9815067cce03d8c25d41b4b702d2e208ca050f316f85e13c4b8d944aa882441c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8f8104b684f2190a2bf5a522a25fb1f_JaffaCakes118.html
Size

71KB
MD5

c8f8104b684f2190a2bf5a522a25fb1f
SHA1

d2f4b9b2eb837cfc363ced9f6183d25ee9f1b34a
SHA256

9815067cce03d8c25d41b4b702d2e208ca050f316f85e13c4b8d944aa882441c
SHA512

c2d210376214603f22d8702284d119aa3263c66fe982def4b5e5ce0533c8aa77963604f08a41419aeb757be7ca1029605a4a827c15a6648c4c4b906951024a16
SSDEEP

1536:Z0kclrJklcc8vhKqjaaKWKFgg7HObc4Dm8I3y5Vowbpic+trekk6TzeqD9iKlC:2kclrJklcc8ba9WKF17ubhP5VqpiKlC

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
124	sites.google.com
121	sites.google.com
123	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
3684	msedge.exe
3684	msedge.exe
4684	identity_helper.exe
4684	identity_helper.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 4724	3684	msedge.exe	84
PID 3684 wrote to memory of 4724	3684	msedge.exe	84
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 3224	3684	msedge.exe	85
PID 3684 wrote to memory of 1592	3684	msedge.exe	86
PID 3684 wrote to memory of 1592	3684	msedge.exe	86
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87
PID 3684 wrote to memory of 2732	3684	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8f8104b684f2190a2bf5a522a25fb1f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7ca46f8,0x7ff8b7ca4708,0x7ff8b7ca4718
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16184792189626971151,9390571373327550631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
70e5b33935854e8806a969f8a6df0a4a

SHA1
1ebd5c0c8b5cfa7a770bf78b9a48be11948380e4

SHA256
391b0b97b8bdb762ef19b3a762900dbb28c905ed2e7aef711a8a09bbef814d4e

SHA512
2700260f6992f2f56af33d606abbe4322ee285275affcec3b37f20b1b75d03559d3703414c65c5b3a9129e78285f1227b55fcbb01266bea8b6bbb7dde913647e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
40b29bfc9799b15035cd305606bdde3f

SHA1
ee062c451d50d95431213472e5536ddc0d8fc990

SHA256
f73cd2e68f69316a969023fb5d882c6c734d0f055964cc88e7b29602e36439ac

SHA512
f38563d2cdce8f21d5595c219ed1c93c706f5fdfaf41a4b18835cfc95cff3e32a01d536e61cc3ac1f6889c5aa8bce0ef607c14e079111cf02ffed46ff3200f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4386cc016b735eaed38d2e0089a64eae

SHA1
098266afa6c9ce851def6830c325c5f69b371366

SHA256
8feb6a831f1f9148dd18be75d296bc3b518d4eef20b22c536dba196d47af6acf

SHA512
7bebd821e28d60e6e5a73f0bfdb1568ccc801a772f062134d7a77ebaa0334c11053f93c0155107c0d9735b4d428482371fefdd32ced43f47ca7348c53b3696b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1cecb7e4251d31377407da964518da9e

SHA1
91bd1681e809adc2a5a6aacbe91542b6a521dddb

SHA256
97449b43fdd20fdbcb5dddd079ebc4f065562096910874337d803b4e41495171

SHA512
483df13aed12c1e969ac005a8666bb501a49c3749b7991706d9a7fabb877d2233316dcf44c736a0554e89a7d1e91c184997588adb8222ce215e7bcee0c832e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19294a125a4c9be9a09c81977fe3b7db

SHA1
c069052ae0c60c28e5412fe8cc08d66627b4951c

SHA256
46eb9973cdcb09ba98db160a283a432f42937e3051ef9a1de223d1de7821d3df

SHA512
2fc7ac2c6e3033bdcb1718ae86ad6177226ecc4dc2d3d2191c0ac41474d5f00b587555aa9e23d11b6c569c30205615fa00b67cf99fc94b80ce3df36024e591b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
607ff3b946a0ed122acc8ecf0b92c785

SHA1
0a3a36be09df3d1777c187cdf9274d7509f431f7

SHA256
c12fa096ece87c3d41450dbe3bc803bb1f0c622a444525dcd556b5686c8d7087

SHA512
60644d3b9f28550e5df0f4e3dcfd615fb0448f3999fb1eb0fec492b7781c195a0cd25d23dd85af10a92287f8ad96652be96a8b4d9f4e5e480e132ccc3f4e01c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f29fcf6e56921e37bd5ffef19abb5075

SHA1
2406ccf2fcba27a67c117d32d461334da2f19778

SHA256
1f85089098dcf4858d8ec8ea02a0b68a97bc5f41560ed27855bcc98184f72851

SHA512
7637bffed5c52d1603ec5fc7d4b7432334083296a9558b7acc93bc438302592a38bec442b5f6b39b88f51e8c064d2d78fe70c363c109ef13c065d180e99e2062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
56ce03fbd0a90e0d48ae500e6602d473

SHA1
9ad04a015d9a7df57b0478a5e8b35a8062206fb8

SHA256
10ee86bfe18b088cf76e7904af2d13c8f23daa6080043362cd47cac0d3640311

SHA512
2e41f32b07c52211460ddddf7b2dddda5b9847659816d967c16abcf7055b80a8e040bc0ae2ba2c331989c4415de48d216112edaa2290a0333077c49113b6e23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
b38425f846f36bcf1d1b951641cf909d

SHA1
aa116ccc1ac1233fecea9ebf37de3ef5f08dce3f

SHA256
3faf76413b755ac880ddd3c0252f861b6481dba791a3ef5dfacadd6bff9ded9d

SHA512
d374a7e1825233937445f361830cf05258007145d536018792339bc9831a2a01052d11bdd217279f572e92c735078ad1ed85f3bebeed0bd00d20877e752cc89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582fa6.TMP

Filesize
203B

MD5
80a2358bc3b3bc376bc86df9597ce5a7

SHA1
6a3b285690238e3e1838e5a80fcd74938b389947

SHA256
68ce9721838e0ef5a77a319cda049db830575e3dda9bbf89b5a2b1e47f7cfcc3

SHA512
9558e97d2e5ddb7a556620256a98911d6085bb77a525406a52aea24cadd0b46a2603948911bcaa825427ce01fcd560891da505ea74b7acf69a7b51b8ae666c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f3481111211e9a69b83f6a55a0f56be5

SHA1
39ea3661d898822f3209c2db5d0610fc96b39ed4

SHA256
02d8d7fc6894db523d53adbf9e60234910fe8cb5262ba3b8f1bf7453737225c0

SHA512
0aade3717d33f81dd9a822b9d5dd9f3c317b754c8a04d56f06caf02014b493a63d583ef213011fb795bc675ca750d20525e3dd18f2166b732f4bc6b437727904

Download Submit