a451da5dcd5c02884a866edc82b28bf202990b25bb1ecccfde64e9b975cd30c1

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c939c5c649a3aa5cbfd0445e2ba09d4_JaffaCakes118.html
Size

671KB
MD5

7c939c5c649a3aa5cbfd0445e2ba09d4
SHA1

0bf41761961f3fbceb1cc30f26621b14a8913ad7
SHA256

a451da5dcd5c02884a866edc82b28bf202990b25bb1ecccfde64e9b975cd30c1
SHA512

ce29f492703ad88fc8aaf63fc1f4144dc47843d4c6c3e719405fb01fe4b4dd141ee770fd9b4db63912ef67a2aa012e85d8bc880e8786caff578d2923e890d4ca
SSDEEP

6144:vRdtfrDTW8PwERy4+lemuRmdWzydYEMoZ6WI9t/7kH77I+jMoZyWBVOYdmQGjaCx:vhDbPwERy4+lemuRmdWzyIXMDMDmwf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
3988	msedge.exe
3988	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2452	3988	msedge.exe	82
PID 3988 wrote to memory of 2452	3988	msedge.exe	82
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 2620	3988	msedge.exe	83
PID 3988 wrote to memory of 5028	3988	msedge.exe	84
PID 3988 wrote to memory of 5028	3988	msedge.exe	84
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85
PID 3988 wrote to memory of 4244	3988	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c939c5c649a3aa5cbfd0445e2ba09d4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe401546f8,0x7ffe40154708,0x7ffe40154718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,17284897075800041369,4957885610690178236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
85ee016c3b6d4b5d5cade16a1598cfe0

SHA1
f2c4e6140f31b75d3c25f86dc6df6eb433a77457

SHA256
13700a97604d0437170cb1280e71d376afe5a8cf3761e4061bd4bd8ace6bca5b

SHA512
a2f36603b14a75957d5a646c8daa6f19e3035a77b6aa8551c87c59d4e656bc9b6aa9a550a6c3e51e0712bcd747c785a82efffb6b3dda9494ac89b4b39acbd6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
2093e34bab12e08a303defc86b43acb3

SHA1
c535ad2fe1ed75ec3c22f0ff7ea6fd2cabdcc5be

SHA256
0953e634bd15f60080dad54cdad0107001e0473d2e366364233503eb96794600

SHA512
dcd423bb7cd3d403a9ba837cd88e770175564f7a40a2b6cb3e839ea1f7424de1eab2b8b5cd2d91b661fc5eeb5ec580855b56c4115ef9127039c51d9b16b53534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
129f61143daabb59420b678e0e85c64b

SHA1
37ff0de8da39fc58136bfe16873e212db6bddb93

SHA256
a644b8e4207f4197dcccfd242006ac57832fda47465ab4280adebe9120b2b5c7

SHA512
6d79c7a165c2a150d22706919db17a14900ad459b631a586625077a7221dfe4f4e492e103bbe32ffa01415e35616f7de8fbf2bfd814c9f1aa7410ec8b697e9be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5054b76fa7413e69aa767a6e4f6832b3

SHA1
7975959b4a247dc282a2079323219af264abe350

SHA256
73935c2612e4dabfb19c4aec8a352736075f2cf9906041b02eb50ee44d0bc4fb

SHA512
482f6526a5a3875b1f9bdd04098ad5dc80d918aaa9269da52329b94720ff042078f14bd569d7d55edfeb60b1452994c2416806bc9476a9b0c045004cef053be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
83649e812bbe297a5ea5e2a0a799143d

SHA1
3b7f971e0e32d863ca76356c7f9226c40c4a9a26

SHA256
b831808f5271c7bdff26bf4cf5254d2c939cf39ac799957c6ba1155fe64a5922

SHA512
b97029ef6abc9c4d28044a67f5fe358863c114584afdcd3b4136fca54cb3995de9598d34ec171edd411b8e3b9a20f0eab3b7cf0472bb53ef261ca70a0b775fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
429c081e69fe7f38d3f5c1b01ab26088

SHA1
1d5910560d50c18e35fe2f9a31a1de9ef408773d

SHA256
291959710fb935b1afdfa6fe9bbf1d4ca1c442d98c3fe056cf0b8195cf1dc02e

SHA512
390abf39a27edd0c5881107546e4d57fc7d83250c305221e77b0c3617c980e7c6507d2650a1208ac676311eede2aa962c0029b0619e4786e58b6156706a89b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47bbcbdda780a02bc16960728a820565

SHA1
9563c3882fe4c6a964fea13fe459ad9cc0648aff

SHA256
b6188dc6ef66d1f5f203e8ccfd8da9e07b64052d3c5e9e954a1a4b15a9019753

SHA512
b4975999769521a4d4c516728fc1b34275e011fe9cc878c35d10feb771ec65c8f2049b7cdd44a68f86bcd54c2b31f51bf06e550e09c4fc6d78c89905a8d5d605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed7599519c9e983f003e5db46f4645d1

SHA1
14aa5ea52dfc1f12d20b85ce6fc316dfb5a7d02b

SHA256
1c5a54df7bcbe89aa804a9d1c098dd4f5edbf8e6509e3c2901cff7c53a332fb4

SHA512
d2be96fcf6205cd87339a398253477918b811af6b2aeb3e2968cbd73d92adbc4f1b07a67451ac5aca8150650e45cae9f01fa5cbc2ec936dd2facc3ee074e863a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c203a126126dc6a7a62c907762be0f52

SHA1
a7201019e195fc04e37177a62dc05b8a0f5c7117

SHA256
f7d7b9e226ab19f11552a084bafe005a17d760f1f026e90dc7a3d37f2e78b42c

SHA512
c87ded44b8a72f586cf15e5ebd6d017e3f9c52d17613974f4dc13907acbdfc3a94b40b381d3579f0ee7b6347fb45489bfad480f3f37529d6ae1ed1611f8002e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a88.TMP

Filesize
372B

MD5
4e9bdfaa32d66981bd6b9c00f7f948ae

SHA1
cc0b505b6172f05bbd51d4f08453141b6010d747

SHA256
edd03e82f9b7844be689ca8d48c703e8342bfd47c8a6c22963232fcebed84b6f

SHA512
e3056c86ad6b54c67f0b4acbb2a6d4137bca0a21e7ac391a11ee4edc48f523d80d9842be96d3e1e2c07dcfb2dc9de1a84445e9d1f25514351539fcde4ea99cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4df52b7-d7f1-46c1-9516-090da43f10f0.tmp

Filesize
5KB

MD5
7ee9b6708f71cf3e46b28244d2cb30fe

SHA1
a55769393f22bd71d49c2d4a4df7d1eb3938f50b

SHA256
1b526f8312f1946643799b01c34bef1ba61951911dbf8169716dc8969b28be80

SHA512
e054fe9ccb88005fc5e653604b0eb30d1ca8355942f79941bff8369bf1cc575c28375ba6236ca2cfbd5e40d89270e1ccbe1962565a7b81a4c83c93f659679795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7eb82cefede4f5cbe683e494f975f2f

SHA1
e63485e7f25da13b9910436f5cdbc4c4b0cd54c1

SHA256
d490e2e6020d780d9b2d761698abda45e4175e38990f14e29b5b79f1e80f48c0

SHA512
895ea6aca71adcf16b089b8829906dd9315eb0e02f2ab5bb48d820a0849ac58a42dcc6cd89e43544d296965d75a484dd7358a3a8d4d01ebb541da1fb86f4cb87

Download Submit