ffef171835d3d2057f9484f3fe21726c645dd44f607a31701634dc9fad58d736

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a08a8bfe30fa399675805f08d1cf35a9_JaffaCakes118.html
Size

209KB
MD5

a08a8bfe30fa399675805f08d1cf35a9
SHA1

0146aa5d184d77f476cdacd298604c8b984122d9
SHA256

ffef171835d3d2057f9484f3fe21726c645dd44f607a31701634dc9fad58d736
SHA512

e2e9d89bfd31ed80ed8eb173b2458176210f01dc5fb699669fb9673f108e1def6b875af67853de2f06aff7c391bb69d3e7a3f60ffd46b77c75238e92cc334292
SSDEEP

3072:L6JXanmdWNlBe526Bdr4ACFZx1irKTTJtDSNyJmoTmVrhl4D:yXanztvD/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
1148	msedge.exe
1148	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 5044	1148	msedge.exe	83
PID 1148 wrote to memory of 5044	1148	msedge.exe	83
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 1988	1148	msedge.exe	84
PID 1148 wrote to memory of 2432	1148	msedge.exe	85
PID 1148 wrote to memory of 2432	1148	msedge.exe	85
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86
PID 1148 wrote to memory of 768	1148	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a08a8bfe30fa399675805f08d1cf35a9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67d946f8,0x7ffe67d94708,0x7ffe67d94718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16473651567315112524,10578812934887423283,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
20b5835388380f51fce6446acfcdb375

SHA1
d7f57f9c16fc8ccce80764d458874fbb0fd5e35f

SHA256
0b48324db74fc28db8ffa9bb0ccaaf73a10faf43a431b0e99554e3821d0eaa7e

SHA512
7a4f8c055267feba05257c544e54115109ad30f4c66f6d593b096fd7e6d2f3992af316785f83c1c2c3f100c8b6b2829bbcd39bdda35b33ac9ee716f6529b7a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ffc52541491cb0221941941b744288ad

SHA1
fd879e7b4cf24ea771aaa698132f42d6985ea1ab

SHA256
e7a2e402e9feb2fd1643a35246f3193b7dbde08d43f1d3890edbcd4a02747ccd

SHA512
6e3296e422b01019302b7efd20c0ca9088b6a363f2f31899e7d29c4d88c753f53313ca7235fb6865c8f71faa33d70740ffdc787ce005e0f7328c79bfc01dbc27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
1096a2306cbd4eb7d4883958581e8544

SHA1
2ced577961ff2f6dfc0f8167ed794f0bcab61525

SHA256
bc62e5910cd1e7bff0255cd00b8b3ab84cac3ac7cb872920041588d31ac74087

SHA512
2382762d07c1b7b146fef045dc660401ba88a087cd22d8cdec8f259d3cff596987aef83d0315d1553f4a309e10b703a81809ec6e7f0a5882e88c2ed2358a1c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9d14560cc68dac4b0f9e745a6e926c60

SHA1
a22b6082ac9d172a441ccbcc8f68d01109b33777

SHA256
504b1c2508fb658de3156923c8eede780ddfbfef5161b51c1c24464deddf3326

SHA512
466df6b4b048a2838a1fb7dfd63e6f586338b6ca34eac9a3e89ebf5a7e69ddcae96eb88f0a427adddaf6ed29c9f5d8790c949027633ae10c64014e2be4fce243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
cbaca355791026b1beb0c631e23b082d

SHA1
3e984b5f42c2ccb4ebabbd94e1bb80ca39f1b951

SHA256
71fc59e877e7f4601bb7c9700626884f68750cf22acc8b9f87e683e7f8bc5b28

SHA512
a316ca7fb06b7bcfcb66000f35750e9d7781a145e142d2f01332cd3628dad1f2c28248a560381c49f564162ce2d060760311643347c8ccf427efc61aec90273f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
754d25895afe11a2b3a1674c1461e227

