388344c396790222370964ad4d671f74601438380c34ff0797b4eed9c9f421c8

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c2c54b30bda2a3e9c0b4c040ac1fd76_JaffaCakes118.html
Size

67KB
MD5

5c2c54b30bda2a3e9c0b4c040ac1fd76
SHA1

b03953619e1bbdfb1cd0db6d14b586609ad396cb
SHA256

388344c396790222370964ad4d671f74601438380c34ff0797b4eed9c9f421c8
SHA512

5573fd769ab51a528c3f3aabac5254e16802644f71827e97f4f7c13d7faf64fcfab963b090e4f8597cd79edc54e7358536b15dd28b692298ec844635d34cbbbb
SSDEEP

1536:TkrN0c17NNTgDT3eTnNTtaTq8TjaT+8TJPTQ2Rr/a8liE/4NGZYvj0dJZumnHdLY:orNtPG3g35OFIco90AHd8CINV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
1860	msedge.exe
1860	msedge.exe
5156	identity_helper.exe
5156	identity_helper.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2344	1860	msedge.exe	82
PID 1860 wrote to memory of 2344	1860	msedge.exe	82
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 3152	1860	msedge.exe	83
PID 1860 wrote to memory of 2688	1860	msedge.exe	84
PID 1860 wrote to memory of 2688	1860	msedge.exe	84
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85
PID 1860 wrote to memory of 4228	1860	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c2c54b30bda2a3e9c0b4c040ac1fd76_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe676e46f8,0x7ffe676e4708,0x7ffe676e4718
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,16393909321961529646,6326319851141099408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
9bc25538f15807071d11381f818f37fe

SHA1
158de444259591949a3242a8864bc58c8cfab239

SHA256
37f2b50a2736e31477dee7e8d6188c452eef473162c0ebecde481b1f42640cde

SHA512
c4b0c9d1a152ca07fd743719f15598eebb3bd49bbbfe3d99a941b4859ed9ed2ada374cff4a67652c7920b296adff0504fdf5695985a22d4b0283fca8d891d533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
4909431ea66de8aa313ad4f21f82e349

SHA1
95fa8c3770a81287e2c5f4d6de9a6bc91d3c0508

SHA256
d2720a6fadb4b41984568198e8e02236a11c78589f3980618f906578fa75dda7

SHA512
90287a007aa67add39a158436ea04bb6ad6be3e5c7025e990b0273b98e510b0442e4448bae6b3a37d1bb595bac318a2beb62808ffa9bd5b8351f1b92d1636f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7530a18e2f7a3e779e1e9f8f76e229fe

SHA1
8828251abdbaa1b290ff457c37dbfbe4c03a5771

SHA256
49c8d81d69729977ecce48d80f127f2f0b3ec4f83574b64e85e9f67d545b7bec

SHA512
26910f3b3c2f5d1cb36da16fa6b56f8f5497efeac6031e6abf29196eafbfcec95f679dc7dfddb9f87082c1371f4c1f644cb619e3f131a48a8db03c82aba1b508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
de38b3395b3854d1252848b34607f9b2

SHA1
9beb84759040d50fec0fd98cd9ba39464ba8ab54

SHA256
514ce4594c0af150be4790eb2b2791c32fa35bd78081d46787be7b7a6fecc517

SHA512
cbee9c652e38c84432919560f6ab63b2acfea6b38adb378117bf82092bbf8c9c0e8a6bd1675c86e0e0497f564fbe1dc108b9bc51519ac84a54ee511e588e1e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff180fa8220c488cb2a5f4f21bea0882

SHA1
e410584b90b3891135732a592de7561529ac90f0

SHA256
0f395ed9e27075d96a16aedadb2642eeba85d6b490a00122d30f02454aea5566

SHA512
ec0b21c7d8b9338f1cb8d834bff5197bada8e49e5d20d150bb4f88470b04f471bfc24151935258ba96e05ce4b12e9de4bb8d9fb0b22e3930a79e12f18c287f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7fa1bb9aa0aed09df6c80d9e75ea9397

SHA1
39aa0fa875cbfb9142aba4c6c8079a4416e9c259

SHA256
9ef5eb5d33d6d82933012a6c10dce3c6f2819a43b09d7363d8d76fcc62c0fe0e

SHA512
3c2c980c5ee64b5e8d78f6a8e1bbcd10f4d13cf6b96977800c3df16e2402e621a26136743449f33abf6e48cc3b5c9e9956dcc83d01fdbe8cbd2fc328f0b15b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cc0770a13a1a195769dbcdb76ca3085d

SHA1
f86507787b1276e78ad2a66892f7f02a87ab2d91

SHA256
49597f30c0334dea13d1de3b5093ce0394571d42420db0355a059d546c79d971

SHA512
81393e2c391efc5cc8d69494f42e4b303910ccb5d6c77944f2ac28052da4aef90695270cbc1b885a78f05d2f015e592380d0c30ad6e5f7ebbcb9da17b94ec10e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
c5ce3b6fc9342ed4c50b77ef6262e9da

SHA1
d0f5fb84f150271d14c46ce3a356d9baafe53aa2

SHA256
370b2d243604e9731afb7146122badcab8bd1d1272dbefb75492e40700b4516e

SHA512
cb1952fd748a9883f7238025bebadb7e2bcb27425d320503dfac71f38b6289252bed52bf208b36f049f66e1ca9993f75316eb159f072d023f6c9ad73d78a704e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579182.TMP

Filesize
874B

MD5
06eae06f96eef96a068033fbe0525b57

SHA1
adf661fd86e40a1bfcee4158e9f9e18871805ab6

SHA256
2c31ba5eddacbf4133896007c438135a24c210d605333716cd8ff01e45321a16

SHA512
1b1896f730bc865760c2d6a3ee86f42bfbc72fab1b83058e2b8e1db873ae40bb91eb6a4d17488eb9737a4244d0d027c822748768030a9ecd05a7c10ce960692a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95dd91f1e1345337241040b1fdac8b86

SHA1
50ed053dd7b3a7e0ff169a19d2608d1feca907ce

SHA256
b54da0737c952823c3846d652500c57334d2ac58fdac327d44b164f18560a98a

SHA512
a33926fe58d9c6d034e848f4f3aca00b0b966fdd68c5580934a5ae5d58cb5fdfb1e8a64462a70ad012ee4495442ebf59dc3836b5da6bbf0ef33150f585aea0ae

Download Submit