614feb29799ed69abe2e363e6946b03f08289ed736e6cbfeed285c7feb90a07b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26384cfc14a10cc1dfa0779d0049c97c_JaffaCakes118.html
Size

111KB
MD5

26384cfc14a10cc1dfa0779d0049c97c
SHA1

96a475bf2f9ca3bea296ebbcd88ae66b8decdc2c
SHA256

614feb29799ed69abe2e363e6946b03f08289ed736e6cbfeed285c7feb90a07b
SHA512

22b3fd319899a5dd04416ab2013eb9c0cc25fb2cf91da490cc7d311ec1fe7311e101893aafaa64263e5bb885cec237779390a3a5b4f7e0a1c47964879a79a187
SSDEEP

3072:TsIySN+tHbPFFM7wZf4ff6ywqP2oTNbMHTu+tHbPFYMsw1f4ff6ywqP2opNdMHTT:eSSMwEn9+o5mGMXEn9+oFmnP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
4948	msedge.exe
4948	msedge.exe
3576	identity_helper.exe
3576	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3024	4948	msedge.exe	83
PID 4948 wrote to memory of 3024	4948	msedge.exe	83
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 1056	4948	msedge.exe	84
PID 4948 wrote to memory of 2416	4948	msedge.exe	85
PID 4948 wrote to memory of 2416	4948	msedge.exe	85
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86
PID 4948 wrote to memory of 2644	4948	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\26384cfc14a10cc1dfa0779d0049c97c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe1b346f8,0x7fffe1b34708,0x7fffe1b34718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1222452975687355461,13862669526640495045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
24KB

MD5
034096fe8f5d83265f2b03de99414d2a

SHA1
30e1f41869eeeebde34d03b312ec84f2024d7631

SHA256
dfd58a9adbd4680e857d646a37544a286ecdb55ea527114df39867bc4daa2855

SHA512
3525c2de9bd895f65f3b667110ab99ce92a22823e01e2becb15b58855f706592712b50db0bd1fab206c2b9de41f7179c0ac37aab750ba745ef23d2d172491fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
47KB

MD5
2ffffbf0a569ca29ea4251ac6fce36e3

SHA1
d2ee5651d515be2b4da6ef1e8ce7d848958c3ffd

SHA256
89d54b4f7790688c160cb2dad03d3cd3150f3efdb3545fef412b2dd1d97bc4e9

SHA512
68a8e01d5a14f88224b8869b5d3546f55a820983290f4df6cf8026481b810ee110bfc142ab5cb999c03af775c9b03e65134828fe2e6e46730976c7c8e7efa4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
18KB

MD5
844dd813e266d90fc010747f6edf9b4f

SHA1
6bb8dbe238a0196e3482fae7040c87a1b8443181

SHA256
456017be1dbc830647e96ab35ff078db4cd62474c79be9fa948428a79c877289

SHA512
c456a75ce6f36a5a6164f9bc1b414691fb6a55c6ed8209a9014491f9989e8b8a90e2167e7be0e782f9764dfffe04c7424b73b47f456ad54f284db81751590502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
29KB

MD5
1f3b16a3f1112ac7a42e997bd0c5f2af

SHA1
3deea46afa69685078ca51e39867f9c00b60e29c

SHA256
1f8da4b3e5d8b0e26fab1e5b391330892dbfcea6c6561049c7590aedfc26ed16

SHA512
3848ee4cfa867ac5d1ad185559dfb7c3e4a6bec384467729a67164d293be8474e2d180eeac28600e1d60837240894637a539aad7492e5a30831c3995fdb1ff78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ac17d1328d38b2c8e23702e580dbfb4a

SHA1
8c37b42a0d04973e8f135e4e811db8d0f164c61f

SHA256
61015d37f21ba7c17642d3fab3e78c43b9ba64280ffcdda86380ed7cc05b0774

SHA512
fb634be6d66e18646f4b6436bbd4ab7ca3576dd7a8bc4de3ec222a730ed1f4438b40ffe382a1b3a0bbb767b5b1b8cf24f3f76e148b74fc19cdc73787d9db57b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_devicebind.ebay.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_devicebind.ebay.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
722B

MD5
ab3e6f037e4648283c283f998f5b83b0

SHA1
4bdf4406f6457b99a48befae9c08b01a5c33b42e

SHA256
3d738ea0070a38991c7658bd5c0588ec7151c983d7fe4bc1a561fc90d2c67a85

SHA512
d6eb430b7f19c101b25a196dc5e2e0c78f1e1f640769350ebb6292ad35d6589ac5a59a8e2562b0d6efa9d3f2c6f4532e9dc8539cdbfccdc0233d73d0321c0fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
649B

MD5
0416d2113c2023e20bce872abebc9b3e

SHA1
722bcb2573636247e14ab7172ad716eb21b00897

SHA256
ff6c842bf6ebfe1c5254f4772ac8b827f82f2717976f5824375571ab60ef1304

SHA512
7c5b992d1f1055d3ad8290749d0e18853e29dbe5ca561dbbea8d62d4340ac3ad18d1e01965b71c70c5bab8369c2bd3713f861b0fac94060f6058fc00cb9b827c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdc21e6c72802254e1d22793baca4a76

SHA1
85c553fb7ec1d06c9d630ccdd76edc174bd8dd3b

SHA256
f4795343d06ad9a78993ff202cb02cac0e9b2c5f335df8ce50e14f70bd138b70

SHA512
dde8f0c8fce3c1250c3e3b4a18a746c637603baef19ad69613612e5859cad16d15b3ee91b190406f2f52d4b2fb100c65fa3c6c4812602ac9a2e5ee5e6b38dd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0ce907944377558eaf8b9092ec154bf

SHA1
1e8f0802fb5bd673ef9459cf7561a361e7b0f06d

SHA256
1933db898c5a6f38991b9abf7b6df4982ccfd4c7c77045c0e91dd5b512f9f684

SHA512
be4ab6c1433df532d9557ce25d02415900322a574ce52183b8e7df866fe964339d3f10aa8a4e7eebccc17127cc94a3922c6b27287b07ada590862df147464ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d10d44a73e2d7bb6afe2cc3d2d3dd221

SHA1
24fa0f1bcdb04a77227110463b0f233798ff3df4

SHA256
081dbc76cd1ef65dd7e0da4b07a25e9ed16dfd137a8f103d3b33d0010493fcef

SHA512
0d1f7d1181262b7a9cde036a46fa3a987a25d4742cd8d7a0f924acce4d1b502ce1f207117376bb3a9300196160f91266b3ac04189f79396c2af8cee56c2aade2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d637.TMP

Filesize
1KB

MD5
4277cd79db67e3d16813de9280ad7047

SHA1
7e19ddafb7ac03f705020ad7ac80cfbbfada5e89

SHA256
27dbad2a0e47acd29c36c780c6e46c5de0bce7a9cedb7a196f9418a21b99f849

SHA512
60c0ea50b753aa3feae1688e46fd86403fed753c80fe059247c253036ee7f28ec6f2f9a8a1fbec07aa1d68421b97ec20ecc694d091436f883730708640a6d8ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bac690e705bc42fb764eaeb926a15e22

SHA1
459643c2439ba2991fc7e1c8ab02f80771797c8e

SHA256
b9352223dfd7b8c09962f05ddb639fea7bc354b583ac4ca110102bab50e60c9a

SHA512
17823950cce8a4eee6b4faf160954307b5c69db2050e4bc9f2c933568616954a4f5e145c663a24f4e760e81a769282e193aee7e3a6ecd0c93b0301617efe795e

Download Submit