373f5768b0f8d285f438db49935294881a52946ba4454ec783803ec3e69139d5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af176d95fcbc4d9683f7750d42593669_JaffaCakes118.html
Size

218KB
MD5

af176d95fcbc4d9683f7750d42593669
SHA1

5c317cf34687d3a487d0a3834f4a973332943cb0
SHA256

373f5768b0f8d285f438db49935294881a52946ba4454ec783803ec3e69139d5
SHA512

d4429be840dd7a5c8a58db9aac966943ff6310dfca245b91b51d0cf240ff485a55c1014d25877181905deb2f533e94da7b8b272cde636851e75293c489aa45f1
SSDEEP

3072:7okclLFodthxh8S0ijgrrGVS2a4CeFMcRRBGgscnRyLBSdKBHCusR60lCqbuXFkp:8kclWyMS27PtX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
3904	msedge.exe
3904	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2100	3904	msedge.exe	82
PID 3904 wrote to memory of 2100	3904	msedge.exe	82
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 1148	3904	msedge.exe	84
PID 3904 wrote to memory of 1148	3904	msedge.exe	84
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\af176d95fcbc4d9683f7750d42593669_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff877f846f8,0x7ff877f84708,0x7ff877f84718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
84ba499574a5c948104ae4c7bd001c23

SHA1
03c26d9cf60068d5ea0472f764b986fe9f5dbe0b

SHA256
e353c256353a8a893da6e5019eac66d4f545cdec782d9ff426a9039b43e67592

SHA512
51ed1bb24b2316fc38c1a9c2060ad2c5f7d87897e68ca93b2cacad6144abae52c6897ec6719018d93488ea119ea8bd5b60597cb813e65422dc31b364b7f3007f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fc83ea6c30ce8196ec9e15978b467e19

SHA1
c8124e421b1ebc291333aa08e0bd2d5080ff7785

SHA256
b2a0aa1f9e3b648ad0d4bd3ed2350464d8fd4469ae4d413084d39b56ce8e9762

SHA512
22bbc0acc4d1ff0a69fb35aa56fbcebbf9ac251fef46301d7cc058fc0f3d125c9f95c6c1158b3028404277cd951ece65fcfb227af80b52d4900ee59c5c1a4ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6632039cb24c3376241494f3d54d7a7a

SHA1
f0d08e366bd9cca7dc9e7efbfef0115cd40b0cfc

SHA256
615dfd4d364a9a832f5d7044c6af880948555299f2bc4d4c344ea91b0be69e19

SHA512
c4ef71973f994b0b3442cf47083da453bec96d60f064f0910b167ab3d7d68d3cfab4904d75c044d6cbf2fc0969ab76e5fce2d40f0660845b18626d4f7a4d25c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9a9e5c0614c2cbfbf15b22381f4a25b4

SHA1
85bd4801e67d4d8c91caef548adfca25b20b4026

SHA256
dcda35c89eb5e8e91fc3d204d68885f263ee3807d8bfccd28037f3a41eea05cc

SHA512
aeff35dfb19a9b49a2264434c02b0e018782721ac0ac1ab60b0d59773688948dfddc88b98e2fbd4d810c392137753e277edadc7a6bdf7c6d8c0fc29ddc2fadf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba70dff2d47c531b58b51bf4de5d3ebe

SHA1
71991e4188ac65f20e297ddcfe3457f30b5c576a

SHA256
ad55d0d11590e84d37562f77427d440e7d657585c8741ff17f97ab49e717472d

SHA512
1c59fae1f14b64c97aa2b7c347ddd4378fc405ec97032876827022abfb45190a6fb8646ca487587fe0e4811074c00b69877eb6f484bcdb5b56f1592bbb16fa9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d435e473efec9fd1c8b8f2df946d193a

SHA1
8cecc6ddd71e44e0579211b1be922f78bef4bcef

SHA256
88d6867a924dc54c0a3b1d6e32dcb9e24477b8409b3875745e2a36d343efe736

SHA512
7aa013d806611230c301c6d194b716c2924d9b3c5c148f76c68bf904fbb8cd517a52e1ce7e22aaeffe9714aac9eb4c6408d05e92efe3c6ddb3bd00a968ca1f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bacab0e571cc6ff3bc1b48c9d222fb33

SHA1
d979f5e87a9742229faaddd9eb84884df8b7966a

SHA256
6990e091828ec8597066ebcffc8a8abe5368fa60a830ab31d3ed99d01522ea15

SHA512
0bde4381d5dc8f1a58745730296233fc54fe724734689d7ec2473fc106969c0fcd4d2349f356ed74520c09a89aecf7fad41407734f757438f384d5379d8c879e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58461c.TMP

Filesize
371B

MD5
a91b0b210fbf6a77e85448ca0d7e2790

SHA1
8c514bc5e997d71d0e971686395e18768a7b1aaf

SHA256
b26447635c3fdf7dc043b2729c1db43d3846802b1136a23033906fc88d2c790b

SHA512
d8685af94629ce8b0bc9a7c0b0da284448b48f92b40d57b96a95476f2d5b07b7bebe3f8b5a9cf0db5b6335582387cf0822bd9604ba29dbbb20af815906cf6aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
de566dff5b3d40c1d6c57b539e630ba6

SHA1
edf5231dc77ce86fae1cc6955f0f32fd90de6231

SHA256
3f2cfba0710b3c89d4519e1e873ca521bb78ef3656058dc1f68612e0a5388395

SHA512
47ae7069016b243fadce40b5a08d211e04e3b1bfc873829eff52717963b3beb2fd4559e9f9402012e3065816236a7238f19bb08ed09aea31edd4ac619432d587

Download Submit