a6f93b306978afd4b860a02a786f0d612f7a62e743abbcaff0ec2dfe55f5ef90

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c82f337eddf8d75d01eed2358d662c9_JaffaCakes118.html
Size

108KB
MD5

0c82f337eddf8d75d01eed2358d662c9
SHA1

7df155b3d1e63708bd8fa7c565074f4612dc9fb8
SHA256

a6f93b306978afd4b860a02a786f0d612f7a62e743abbcaff0ec2dfe55f5ef90
SHA512

31d377cd33473808e299bc58b467ae7caecad53f3b9208f9bf83b6cfe8275c974246b0d80f6dd76c041ccd44eaaf089a74ceb520859a157db09b37a48071f958
SSDEEP

3072:7UZ51eoPGz7Np1C+4/aAXt8M95EDd+NbVATjAmBn2hWBibuWP+0JZH:YsoPwp1C+4/aAXt8aVSAm8v

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
1376	msedge.exe
1376	msedge.exe
1488	identity_helper.exe
1488	identity_helper.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3604	1376	msedge.exe	85
PID 1376 wrote to memory of 3604	1376	msedge.exe	85
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 2424	1376	msedge.exe	86
PID 1376 wrote to memory of 3844	1376	msedge.exe	87
PID 1376 wrote to memory of 3844	1376	msedge.exe	87
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88
PID 1376 wrote to memory of 1660	1376	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c82f337eddf8d75d01eed2358d662c9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffc18ff46f8,0x7ffc18ff4708,0x7ffc18ff4718
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,8488951096756164718,9212809371495085399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
2b6b9460faaa7205baedf7e301cb9acf

SHA1
dad064985792605ef5a1dcef56e9ac4b65144cee

SHA256
0eb2daff8646e3560bae712cb3439c5558d6efb1dd08bf43ccc9f07fbc97ecb8

SHA512
eafc48b46906204f44a2359aae6478870c3ec7906920baff9a9d49c2ff23bcf3e94945a5ab06f80be01e9c7759ae1287bd0895a92febbc074032a828f4b78f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
12ba570bfb7516cf1ea9ccbc64f4065b

SHA1
423be156163063f0dc3129453fd145e6ca01de42

SHA256
d67f3e2fea06e84c9e30bcd0012f26dfeb8ccc404b41d5db121820ca15119336

SHA512
eb3e41735690875d275b6bbfaf8c01b2730b50c936bebe1ca0fcd105c3970de213072f4c74a996d61d72b61f7e7dd7742a233cc54b02aabe73e0b9dfa28f54ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ac0f879922c284ceffdd3c2a732a50f7

SHA1
e0bf918ae8c404ff613839155e0988cb6fad7dad

SHA256
ddfbacedeeafaa5c8ce54283dfa829ce5c3376c54e2e29259dc7f1f71ae7f6f1

SHA512
e71dd3c88865ce3845f457ba2b70392539ee88cc7531421e13deaa11a64284f874bd9ae25f9f4d87167c114862ff4f0653cef7b6494450ddabbcd81967660644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ef963ccb3bb7d796b6fcd41bce4a05c2

SHA1
a003229c4ad8e9c3bd8bf4b71c9528c6d6278f9f

SHA256
b7c5ccce0608aca44d58bca93bdb29ac99a288661ce9c3e858e09c4a393ddcab

SHA512
6fcc1de05995f7da4f76397febb92468a0f2b0fdc23eda1b084ffa90f2f777621a90847558fac31721a4a8bc45e78cedf34f170bd0501e3011682e8cacbbf1aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f8a7ac33b6bc7fe8a22502de55c3bea

SHA1
5624d676a7e7440eb0ff2331869a2ed996aeac7c

SHA256
4411e51243b92bc57a4c7d4c37828fd998257d2887fcb3b76dea5570c1273d3d

SHA512
1dafb6f27ce94930136dbabf2ddb73e6f78d9811d5e23dae160a1ebd3c86fe4739e5afb45575c1c38b3fe2da39a558d42e6039afb8c3164e7972c979d4681231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a33b5d4ed39b79577172a67e7ffb111b

SHA1
da1dc73f47d1a1f835207cb9e2b3bd9fae800968

SHA256
a7e251797d35b335ea7e12748ae3101a7bd1b77747066736c423503e5373dcc0

SHA512
9442b5b27d79e26478badd6dd45c78e34a043fd720b96a4656b1b7b4330dfe7b604b309abd83c1678c4c78ee0bc0e20b0602daf9ec55711d960e2b4d83d83024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
acfb3d75fd726eeb3431bebd79b72181

SHA1
c5427f0ae8e1abf01670de9507ce305a7d1fce72

SHA256
a84c55d7693dd8fdd55ff26b77681e4f92d489e63f580b07b968bd7495812bef

SHA512
ebb7ad8894a757fa7a832537bb7357c462e5a7cbc86d8ecb5b7d0feafabe95494d770e1a69f4a0a078134a6abc0a570e362827f0cc26768ab62e4c4a05faa277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
b86a54d396da3ade0a21896a5e605528

SHA1
c2273162fc6ae454f7ec4ea860d3ca2a428cee99

SHA256
f9ddb20391e4d16116238f68ac131ff3d0ae0c13497824fadc68c2f8c5318f03

SHA512
69563d0ca078b51fa8b33b4a11ba9b97ea7cc87d5faa0f8e5663e5b33a35b5e7ae648e805dbf63fba6e8814df7d9ea253d17c54ba4f7eb1ceec37cb5431ef446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c747.TMP

Filesize
203B

MD5
3e6115d843ae910dc3b91f27679ac43a

SHA1
e8dc8c619fbd21432af397e3a5573f96783155b6

SHA256
83b72e575c9f74930dc6d83eed9579a2e828778ddc15bcd531c616a4b085bb28

SHA512
7e763dbe4a27e280b9d252f293f93e04494fb2cd236829453be0d00fa0c26e5fd5ac5a422506d1107919b05c8a19ab2400a7db8535c163dcc53c0d5fcf0f6713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
280f0c6591da1d0209aa1cc20cfcfb78

SHA1
a4d3de53168635ea78d1fe5c3261c36f4c9941de

SHA256
31a2da74c32a9d3ee7dc11e30675ca75a80f8f6845182874efb123be56ffd3e4

SHA512
bbf70c7930b7e0576fd113e62430f71dbfad1d0a31643a6fd2c9b858a7d4dc97bc75d32fa7100da6c30a906f9ac8c029d63c16deb8410a946903c93983dd90a6

Download Submit