fb0b189acc6f75d161332d42b7808640fa75ce5fc22f7fcf87937aac94d2549b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2024, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec8135823ead5c4cac185e9584d692ac_JaffaCakes118.html
Size

199KB
MD5

ec8135823ead5c4cac185e9584d692ac
SHA1

f38a0c8059292aaf0883bf16f3be7f5d8804be0f
SHA256

fb0b189acc6f75d161332d42b7808640fa75ce5fc22f7fcf87937aac94d2549b
SHA512

076dfc39dd7ca0a103f78bea2685addb79d6de2932e1a28f686deeb376e8f511f75b6b94176702bdbb0b2dde63090e64c7e407893d669684ec4b2984327f4cfb
SSDEEP

6144:Kt3cIIIW3G4k5QhL8atVyiVQ5MIsuQyf5bTM+MdBXpKgXpgx4t48O9mge/bE6zbB:GcDd3G4k5QhL8atkiwMIsuQyf5bTM+MX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
4860	msedge.exe
4860	msedge.exe
4912	identity_helper.exe
4912	identity_helper.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2672	4860	msedge.exe	83
PID 4860 wrote to memory of 2672	4860	msedge.exe	83
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 316	4860	msedge.exe	84
PID 4860 wrote to memory of 3104	4860	msedge.exe	85
PID 4860 wrote to memory of 3104	4860	msedge.exe	85
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86
PID 4860 wrote to memory of 4220	4860	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ec8135823ead5c4cac185e9584d692ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce47c46f8,0x7ffce47c4708,0x7ffce47c4718
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8567815728555715340,15834505865805788014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5520 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\626ba276-8332-4bed-ba10-135b4c0506e6.tmp

Filesize
8KB

MD5
aa256226d9df085972aa797163467e1a

SHA1
89a673318d30abb47c78ee11b4810a07feaaf00d

SHA256
f19e7d660709c08900413345dac240b6e8d96b03cb3986084d81df5a32365c66

SHA512
bffa7ffe7a4c5813ef69798cd400d25be8d77c860319b1100e69a9fbb97ef3f71b8f12f4f6770eef6b28bae526ea6d61b97a4bea763716141d4edd3b920da84a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
c5ec28d2fe96629bfa6332684fe2bd08

SHA1
e2b79bc4dd5b8fcfc19e4487da89cdaf8acdac14

SHA256
b9e2a4ba5c34b9fac56cf45dbca9c28c67982bf85f7280cd71681fc59c418cbc

SHA512
8e9109297492f6d3c73c03c56fb023f33bc5615fb633fe466e86875fc3ad145d1b9c01e05383e8d291438df3ba6dd5ed7a381369e22927a15d8dd543fc147e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d0e9ce831c142b6c3c85ee8cb9fa9ae7

SHA1
876ae7d90c2e724399f4054add2f8fde030b7d91

SHA256
cda1c88a2b3cc070932cbcdaf30ae709a8b1a80a6d88620ca5082e507f5cd27d

SHA512
71bbbfae88e90228a6cc5863916dfbf6b0511f160b86d067e6f9214df86c241d4ac0730b72b2554af8797b3928fd0705f2ccf721dca56220cc83e12ba5e41702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3b7d206d566fb062612abef923b0c624

SHA1
52599137696c136b1e8319710072d8b56da4fe80

SHA256
379243d9605ce8259c458a0ce048fc23cfdb272ef2f2b7d9ff23ceba606eb6a4

SHA512
7a46e471525d22c8a71c6d8c29dd6ef5430e1010bc2f85077020c5d07be294290afe9fdc027bed9dce1e6b1e5333acd54b1f43fe87ead7b952b3f62c9ea1f5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bcc0e55d740b2fd8ba14cc830ab272d9

SHA1
72319b173152ae63a4dd8fa2e79ef1be9c951b31

SHA256
6706194909bb50aeb3c48b808af7925a31f4dc3f8c455e10b180b65c4f841138

SHA512
a07c30e58b41b0ceb617435eb4ec72185a753edd63448776a31342c83a1c3b7827083fce5354dccde6416c3bf6228f15f27f8412126cbacb5d9ac137072bdbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c33671801f4e2726c6352470d6be0d7f

SHA1
b77b7e3ffe48b1452b82ab17d358945e3f3cfe32

SHA256
6799bd3c5dec353d526ec8904ae2eca020f4239741e21e7f6df666b89cbe290c

SHA512
f10a0f5a4a5a3eb6de03e9ab968b4e5220d54704d5e8b056414a88188ac9b90990db878d4cd27800130b3c148a1a2c74e8a86e7bf7fb73f3a2b6192b89e90854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
708241c699d7659b31268018c1e0761d

SHA1
222662eb2d16575496d6e1ba9f0e3735b93b84a1

SHA256
69ab080cac0bb7547e244678190243a31d303b0e3fc4c1960ee81a2962f42074

SHA512
59fa4c9a73e3fbb85808859127a42272e7cded6016470818f2271b02873bee829f4fa5650452c96d4dc013faa6e61cae745bcc1a7efe88618b65a13e16df63f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dcf3136f4bb39cc00c4b471a69d86774

SHA1
943d6a34792d751f9ccc5229408ad2b429b09ee7

SHA256
200a131307fe19002bec38859b63520e2d37ff2013e07e6a5a35218a620f6356

SHA512
a2892549c6aa17d891aa728366211c63902803de556b98dcc0f94c4b59af2a7f79f96dcdbd497fb05eeba4d28fd1c9de1ae58780b5d9141c812bc5115fc4570b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d7b91ea804a8d5530d71c10cb1ee8eb

SHA1
257be85a7b3e29f954e007d08c3ae44be18e4761

SHA256
36abf859966983adb4f607060808735893ad00663874ce94363a154a991061a3

SHA512
a69cb1b2f4991297775acef24c457ef4d429c2f524a5e3cd93c90683b2da204529c30f6208d6d41e4528080001d9f11e1caa94e02aff8a273195262bf12e37aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
9359db8d18ca9b077d7f3e88838ac27a

SHA1
addbbfa3f49df6b6e4081f671e453b0e1d3df9bc

SHA256
eff5088a8daa31594203b852dee86365b3fe0bab24d76b63b3a82098b029689d

SHA512
6c5041d519d5ea12d1a67caf97cbf9afcab25ad1a9a29d0229e329111bb6cc788e3ab3e44ad1b13b44279749f5ed5a8335cb50cd949158f5b57b04a9a9ad66f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580450.TMP

Filesize
203B

MD5
6a24e60a6dae736873bcab6ad550bc18

SHA1
c17d1c4467a2bf704339e28bfb7ea8e0a3a71f8c

SHA256
be6a0c31d5ae2c61f4978c7814aa6f35214cc8a6c282d27467a2255acac8f886

SHA512
8957f93cd79afbcdb1758c8595b5b34ade263524fd860d324f0d60e71d8c2915e4edb3ab810ed4e342fe62ad8a0f0a42f2ef25c68b772e590e729168df4d6d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
39c175fede307c44711f094cacf30345

SHA1
91ac1e91e296f7deb18b21c017f1b9ca1401a935

SHA256
994f0c36d43f7e4b68a1f14540e27512f9c1ac7e9ff3ff0cdeca00a55d20e6cb

SHA512
223fcb3293eca486190a6d12cd90997eb3b476f590215abae95f6bb903357c4695c95de8d1d9d2c4e91bed50eb73675a547be9076f926e4b1d70736f5a93c026

Download Submit