a356b5d5f8e29516fb5bc7ab253f8f0ea8702cce5355f7a53b585b728341e22d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c4857f05cb0dc325ae5a3b4f00210b5_JaffaCakes118.html
Size

151KB
MD5

8c4857f05cb0dc325ae5a3b4f00210b5
SHA1

8cb208117fd7cc9f3ac6415344d0b39f1e0a3eeb
SHA256

a356b5d5f8e29516fb5bc7ab253f8f0ea8702cce5355f7a53b585b728341e22d
SHA512

1047315beebc7e6112b844cd95f53b73878a76e94b19e60b222cded3dc830b94e718ff4d977125d8fb41c5961985e52ec70832c3b6473b6315d5e57ba3b149dc
SSDEEP

3072:04UkSw1QRY6RB7a3D/QW//K9odVhDPzodVh7odVhoSXg6Cnsoax6a:04Urw1CXr4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
4000	msedge.exe
4000	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4984	4000	msedge.exe	84
PID 4000 wrote to memory of 4984	4000	msedge.exe	84
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 2288	4000	msedge.exe	85
PID 4000 wrote to memory of 532	4000	msedge.exe	86
PID 4000 wrote to memory of 532	4000	msedge.exe	86
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87
PID 4000 wrote to memory of 4308	4000	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\8c4857f05cb0dc325ae5a3b4f00210b5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91b646f8,0x7ffb91b64708,0x7ffb91b64718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,2063626668268732300,17243949393591026883,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
657360bef41431be1e4aea61b94c91b8

SHA1
0272f5552ee4cbed5ab15115b2d51af99a3891cc

SHA256
94426cec1b6e1750ebae0ae288127194c5f419b5948c308b5470e8823f391d0b

SHA512
5ee23f3b8f69d3d79c4864e51954b848d6b7bcf0a405fcee940ee6b781586fe7fa2a24ecc4267dc09880fafc5afa8199abaee7ac82ce327a519c50fe4561a224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ab251d48224fcfa29aa81bbbc9ea2b92

SHA1
489bf792555badfb0126d24702a37a9cdec0e24e

SHA256
c9cfd2f2f2e7860d106fb8bf2ebaa27596ac6ba831612073ff3d7bf888ff2579

SHA512
c0182467908739372803387e9d904f320fbda214ddb5fd412e466dcb217a67eec2a6f3cafa749046589ff3101da54b17d0f5d8ea222c5f82cb543bb42cd73947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
86c2abdc9d477fac7bcfa93e6c72c226

SHA1
b45e24d11525121c39a71705fd82154186a8e483

SHA256
a233901ddd0344e91727edfaeabb0b7430cd4967748b3b3a3c4ed750531b3d5c

SHA512
d004704df56be89a97d9c95e735fabf24c99e69bca54db7cb9c38f8f4195906df5cab36b360ebcc7256e13b83bb813420b6122c8c0b806da33d45949035e44de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
980781dfdab045c5ab8c60dd1f42d722

SHA1
0b4680ef855fcc8816a6b04e04dbc8e3086a7464

SHA256
20d2ccf70adb2c53c0b61858486f48fad85fe6eb15554522fedeafdd11b80cb0

SHA512
8edf2c88b2b8a69e397d61f280179d275efc44bc8eb86b97cbf30b33c61a183d6beb3cd49653667670a2c83a51197ef4ddae438ed79eedeb6d8e36798235b2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
93c0696b173b93eb2cd45329f3519862

SHA1
9a71e130c97f8a5d97045dfddb36e655136e13d7

SHA256
bf4ef1483856ba1b6653b0f92a382921d39961d25ddd31cc8c498ccd7ff830a9

SHA512
7915e245f0a16fe5a22ac962a04fbb18a68cdc53d73813b54da6a40c49eb658361fefd41e33236be025bc9a50360739a7b672d72463e0602de4a4cf2e7d5075a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8b2ec6858acd305fd355ce08f6feb390

SHA1
df3d117b80e04a20864e72130eefe27e39594f8a

SHA256
25d3f5678662b8561a8f3db66e716bb2251efc3e27fec42a3d7d9447c457e685

SHA512
5dda3a8c5949cacf5ae47b846c84e3fa236404570767ef7ac228f2a97e2fc714d4a0faf17514c27cc5853f1c54720b85c9d3e0c23e21baa4a7ed47ee62fa9c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ead8025c0e806101de5e50027eee95c

SHA1
2520b049a9ad8ead93b48a1b211eb543ae6e579b

SHA256
f90ca84961c703c6cceff351de53d3626da0b5945fa3a520a635868edff831e8

SHA512
dca5b29885cd0b4dedcc3167b36d7637f675e1bd677d3690d7c0704648a350f0c55f95b5c06957db3bc2a1281007c089240641732e5af08bcbc82b665f62dc5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f9a83851e062b51a2aabe1154c78f4ca

SHA1
7c6679a1185a127a39271ede988ef5e0081dbae6

SHA256
dc446e97ecfcfec5de410337cc98c4e4eb74c1dd859769a3df81833bf3825b32

SHA512
c8a0d79ca8994bca85acb46e89f1bed1b73e8b053e74fcf462f627454b11b58a7dabf709d2182858a33f17a05489882e4b1b787f819bfe236bcc01d887c39f89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
532B

MD5
d2458d76b6447da858eedcf6cc73605f

SHA1
190bc10ae50e5c73109814fe45666b0d3eb0f0d0

SHA256
5a5525fdfe66e1ae34cb5352deb136e0ef44020e7895e0d351dd398fb1f673bd

SHA512
e100e1f0944317c9ff36b0ddb3efd928168984aafe71bd419eea36546717494e51140018d0506abe084a8982933cd231ad592662478193ce3aefd376a961270a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804ed.TMP

Filesize
532B

MD5
4ffcf3fe1d7f19ca9d5fec27fe3d4538

SHA1
94c8d3d1f890bfe27dc16aed5775928d1653ce1b

SHA256
d18c25438053144d15eea841a5a73a8965f71b5cdac2c7777581a12309c88b19

SHA512
75ce82ceb6b6e27f8c89fbb184fec229e897e1293269aa2decec52b7cac2166266fd6b74025bd7463e73b2878b8b924322aa8ae22d8576ae19e15efb32a39b6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b0c6288b1218fc07406172df17bd4f1

SHA1
2eb9353c7c9e7f219bc94c0041f6a2502b995f17

SHA256
fe29f01f9a9c4c029a632a44cde48e6b8308a33faaea676887b48055b322a4d2

SHA512
dda832fb8f929fe1c735c09aeab6cbc24d53172c74cf44f46a7d86c0fd214167d83ca537310a6d613c657e874184952f2547150c302e53db7377c9a9fb355d0f

Download Submit