SHA1
df7df2eb66df19ab9db149c946f10215fb91f1cc

SHA256
6be9d02b2c0077345ccee1b1e889f6e0fb51e9918e4cb4da0d58123d04efe77c

SHA512
524f91aa3a0b741588c9db9db82bf51c6b1b8611a1bf92802ace7d24d87d095ce8dbafc6289b9635cfe305ec44d5b454fc8709bb22c09f836ba8752c2c8fdbf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
edb0b5113c66e973fe91b3b23691cd4e

SHA1
170320e53c34001a4e4bc31a42c501622c63c358

SHA256
21db6c186cb55f7a3bf91c38c580b6f7551e3b039bfec4026801114e5f96cafd

SHA512
f994b7bdc02522e9495e1caba356990ee7fcb11675a67ebc61336f58fa9683191bd4809d966e38d966067f74f55540f67c4b23418e6319291d5ba18ec69aa8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32f5f15245bf1be7fdfff507f9f86aa6

SHA1
2093bf67a3d1649fabbf65cc37816dfe5096f034

SHA256
97741305e28958da66135ccf6c5cefe6d64fa6516de3d6f3b45b744078b0fb86

SHA512
d39668b2bdef0255c1450c317fa0f9da7e2ddb010c8683f3633918728d72c4ffd6dfc8badb2d5adb196452510896dab7e8b15615518d3abad5334fe4fb7a1456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6553eb65fcb52da8c6e20e0dc6756201

SHA1
dae07c070c50cdf316901e3585ff8fa4d283b7cf

SHA256
5b21b09acf4ab5778b41a835939bc08c5a4ad0ffc0cacbc15be0dcbe52611eb4

SHA512
43e24626665c0f719f25fd98c62b35e32a676e243fcdc2309e6f2aaada2eb856a0d51385d0df44de9aa4e29d6e726bb06b25dea6f437da204475bf309af79c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ba0289d034a1c9387b904ca02492e5bd

SHA1
a4189c2f40066ba66f9faacf70aa62a19f6f0a75

SHA256
11f2e648eec84b646ad3e17fef57f8fe4145031a1542a40d5a7aaab2ac4c45c2

SHA512
79fd04025483d6aa4a72a6b0e81f92b144763b33b83f7e045f22fc2f594424eeb206ad001039438eca12416fb5727741731d1c280b0d8160ee948dc1fe4ab604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
d532285bc5f02a868dbc53e9a564c777

SHA1
4827b99834f97b40a18f1c9078362d87ec26db30

SHA256
f4e5b4a76c4d294ee7cc5d7d39df78684601018b7da3655edd2327cb0b62385b

SHA512
63abceb40229aea3b02815b0182faafab4d403ca7544a31a9cc5faa69cab074fb8159d5490d68eb2b6fcc10b01bcc4bcdd97d0067a9919391f456f972e0ca7be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581393.TMP

Filesize
202B

MD5
14861e204fee9cef0184d1057e253493

SHA1
d23adc1e6b247c51a5f37ccb29269494e6e82017

SHA256
0021be72e7b5fb75291d5b298fdbe306f4fff38abbfc8429d4b26a7b205ec24d

SHA512
da6d98f91fe193aba2bfcf2f6b0b58fa06253a1779eb1e8b13029e3268c201a24612f251465432b7bd7b57890f2f397ce7a7848449047c83e5c58117aad6270f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b55b871c492bbc86a0a4338287d3f5b3

SHA1
55552c116f2eefa5051f6d25c9175c73b3a40655

SHA256
50d3904001fa7b0e344095d07ab81205de7ac1ec7a7c226177fee1ac3a29119c

SHA512
db3d548262b0f0426cb06ddc577ffa7269bb00eb00d6b0c1df0cc0b4cd7c7f3190e495c5b89a82401ab66cfa541758e1db013e0f36691ac5beb0a70491e94bef

Download Submit