52d94976f34dbb7eb99e3aaa1b4bfe8f9a5aad8659a76df995ff330401a03e9c

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac823966a41769edd72ed05942c7ba5_JaffaCakes118.html
Size

64KB
MD5

eac823966a41769edd72ed05942c7ba5
SHA1

63f1c108bd04c01cb378dbbdcfa655ffe5772329
SHA256

52d94976f34dbb7eb99e3aaa1b4bfe8f9a5aad8659a76df995ff330401a03e9c
SHA512

12027dbbaacf57ace27eae33b17d5fd9d2f0b847d20d67a1c61b5cd7f08cecb9c54865084b5b2b244dba724d3308d6209151c316336827b0ec9f36d06a59f56a
SSDEEP

1536:466N5iBjIWP9yXydY9RIeu2KGb+1la+ss0jdyZFmapk9xmbKKuViXFtRcMV3Jp:iN5iBpPha+ss8cDlpYxmWKuViXFtRcMV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2272	msedge.exe
2272	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 744	2272	msedge.exe	82
PID 2272 wrote to memory of 744	2272	msedge.exe	82
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 232	2272	msedge.exe	83
PID 2272 wrote to memory of 2396	2272	msedge.exe	84
PID 2272 wrote to memory of 2396	2272	msedge.exe	84
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85
PID 2272 wrote to memory of 4420	2272	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac823966a41769edd72ed05942c7ba5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee21a46f8,0x7ffee21a4708,0x7ffee21a4718
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3314465958029921569,17094522876648557919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\203a7bd4-aac4-4418-a4ba-4cd58e69d5dc.tmp

Filesize
8KB

MD5
c61c5c5d6876a1ed3de75bd0c05ac4cd

SHA1
caaad9b0a6254cddf16d99c52c9335feb860e829

SHA256
2b499e135ccf0f62ddd922191d00449bba5717ffa24ae4bf1b262f9c90e3bce7

SHA512
168eb2dc5c9c382402d40f301fd1bda3413e32a346036fd2e051cc259d7b0f8511a7406b803ea9d285240cfe07f1e9fc457889db331772fd0bdc0a255dd04325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
9838a27e6cf654d899b3d754c47f261b

SHA1
aff0802c16230f4d37f2010437ec72b86ea8ef93

SHA256
5c9c0d5bfbabfeceefb2c3c834255d8351d4b0872a61ba990d0383890e6db9fc

SHA512
01d80d8310653b4d008a87bb290690e4a325c924a732273128d1cfe5125828bb4499a4b5d38184ca5d0b53200ba8aa2d0bc677336393808d6e97e3ef0c60e7f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
32a44c1dbb7e4cd3ccdda361513121f0

SHA1
3e213d8abc3c425fbc37de8f3b1d52dc50fdaf57

SHA256
5aa2c7281ff38ffeb93710c127134d09f3c5f7540db8bee1fbc9b086427e6100

SHA512
7c4c4db0a65d257ee6b83076bba34eb65d032cf7f2bc688e9d87bed3e23311486d612fa44bb81c82667dbd91de60bf9bef2a812d9adddb69c9ba2a4ec66e3ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e40206ae5aee8cfd76747a8565446336

SHA1
5cf96a2fc82b619df6f6a56756ec4f1875efcfb0

SHA256
3afaed7af8fcee1ffb6751c972900057df64dbcb57353ef7c65d57251e43097c

SHA512
d16872cc2dac930a24549ad23da5638e1a9dc25d41b67d7501f6d99f901d1834c94da8b3978a9150c2dbfeaaf89bd803a023b798ac30d0b60c29ff4b9fb582bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
028d05c01ebf6cbc66293d7697b216b2

SHA1
453135b24d7d5484a09bd3840cfb1e18dc4aafea

SHA256
9133e59c64de1d20d5e1ed37cc67c212d93e3112da06401daab296fe6ad4a607

SHA512
7293ee7412c68ea3ba88a5512a1205003d5205c66bb57fa486bdebef98ae01f833b61596da158e5310df1c047fb1d9e10d579ad6d11150fac67a36ab78f7a725

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7a5bad32c6f8b3b87458e14798b69668

SHA1
29baddefb0a4fa2dda55513aa54df6861cb6bf54

SHA256
4a5a5c16ac305be62b9957585cd7d5a1d63bc5f92c4950c8dfa378611982b03c

SHA512
15635c5b3326d42af3afb614984c8fe2bdcb0b63698b453a5b47c386464b8b8a5a3fa54428a4389746137e3a41d44258711487458b58c7b2396a46387c271fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef59b9416643ca5adb3bbeef7d3ecc22

SHA1
9daba90aa90c9b62b5435db275bfbaca2bdcb06f

SHA256
c5954153a64f80af7233ac3179e42b5e72fe9bca3955a955156caf897a7ddd48

SHA512
d38711b4886e8696b0ccb85efb8ce5fa8506776184321f91a201d7a938abfa40aaf7ba0a26246ea58fd5a62621c4ba4ad0f7932c3fe4d1f9edd9a069044d281d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
82593bdd86ca282ebcdf9d5502049ab2

SHA1
adf79c9956d91032994901ebf1406df31f5304f1

SHA256
397f5a48c2ec90328a1b5b8431a6ba0d64486d6039c4af18760a06b11ec01140

SHA512
91fa7b40d72567cf50f60b820c396fd5d3131c557e1191a3ad9853ae5deef6252b1dec7ea0a432299b45ea4bb57f84e391bb2bf56658c0ffeed3adc12f7bdf22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d9f9f878f4785da1eef8e87eee26342

SHA1
d2b0aed0316142216bb8ce42be8282e565c73a4e

SHA256
5f6862b915d51c93dfefc72c8c6f54f48f1e230b493105ba337892d32260d7b6

SHA512
c14fb6e50f559983a4b94c7a16fef1bf375882dcc3e5a1161c4105c334f1ff0621a770fee212eb68c5b3f210da5e935ac8e2fd1c3ac8e862020c457a10440d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58123b.TMP

Filesize
1KB

MD5
f4259a9688e05d9b2a5645b735bea231

SHA1
04edbb5c03d5eb3f847657331d15eecaad68c28d

SHA256
bbb6c7f87a0d8062a37c773c98ab1cbb66059910f123fc63fe3935377cf1f7e9

SHA512
94632e7637b4ef98faf1b561328e8606cf3ecdd98960d7174baa6db3eecf87fbc7767a213bf8b96f8f0cc6962f87b0fedbdf7261a9911ee022a2528fdf18e9fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
35d7b6efeafaed095473f6525fcf167f

SHA1
dc7393ef162955eac7ebc8d49251d1ab09f88d68

SHA256
2b1c6d3ae59a982f4e6f7e8a27b9a7ad8dc259658c24dbb6f3ac02c22ba1877f

SHA512
4ca2cf0ce5f3769927036db6d680c36d30b1453c7b70090bde51380f7171f55b186e1f34416c7f2ab778fc0476e265c8d3026a7c53c946ebb15576b71fb774cd

Download Submit