4e5328a1bc0a0433d31d09f9bdeaf30ed734e345db4552bc0cfc2fdd520caf93

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d3fb27a8cf38f73f9f21d12aeb63d42_JaffaCakes118.html
Size

49KB
MD5

5d3fb27a8cf38f73f9f21d12aeb63d42
SHA1

97c0a8cc1da43756911250d369d74a764a6079a4
SHA256

4e5328a1bc0a0433d31d09f9bdeaf30ed734e345db4552bc0cfc2fdd520caf93
SHA512

f75d64c05acd7361bbf87c8eec55a6358098d9e15ae67f82ba6bb2414e2b1a61e5b64dd995100081c4be9a8afd282afd1972cfbfa1717eefc6d96a79119721ff
SSDEEP

768:SGN3S4hVJs8+licUNJjpc2hJVCSMb3z2U1sikn3U:SMi4hVJs8/c0c23VCSMb3z2U1sikn3U

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
2476	msedge.exe
2476	msedge.exe
3644	identity_helper.exe
3644	identity_helper.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4828	2476	msedge.exe	83
PID 2476 wrote to memory of 4828	2476	msedge.exe	83
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 3560	2476	msedge.exe	84
PID 2476 wrote to memory of 5012	2476	msedge.exe	85
PID 2476 wrote to memory of 5012	2476	msedge.exe	85
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86
PID 2476 wrote to memory of 1148	2476	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d3fb27a8cf38f73f9f21d12aeb63d42_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c14718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17265585767350380223,10772104277062571366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
8cd8928fdf6b311a64480b5a873a7ffa

SHA1
ed382038c26f96422855dd67cab265816dcfef69

SHA256
701525fb7bd399328121dc1c1d8c8eec18da7b6c2b95bae460526222f78cc7c8

SHA512
251f9bb74d306fe680c155a55b73639642d118b0014611ea2fad1ddd500f77014f29a5d23be9990b33f302145020f4819276980c817f3d08400a3d78985a5fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2be80b729ba43b54c954c99b960ff007

SHA1
3cef1cabbe2c164a66d003becdc6f225017c86b3

SHA256
baaa544f92140094d825ac9985af5eefa6db8cfa3f7d3b52fb6994e7a57307e2

SHA512
680b1282dd1edc043006e36c4a180e544c47e515c002c750eac9ee83485289ebe29d20afe620a20537d9846958fecb7d3d0774bb8e7fbf935abf8af6db109805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
0fc78c9baf0f9fe54c5d4da2fe3227e4

SHA1
381c2b5dc3ff9a7e114357677eefe3a22c61423b

SHA256
48e521c0a6d54fa24b3df1622eab6126335a9508f449ada65c8d5767770d40f2

SHA512
88d58bd36a5b85c29a60413cf5b88733c849d0eb736dd977736364b7d1bac4eb83e8fd28865f893c9da6f8b841c97c890bbbeacf96f33d432e05d83a7b280f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9ea6c176d0b859f32dec02043d6b95ee

SHA1
aab4ca073c49bec5a4a0ef8173475e6aeb8973bd

SHA256
8d433d09c03259056cffe40e50f1b7429781c4ae4a042a40db97ce2f8f41ccc4

SHA512
07ad8e8dd0f1e81ac3071ac5dc391a24c9347b6746a40391c52f947d6d24245e9d206ffd35581982caab9c8f91b7c893dbdc30ce9bdd64d44014c4bafeed184a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b14aad9cf64beffd3a350b56adc3da2a

SHA1
4995c8d09450df4a5c7f59e4903530ba960db74f

SHA256
4102fa966623254bee2db2b58f9ea231ef75ffaf4e1cff7b416d3bcc61848f1b

SHA512
bbc96a74434717dd1a3eb3df147263062302a8df67f5832bd4324460b206827570eb0a30493eb326960b8cdcd18d6361668685f6398566354d002e6bff5c58f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
698494bc38b253611846dae8f17ef6f6

SHA1
f25b7459ba087997baaeb19e1607bd53e8078b1c

SHA256
b9105e7ff0d8d58e99d0d4b80ddc7feb6b40f5691ec0fae1054c0679d3f96d1b

SHA512
66a86dbdd332d16be1dd3e87af0f47ac9c6c12cbf9c9fc3ccf4d8339e9e61fe95beca8f057361234a61bb3538dbfa9f2e9c22d87ff664b9b6844e79486d4fcd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0c27e6cc75a7a6c33436a5b86712c3a

SHA1
838a195f1814dc175687dc79779296bcf996d442

SHA256
2a81e26e6b9ec2b26bea3a82af135d1e517385bf9cd213cd80bcc483e73a81ab

SHA512
1d26c1bde59c311ec68833f7ea81f837b475b8dca31fcb81a114e4235d5ada769c59789c5946e48a156430e018b69a2989b834e12cba5bbd39800049d3f89942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
480baab714bd91e4a0908784c574de63

SHA1
fa215588c109bd1a14e8d3f018a71b2be199448a

SHA256
118055a95ce88be7263c279c02a65ea603873ad50fa50020f9a66ab9bf265771

SHA512
be969e520c70bd03c036d68bb13cebab02a1d5e6175d361cbcf62db6764b28cbf7186bc7f4de5ed60f1028f655b92cc6db4bfeeb89e908c942cdfdd2d289e5df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1353da887de1e58230863e95bc6a4f5

SHA1
7772482210fb4986a22bd6b59615540f47db7f27

SHA256
e3ff710d8e879e9c0eae86fc2df3b30a9ddcb5a65176371bd19ea883de145467

SHA512
e4b7e47bdfe88ea364d34cea1a6dfb1583f922aee850be4881a1df2fb6f0274abb339d9469e6e7732290ab47ed51906d6bd6c3e62e1607522799702e0580bbfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f79a.TMP

Filesize
873B

MD5
ded899644ea727cb1cb6acb152a2e0e1

SHA1
659fc3834f5282f028e91b8b5b90f85164565cf3

SHA256
59b6bef84e55499f0add2842a48c56fa83671a7a460bbd852f8e57cb67b06f41

SHA512
b2278e36ee7ddf0fcbc494884e4e0fc9db36d9aedaa963521586c32aaf118ab3b6613088a02dcd53f13173997a4c5deea8469ce30e136f1b96daa5e51f63dd8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b79bd86f51378f97dfccdfe7b97fc34d

SHA1
abce65df3fcf41513e816323adb25f2e845fe8ef

SHA256
9e65e9d8730753330f2ce51dbe54f45920da3c71f54a849f373ac3977db13503

SHA512
d0e0483fe20b0f7426eff25af5e1470c64e70e631ab4c94963d8bf8ffaa0533222e2c2a790b5f30dabce89fd1265f76009efa878c4b4287ef33b422b04662d88

Download Submit