995023ad9ee19972edee78165b67dff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
440f7f53784705689b0082d5514bd9b4

SHA1
39e54e5b14a30e78eca5ba7fcb31fb303bbb54ae

SHA256
d4679a70fb777afd54d0b14c1f9d1ea3c3879d7f84dac992a90b427a292af169

SHA512
cf576b6930d85480e714ee04833132d4751f80b8ea988244bfc32fb64208d013249047eddbad07822007a23a1945b8cfd179000bdc919bfd7cecb56a34683ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7db86f6ba62c045a954c252030ff9ccb

SHA1
ffef629f3dbc42da3c4901b570691a71c75c2904

SHA256
e84d85ccd762b24b3b7d6d3c5c964d2d4963b358d86f8d454b1b48bb2e7975e6

SHA512
a736119dff6761ef33d3e9c2d0e9a4cbc3a50506e82a905479b6d5a97ad443bd17d6e81ddf0af0457eba4a81a04b4cbf351d5f6710cb88675afc207d22945de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5de08606bb9dff3d44d41ee806775278

SHA1
552fd6e6ae615595a3cd72eeeccf1f46b107db7e

SHA256
c04fbe9ef0161c65a68da4977f00c5ed58da84c886fdb037ed281bfed1b14dc5

SHA512
805b5a9ee2cfcd8033d4100976c0def1b44239dd6c5d96f6cd0b3a4a943ad5af73880bad8af8fe1056032bd6009b6441b3cd07a1d60347361b2b0bb92d3e601f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5aae2d80a2cbca31c0ae8c4fef1f8642

SHA1
f3232c5f4b20a52615e25079ddca433a1561e55d

SHA256
f4e2d9cc402500c3536fec4ead26f2c3355c66173dfd06e222c7087f7e19d83a

SHA512
c823682f0210ebb82a37c90835ef8b46bfedb0d8d9de7d41981ffd477d7932c3422d57892a3a521b7d2ff77330a51e5d429d19d9979ac5fc86363cd471c0afde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87f1ee343425bed21f1060c89559a3be

SHA1
092bafb3b29ed5444553be5f349b84e3346391b3

SHA256
7b52cc7a457a609caa6f228a500fc14209f3b5bc054feb8bbd00ef46467e441a

SHA512
7fa57ecc3d9a6b61627c57c98ef8f64f8570c8f4ce62ff605b265da5d5576aab8c250fbfdb44e5531a8da9e15d6455efb3143ef207e5caccf95b3a6ff774f52d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c856e13112a94648134a16ac85e851f8

SHA1
e38a11de036693408d1b7f962287a518c604041c

SHA256
3c27f3401427e8863ef0b646ed2f406cdd1848f954983e3b24dd1d35750ce3dd

SHA512
f4ef8dd50d70bdde5e31666bf3c745c5f72cc77d33be0ea6819c7203e4966215986d1d170d62d36a2d2d37fdf2e061b088fa9f635439ba0b6fe2944b1e83e381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
533B

MD5
1903f7ca527042c30dafd1773d587d36

SHA1
69b763dc43db32766c8419b587b2af8edb3ba2f4

SHA256
f41aa49c9cac43a983cf0b34b947d688b7e71354956d2946f327085d3c32b64a

SHA512
61ac8ce01da4dec6f4b3fae966dd772061a8cbf51cf447be2e09fea280edd75784177be2b71969b442069e03571900c3c3920460e41a9c740c641b812e2b1422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c294.TMP

Filesize
201B

MD5
faf7cf94a5e676bc1dc7f482db1527e6

SHA1
3a4b3d239e48dbf4b989587c23e8c16ffecf1cd1

SHA256
8166a7217146fdca2394e9fb15faec8d762c03b5a9bf28d7b542f6241a34acb8

SHA512
0166434e8743d906a44b2138a4f2c521a4d6139cd256f4e5f16fbbfbdc649eb06bf209af2506e1d74e978ff64e480f3256f19a9c56286f275d638f0f5c761306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee9db765-f882-412d-86b9-5f9255e9b3e1.tmp

Filesize
7KB

MD5
40090d80de8fc813c832ae0281ce45f3

SHA1
bbfa18b66055da98f956c0633f937ae636535966

SHA256
e698e8f5ce536ba08469031852cf6b167b14742ce75c95959f2b8b50208099b7

SHA512
99613d894345e43d2122dac39ac93e21d0c7a440dcf1bced173496dbfd1d5f55a59c59291501974cc6699a14635f0dd7ac78d987d2f03d2fd56fbfed1e68b473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d67b79554f34534eb3c4648c613ee2ef

SHA1
ece59cc737077852253153bcca39b788ad3a2490

SHA256
f68c98cac97bcf142ef7a499e1b0c84ae78b314691757702c106bb4a003f6fc3

SHA512
45924ca8fff218f0c81b4b5431bbed7f97be59e44a25d3108c3043efbd0c24fd111af5263e0c3aae9a3bba2afd64d019206874859eeb6f79d9287e110fe3d071

Download Submit