c477dd8c8021ca7e48bebe71b985e79c36f0f71fd3b92d6b6e4c2ec05be40d28

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

066c6cf004d7fcbe53b9e678d384804e_JaffaCakes118.html
Size

79KB
MD5

066c6cf004d7fcbe53b9e678d384804e
SHA1

0c44709a06fbfd3a6e32e5c9f5b53b232334637c
SHA256

c477dd8c8021ca7e48bebe71b985e79c36f0f71fd3b92d6b6e4c2ec05be40d28
SHA512

d7031ec16f6e5d6d4501f6ef37cdc1e00cca9b3833667f35904dc40b27a617246626175da64c611e6bf31b2d8602d227a3fa04cde216db746f4828c8889381c2
SSDEEP

1536:Q2tobDeCB2NTR7jRD5YBprzEgOY/TqAoddho8FvdoVtpAkxc5Yu:QbbDeCsNTR7jRD5YB5zNRqAoddhxF1oW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2596	msedge.exe
2596	msedge.exe
3964	identity_helper.exe
3964	identity_helper.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3564	2596	msedge.exe	81
PID 2596 wrote to memory of 3564	2596	msedge.exe	81
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 1272	2596	msedge.exe	83
PID 2596 wrote to memory of 2568	2596	msedge.exe	84
PID 2596 wrote to memory of 2568	2596	msedge.exe	84
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85
PID 2596 wrote to memory of 3160	2596	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\066c6cf004d7fcbe53b9e678d384804e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd521f46f8,0x7ffd521f4708,0x7ffd521f4718
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12333663113667727566,5075431740663237486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
fc61f5710e2731b4d428047c5bfc8ebc

SHA1
35c28331a59201eca6bbeafe98ad3b02de4f5b7e

SHA256
b0b22c71d40a61ad53adf9d2a9376429010ff704f19e9860ea817dabb20115c9

SHA512
3fd901ac62be5db97a8d3e7b62cb4ed1ba05b5e88e2e7814be1cab6f4af439c9e584778048cddc362fb6937286cae2d68613adcdd3458920ea9dc60f31758625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b21c08a3629203ed41af0b5fa2b5bafd

SHA1
06bc63d21999e0a05274483753a315647c7cdb31

SHA256
ee1cea6ae42ab16ac4dfbdeb835ef0b3b486c707bdc75fffd9ecbc5901849280

SHA512
611d07b1b9b85c288eba677a13760e7566aef3397e9f6373ec538a6cdfde1060a378d902ff862fff4c772c622ea28372f756c4ff3336ffdb2a32ac555ac7b62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6b90d820832f52149e6f8cc5d2bdea9b

SHA1
a8d29fc1a7a3aa4fb3a1f55d51dc5b4b8a61e717

SHA256
cdffe4fadeba4fa12995b28a5c70ad45aafa936061bb6b247ae5364d521e145d

SHA512
0741d385e509c8749f24857a4e32754fa8ac165d9ed4d839a6aeeaeb5401949c5208ef1f4f32b50e94de3b03b4743630f97d2a850b00d2df83a71b16df997fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5a11f26fab475c34c4dce7163073ac20

SHA1
d76ff09f8a0ad93de0f87caa4b5153a8f2ad48af

SHA256
a35c666e53424c3d5afbbea6a38e7f7a0c7d2201e759a42154d9834c6d5f58b5

SHA512
1dffa2655285f5dd455da8caad942689da121dfbdfc6910430b056088a6225860b49268ce0ea7037b918eb9fa57629de3af981958bb453225efe88067bd2bc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0fb2f73ceffd79187ae10027d1741b62

SHA1
7a9c771a247bd7511a47d57ba4422af7c372a151

SHA256
7a4eb2d499a1bdc2a3d89d6faa64fa9b2f6a4c6c603397f3c35ea78369cb7a8d

SHA512
fa1954be53e6eb271e3a7d51bbce1198fa3bbc38965e32df1c93119c7c996a68d4853188bce7c1d266451277bea834b02cc75c1eb2d884b42393465e16c05b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25b601ea91514d9c2278cfa2a87e1394

SHA1
a8319f000ceba61592e83ac51d9349ef68eba0c9

SHA256
f57926002d4177b3db66587164a676da84ae1206ff6cf0330f9f4fcc70d53526

SHA512
98b218c02e269aaec29af2c786dc41b6393726071770c72ea8ffbf008b5efebd249b6aa2c0db8ebe81d2930e352abea89e2ab5c28f0e670860db771a112f1470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
653133fd7fd9b3d65ea160b6473c1348

SHA1
8c32edc2761cf962dfe7d5f086c5245b4298ebd7

SHA256
a9bbbe194eae1ad06b92cb81d0afe542c3c0c53c6771f088ad93d9a3bcf5cd6e

SHA512
b5686a930e2b3ce1c42032546ded7bdf596c06394af9b7780d755ab1e4896e14708d651926f3fadc8917f495559d834bb5be206b7898860de399358d0b538351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
160bfd2845ef0cdd50656c20edb3625a

SHA1
e02da77db671a551757fa1b1be8c5a7269c87b1e

SHA256
a22f960302ae467a5ab0834241ddf8243cb04b1f2b68c584c4e3845abbc49d35

SHA512
a42dfe729d25695cf92282b8ed425606c2628728828fef2b6efeabfccabca15ea0e1ceac9a0ba707b63a8c7a408c7ee60d47b9480f7c2b563f62f4271fb593ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0bab3c6984e41937440c0fa08763b4f

SHA1
ec6c174e93729503c1a38023b11b018ab925232b

SHA256
9c72d31dc62bc1bcfa6f3d21816b5a63d42f06ae2b02b5d3853b99ae5bf247c7

SHA512
e1baca1cd3c4548eddc6604bc3518386e96a75adc3b9329156e4bc7207f7eae5ef6055a3a4642319d7aecdd53cac5538ae901648026bacd686aeae546621479b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d63502694620a0be3ea831e1fd883881

SHA1
71746d08a32e9425f37cf7ddf81fd8914990f8af

SHA256
e4129913b0358607066c7c018e0d693f428d5b1f22ddb3968b67aa6eddb2bb7c

SHA512
802942dd2f7494ec06091f2d16b7db739fee514eb392b00ff27413afc17a9d82e74edb8aa93501532d3f08d2e0a550aab98d97f3bb7093f6a4f28c039bb9347e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e84.TMP

Filesize
203B

MD5
3993f28e3be122178fdff84f5920100d

SHA1
f66f18ad30bcd15cb643c7b177dd22da6397bc4a

SHA256
588842992763a74aba088ffb9ae5e3fd2020100d965b1ecadb9667de7e17b9cc

SHA512
c6e465934a0e9044c46d3edbcbf2754b83fc044cd930d1903d27c415dc6ba5219505cf63717a44b089c4b546bd01e676740722909a59534d9a53640bb4b62a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e52c29612af14e830dbd08dc8d8ddd7

SHA1
571dcf6e32cfa52c1158e79baef07cf2d6bf00cf

SHA256
0f11f943195448a68493545ed5d5da700f6f29f85ad8de75f663b7691a7b4177

SHA512
567b7242b91f6e0c7ed1bbc4b2efc23f99f056fee9b3c279c385f83b059c5e981e1ee20437714af0511c8038b6c0b3242b3a6e0e442b3b7b3aa9e634c8322e35

Download Submit