af777b358d5e05fb2248ff338db94ed43f667464adb5631b95dafacce23e9dab

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9e4baaa353b57cba940bd2bd00ade4d_JaffaCakes118.html
Size

66KB
MD5

d9e4baaa353b57cba940bd2bd00ade4d
SHA1

440a9dacbfb1a2595a2b58c4fbbc5826922f85c9
SHA256

af777b358d5e05fb2248ff338db94ed43f667464adb5631b95dafacce23e9dab
SHA512

fb3c00d171f15923131cbc37c9d11531b73dd061ac206d9a6171b8b42511a121f233c0e20513d56dd71a4c537bc0904e7cb1a9fdfefafab810729d3e15c7eb6a
SSDEEP

1536:HMk5hP2z2CNolA/RsAPiJ89rCX7CesY8seTGtF5D:HX5Ny2eoG/6A669rCX7CeiseTGtvD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4244	msedge.exe
4244	msedge.exe
1948	identity_helper.exe
1948	identity_helper.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4824	4244	msedge.exe	85
PID 4244 wrote to memory of 4824	4244	msedge.exe	85
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 3156	4244	msedge.exe	86
PID 4244 wrote to memory of 4628	4244	msedge.exe	87
PID 4244 wrote to memory of 4628	4244	msedge.exe	87
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88
PID 4244 wrote to memory of 4052	4244	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d9e4baaa353b57cba940bd2bd00ade4d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa173b46f8,0x7ffa173b4708,0x7ffa173b4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,617262466235924358,8558960441125487490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
23KB

MD5
abc48fd7cd6c006eb9f9c5719748c9ec

SHA1
1bfee875209e5a39e65213bd25322becf223d1c3

SHA256
862e5db88bc456d003eeb9ecef6021b12a7313427596ba87eb4771020c658f93

SHA512
62d9cd90cef344841d5f5acde94583c36d8541bfb6a61e72b6152d2054770ca3e056d702dc01fe7889a136972a12ce92057d84b9e9082903504cce730ef64594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b0898200e6b33e9c6c6c76c9f615cc09

SHA1
1729fb8996a64e2e339cc6a182b5af22a2704db8

SHA256
369d284098beaf2e29c9ba2b8b6e351f49b250db1cc0bc7304fc2ca7ae9667c5

SHA512
14e74ae807387ce2e73675d8e644346e22a0cb7445174011786bf2670dcfe46bcb7ae4a2671e38f77112929f03f5f0b4d1b9046bc248b025b539abb40db3f46d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4ea24acc943f7551de8bbeadfdbe288c

SHA1
36c81829f7a7f6ba50b049dc4059c83b0a9dc3f9

SHA256
b75c41dbd49451d2208e7f4c838d9221fae1329d1410779232d3ccb0520373d4

SHA512
ad1e9bd55455fb346181ba8c774caa40864703fea8a81444d3e68773c46bdaf227d146a00e77f237d1aa35da88217f81ca7b8ec33cb5c8d2c8a44bbcb3439125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7899e597300aec6175aecc96e72eaee7

SHA1
f2ee6e3593cb1b93c1f6a83d7866bafb58ee9afe

SHA256
05c9135826d9adee8ce79e046dad5cadb27188aecc1015ab17329c66f08b19ae

SHA512
0c9dd686b21ade78cc391427426bfd5952c2fb033e5198fd5ad11b53a8e8dfc42c737f038cd25c2a67d96551a11e5452266994449d540f1418bdb44b8f92eb71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c77a82df2381ebe173f407dc28991c6a

SHA1
5ef3d8660397ae5b38fdf56ff34206cd7a381a8d

SHA256
335b240fc3f46ea9cc340eb27a0dd284ccca4fc165cdb3add8ea0cf219f797aa

SHA512
fecdc60c88b23a98414411a3db5116b16da79e0c84139b37c2524704e3bef465e51875e0fdfa8df2b1a97455339611cfce679402b9eb0c9840a87df0356ed702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
de77ad0412e1dd71fda4f7d011b8e369

SHA1
b863dfa1f053558de5bbec826a611e3ea0dddb5a

SHA256
eec522b9b573663ca230ab20ef8a1f1275378dadde26144957192ce77125e7f2

SHA512
45ae9cf690db1ae6b227c1186d2844365e5e80ff6ac5467942febd94c62d2359d255b4c641429d29826cb0e777aa10b856bb6777535c79d61f41c32627c2e828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e475c1a1e44e18805a175a73bf47e79

SHA1
35c18f5e742c4b36fed76970d521a51d8e3386ce

SHA256
79f0aa2bd0560c3f4170735856e1e3a30c64149315b18922807b8a8eea731a16

SHA512
269562b591ec012572f9593bee567ffa078a06f27e8a610a050a91bd92a5253ab329767fa70ce96c4ab69b5a510cd56c9880ec72e881072de4d4f017596ce51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
87480903f597d4207a6cc80d94a43d18

SHA1
87ed7537f747be6008b24a06b5192fddd23ab7ae

SHA256
adad67687ac5aa1204a059ff0d1c4cc2a12c46d1c3d333b1c5106dfc9b69e492

SHA512
f5f4a5c010c3e03f0b25e1b9aa85d04b02fa4bba8d072ce268f1f63413d87951ab37c34c8dc0b48a653b2c1f9dbc62b958e5156d21b38920e4c320552b47ce4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583004.TMP

Filesize
370B

MD5
831a17bdbcdee95bbd70263e4363827b

SHA1
0bb7fe468c09b6d01c77d2c9b45db8b6d443cadc

SHA256
edf7155a6ff1df449b2424f6dffbd4f36c2a8339c13ea14da2c5b74acc7dae5a

SHA512
ddb2a800fe991f963c229822d73c3a91eb92df190ffe77cdfd146f2a0c1861fc163531e9f8da1b568800f34ba75d6cc2c1594dedfe9fa357d826587431a398d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7540439ebff2f1f9ce629e24becc8ad6

SHA1
83335cb3da4982ac9359803bedfdbad70c3f30c1

SHA256
e8b3a67011556f90cb0e80c2c49e3dd7870b385c27163d8562dc1eb18c32393c

SHA512
6b7e084115f1ec4b93b87b7c6af9937fefdd500b761c151704d67d252fbe73e04c81938e3a9001a4a173848e51844c7ab5657b6c3c5c1688e008d2e29d6c8ab7

Download Submit