61fe05d6eccda05a5139a3ee9bf687c9013e74636fd801f75aae5a078eb71093

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08ac328ffcee034b861adea25a396c9a_JaffaCakes118.html
Size

40KB
MD5

08ac328ffcee034b861adea25a396c9a
SHA1

b618b49f04ec59fb0b41c3aaa49b6b9530c52751
SHA256

61fe05d6eccda05a5139a3ee9bf687c9013e74636fd801f75aae5a078eb71093
SHA512

4ea1644e09b3ed7a243c1a0151b0bd57998015e97a6787688e7b8eabfcbb9bb04294dc73c70a70f5e03c6f7f121565454729c81f1b0385788514859eb767cd71
SSDEEP

768:dO+T+3UOdrh4g7J0vAkeuq6fNoCQC46bcuVFGzU3rI6iruVUH:dO+Tqrh4g7mAQfNoCnVPeuVUH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe
5068	msedge.exe
5068	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2108	5068	msedge.exe	81
PID 5068 wrote to memory of 2108	5068	msedge.exe	81
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 2812	5068	msedge.exe	82
PID 5068 wrote to memory of 3784	5068	msedge.exe	83
PID 5068 wrote to memory of 3784	5068	msedge.exe	83
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84
PID 5068 wrote to memory of 3596	5068	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08ac328ffcee034b861adea25a396c9a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaf3846f8,0x7ffbaf384708,0x7ffbaf384718
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15335632983991318438,3078436686666357471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
b07fb350bd82db54dbc49c656977d25e

SHA1
005d2b64a3f60f45df5c87df1e11e7b4d1d00f22

SHA256
d5e03f30ab268ae27dc32f74ecba99c49a2723cd6e67fba5d1d9c7717f967bfe

SHA512
62044d7260e3788c4ffebafa92813b24f56a2e636a96fce9b46dac37b93e1737ef68ba2a4ce0188b90f510b8a7f40f144fa8d3ab31c6dd6babb8d3955ad19aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a2f71ecbf1bad582d66ea22f411f2df3

SHA1
da7c7d7d356677a8803aa1f333647f65f6d55b3f

SHA256
a03d168b36f9cdbd9a2e6ab3c41814189940c813c815a8bb2232db9f7a2b03e6

SHA512
a95991a7c3a2f16d656df216be63acce7d9282dbd9e5bd2e575e6022d395bb324a5f7d6fc1a6c3399eb006cadbabe87fe0d573e3c976f02e6bf5032786fc3d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dba745550da331bb2606e3c95e0ba566

SHA1
771214bbb588c5f795671d24d8816fafbda33c18

SHA256
30ef9191e753519432f5724ad98b1456099770c5a008d6426f339da10478485c

SHA512
14a2d4cec8898932959afdced13c4a20f0ad3990b9dc9b31a0ed809412cdd285948006a7222f570eff7705b305b1f374c97db8aace8a8a5d6eee05c73a8d5b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8b0489ca229c20f843343135b1b93907

SHA1
d9ae3e6c4a084b1d99adc09395fda43ac5a654b4

SHA256
97a50aa03cb85474c4a79b0ee835a7748478ce4f165f0c8af298853bc1bc590b

SHA512
146a449ae7fac952f5c41f068d3bcf47aa0ff6b547279cc61f533a6bd71b96543502b1e3f5b8c56afb3325800f291ed236ed40c362d8fbe4e3620b32469b96b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b3d5c643a63d3e7428b45e0d1ca5ea1

SHA1
71c9e08d3a86ef82fe05f4156d5987d16014cb88

SHA256
ab04040d3b50137345d03ff39ba25b3bc39246362232af68de6b8cd2bf02f971

SHA512
fa1ee4c890193a6db5da3e6da93da41f5200426b5d774d8b68b7ce62de733ec0f91a7267921478cbfbbd9cbd9d8bed61f80351b184c8eb4adddce8ee64e24369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a4f2a6aa3023e69edd04dfc7df640446

SHA1
86f0a1aedb85149964ab7cf2903399e73942447e

SHA256
1f70ca11808dccca4f758511235f227958f1f026ada51c2e2d021b1e8066335e

SHA512
782cfd5a8311d491d25316eee0b2a04b2279d502aaf362fbadd4c6195620049f21c64a32b5c12bf653059e0c1c663c3dffa0210986b425448bc499b77580bafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
354463fff5393a8ae9ff3c586c501fbd

SHA1
eec0901798dcaae9cf58f6f1a3d66e5b267c3a44

SHA256
dda79f5f693fc44c213f656c8453b8dbcb1573f23c4ac3f6905ef265196b014b

SHA512
77a48828da006c9be3c4fbe3730606fe3aa9be6ce723db219b01b44efd3ece34f3ab0ae3ea90a876d5aa5bde0c41af7535b39a2040518714e0cf8707898b18c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9d021e04e4dafde00b7cdd22569eac4d

SHA1
91607c112fa9361e7157251b3b6f8d6d7895e917

SHA256
fff79c3a9b9160342a6552830782f7f233ffec93be00b656ce15abc4a957e105

SHA512
cc2d662c197d772f562a5b849e8827aea5f74b33abc47f3aa9c94e24059c53482bf1473119938f85669168a8cb66ece32b8add52fb29de49208153d5a1f2c000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a3968229437a1daad00f6f3a80d35706

SHA1
8f5c85351308038b9827aafb43dd8c7c8d1f6cf4

SHA256
091eb1e7b61bf983dc42e60cedc3046f5b38307935c934e0acd98981e3fad66d

SHA512
8f8959580350f06b7ea2323b2c769a65b5cdf26a4aa146fbfcecdb7c7b0c497a80cccd23a30dc3c88758d189e5e417250b0d5213b0a3f3356198f37649976d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b72.TMP

Filesize
874B

MD5
4d1c9de5a499f9ca114c54bef64da36c

SHA1
cedea996f75191a5a0941366dd49140c7a325c78

SHA256
4c510d413c3a7adec189e3c68d143097247be998e9f292b0879b9a4a27a90a3a

SHA512
8bf02cb7d9f09d9aa0e64f11217923afd715e36f460267812062248517d9c48b8fdd29680216e98f67bf78bea9ce32ebbdb9f3279cd0f466ed3ef5407fd3e4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9fa1555bf7e18004d3522632849b6e0e

SHA1
436a3185c3f7318633fedb3f7b661dc2d56d2374

SHA256
f66935f7b36a3540b6d9ffff8bdf2fdcf3246a277c616ff92f6c404a802f9b43

SHA512
e0bd87d1785269e027f86235f4b38e02d8ca0fa3160cfcfe6b8e7ac314d7a7576174b4dff99737b456f8efad5413510c5b154131f9dfb1d5826df1e71c5104e7

Download Submit