11330d175b2993dceefd48e563ef0f77a00507dc1a7049355f3e818cf27ad18a

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1739072fcf7390c4a5d4c66e7565b1b1_JaffaCakes118.html
Size

113KB
MD5

1739072fcf7390c4a5d4c66e7565b1b1
SHA1

158ce2c13557aaa88b710e05452291577fbe412f
SHA256

11330d175b2993dceefd48e563ef0f77a00507dc1a7049355f3e818cf27ad18a
SHA512

2257aebd72e4918bd0a435a00608851ffe51d2cfeb0d3b148b8ec19821c1cd8f197e8d2db5624bcc7f9a4ac173f3e4fb56ee099ced7b34d1b54f831a197bdce2
SSDEEP

1536:na8jXafDgC2QTAFZtguMEkua7HZkCpl701QaeeeQ4eeeOHeeejUxOApDUYK2Vxpq:na8jXaAXtlMEkua7HeCpQiWBv3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
3496	msedge.exe
3496	msedge.exe
3060	identity_helper.exe
3060	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3448	3496	msedge.exe	82
PID 3496 wrote to memory of 3448	3496	msedge.exe	82
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 2988	3496	msedge.exe	83
PID 3496 wrote to memory of 1660	3496	msedge.exe	84
PID 3496 wrote to memory of 1660	3496	msedge.exe	84
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85
PID 3496 wrote to memory of 4536	3496	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1739072fcf7390c4a5d4c66e7565b1b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5fea46f8,0x7ffa5fea4708,0x7ffa5fea4718
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13635647902725374752,17483680514375896010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\626aed33-b016-4d5a-bb0d-3347df74710a.tmp

Filesize
2KB

MD5
f8be9f27605ec515c23b85b83acb2c02

SHA1
c84055b54407a511784f214a06c4964ac2424bb0

SHA256
07ee42b0eb3db3467e3da624c8bb74f4d03c69ed5f1aac48b0f798460419a69c

SHA512
5223d81d1e1c82425936bc69913cd5b0657367bca7030c38841708f234098a9065c086af3012d7c1b98cd58043c3fc93857f544c3d397bd16b3728959a43cb48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
96894567ba2e6fc9ead756055dfb32ad

SHA1
2152863ebbf11dc4024eb93469b4ce5e27350d21

SHA256
d4fad71d08f169c3a7e83ae6fa53a7d20aea8b9f8706d05aca8e94a6969b49ea

SHA512
b1d76cfba594505bf229ffc70c33d5c7d565f535dc43a02f17e3b798326e97b41de95beeb9485753d9bb4f42e04e441da9947750594788f8ad5118e5f581e0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
0e71d22526737dff872016ebe19fb980

SHA1
751c765acfb66565f3a47b9a3c55c709e59d21ac

SHA256
57b844c827d00a2a09d0dbccab69bc7ea5624afd3200f4f2287fca8ad1541cb0

SHA512
6e0b3e3a8e20e2a3b2210f3d132aac3f8a5cf0eb3f14d61419591b9272f2ecd2d11a4551e8f7169521a210383421a5121072a9f759e90a5847b3d7f8329c56fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b2c8156004b7dd58b38ddb57e484fd5d

SHA1
f174d63ec0ad23cfd6892a12e75a96d8ef516a64

SHA256
cf9851edcd523c5bc68b3b208e3d5590e25f7c372ec45b268dfd435051ca076b

SHA512
9cb31e2baeea6b3184f668e346373147665cb4ba0df46b7305728d20710c744aca1d4f19b24edfac91c4a275ff639253a747cfd23b922749771fe124a3963300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
579a63f17031534db0c4198396769ea3

SHA1
161d575722090c0d9bd435bd2621074d22fd0c54

SHA256
6e5a6a2a5a8a90ed2a54f98e94705068ebf0dfbda205f436aff4a8461810ef03

SHA512
b3dc034661fc639d13f03053d5672e108a7fa185ec926487a043348787ea72fe825363b4b8c8880feff5c8a580bb48ad2309972e4eedbe0db1d2e6f5764232c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed61b81c31e9f05b23266110e5b6be78

SHA1
35690c320a8241a1a1b94784f52cf93636fdee41

SHA256
1cac2e6cd1f897e83f20688dabddb20adf2d91c7430e5219d5c0d6cb3d976961

SHA512
0491d1e19fe36cce99b7d684b4e2485470ff29c6acf9817ab590f89454ada88c9af097d55c844b8a191c0da865ef5dbe5512f2de21b252d86f91916c4a9745df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
446143d8fbe8d99986fd50485adf73db

SHA1
4c05d1e12a1f27f5afed1308fb8dc4c571609860

SHA256
e0c1aeec783ca8962e15e7d3bac3a038fcc6354dc92394a3c503971986a51355

SHA512
6e9335a18cf6f2c2062500e11957cfef9cf3cc08581818442075b5c10c864dff653275a5a16de84e360c2140d2ccda42ca947c5868b8e7d94704bfb84060a5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
02ac8b92f46772e027c0fbbcba63b416

SHA1
8ed5fab00f95a32121d24f1dfcfcd5350f3ba6d2

SHA256
bcfdccac0b4dc5b3525ddb46a8fc6fc5a21e99440ed0b36aae0d98432f0f34fe

SHA512
4eaba9fdbe375fb9a7b1661bc451735035ea5b49971dc94e7550dce3c7f67bdb481f39d241ab3d7c4e8950db45770bea396afc63ceea6f9bb86c378d70f39737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
894b021dd7eef8a7634f54265d2aa857

SHA1
d56c005ca7d52bfdf69660c43a6aace13ebfa386

SHA256
710af7959dea37017774ede8854125528e8321fc5d7eccfd92f7270718cca9e9

SHA512
53e0e6c835682164b9ac5e338630cfab7043dfbc3572e430a54e499c751045140bc3def3475b2b2132cf7773e0ca3e8f5da2ce76de3b1e4535d5f1676cd6c606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5916ba.TMP

Filesize
1KB

MD5
8ff48b7b977cb3b392f164f9c679a489

SHA1
3897534b189f9181b22b46ac5e3136369b765a26

SHA256
1a7d8fd87f3de2a08f31bd32b4cc11cf034a9590ea433e47ef145be1fc9193d9

SHA512
73d524462dd37a2085efa38ee185bdb7eddf20777f2c34b2eca14664f0d4bea6c40e1ee81c49e1013aa0dbeb91443ac307421b4e86d9890fe8d4ef2510afc7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0d8f6ce5127c036977e5c04b668de9eb

SHA1
9a9ecf6f50c81aa8b7686ff9f2184a00cd535b12

SHA256
ce6aabafd8c1532cb88e3778e414c145865cf3995e6538d9931cdaf1ba29dde2

SHA512
6d7f6a8f834c3373d0bd122ae7b3edccb89ed51735f92bd6f194c92fcd586f57cfa2cc1e69da57e2457d06d2e21eba6238adc78aa74ce36bed20fc72447eb323

Download Submit