f11c38a09dc2b688fba4ebdbc21015a2ca22858699c64a21e820ac1820160bbe

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

985a4deb49190bace63f25c8c48f8441_JaffaCakes118.html
Size

171KB
MD5

985a4deb49190bace63f25c8c48f8441
SHA1

512f830cdb6b4c95f4a55d1660a6655005e12386
SHA256

f11c38a09dc2b688fba4ebdbc21015a2ca22858699c64a21e820ac1820160bbe
SHA512

0d83b814ae12f915b22faf415a66eaf742381361f91d590f10bf5667792ef006f9f3c9061723f4a2dcf0ff226bdd58bf1b024dda792a911ae6edca37f1ab284d
SSDEEP

3072:9FFCYSF3D2UP13G4k5QhLpOatV74pXdgAOh/fNbYaaLStR3cxWUu/v66sbsGon4T:bo73G4k5QhL8atVbPfNbYaaLStRMxWUL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
5036	msedge.exe
5036	msedge.exe
2916	identity_helper.exe
2916	identity_helper.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1400	5036	msedge.exe	83
PID 5036 wrote to memory of 1400	5036	msedge.exe	83
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2624	5036	msedge.exe	84
PID 5036 wrote to memory of 2352	5036	msedge.exe	85
PID 5036 wrote to memory of 2352	5036	msedge.exe	85
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86
PID 5036 wrote to memory of 4148	5036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\985a4deb49190bace63f25c8c48f8441_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef99446f8,0x7ffef9944708,0x7ffef9944718
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5880090288814855256,8038688773245784907,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
41b4b907f9e0af78188d66258b8aacc7

SHA1
b1f0d3b79855793f2a04ed02be1effe7569d9467

SHA256
10a4478102e733411338a85c031be4676162f2e0c23c5b931f0b75cf0fc1cf0e

SHA512
d9e69f2a4db7c88fa4b623a71dab7af4d41e8bd5eb643b67d781ca8f93899376c8ffabcee7b10eb99394f362070a6ea583b707ee3f7adc196b62d1928bde8e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
fc355e9b523f3bc17d07d1341fe39e89

SHA1
a7036867c70075721a9a7bd6fd9d96de4f803b30

SHA256
a69926338a55213ebe086899a72bcc90fc9a0f253e52ee8ddc2e48e42ecc177f

SHA512
2c83fb3c262120c968ad8cda9b1171dc30e231c80529d954bcf4ae56f3b19427677bdf778efbb430f49c13544f5da47e73f3f02f683cc733773f873d0e4b811e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
47ee10cd45bb720e77071062b6fc2d9a

SHA1
b38aadfdfb1ddc6c5922733e72d5a86907a5ecf1

SHA256
82517a8baf7e58c27379e742c8da10bb7c1c6f9c3d261525ced3aab8abf43e26

SHA512
5bb5bbd66ef3ddffe460a506dd75d8d99417fa47674e13642f801b78b8c8f3e6d10b6cac8cad11e06bfc8c2fa408946e519f838fc87c3dd9e3808313c7f4de38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cedac64d9f5f9808fdbfe19af0571939

SHA1
9d7e7de7fc186a3f4435fcadcdd1ef38982edc34

SHA256
c6c26f3db82d523c07752b677ed6cdf59e0fccae02fa20da8403b96854a2b757

SHA512
7b8450b718ac137d7fcd80fe2f8407653db685a5a15eb80a087d3cc0d04f7fae62dbe45c9306809d3f4a2721b98a58d92c011839ff51e476a06474187b7338df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ee3b2a537bff657cd1cde95bfb2f5b69

SHA1
3e12bc5fb0237bb431cc443d776b4fba11b324da

SHA256
fcc1d093b95e92c6b175b18a753b01b6fc2197aefbeae2097fc52cf091322ff0

SHA512
39b4eb90a2761a06946b899647431c7ef25a20f87bbb546739712135b7a46171d01e55847d1a39ce5cb581f3782e66aa35cd73e3cd5a414656697284e47435aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
401b5f6cae31280109851002f54a389c

SHA1
b1f19fe5162c2611ddf506a48a24bf51713403f9

SHA256
7f74722e729f881611dc23d94d79d17358132613f2451276c626075396a70624

SHA512
9cfb3f8859fb3c58ecdd47c19e9ff31b2e723801c9ba452040421980f5ee39e6df8ec70aee010f25bc6a37b1e2928b727c80ff44c0b71e6110ad41954016eba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21a53998ef2051e63dcf918b932e627e

SHA1
82c91ecee855fee052e9df0868f6042c8381aeeb

SHA256
5f0a86c43c08b6b8102f265493c554020d2cf067966f756a7dc24b1e5ec91d28

SHA512
3209aa1f3e53416f2a3f18554b4decdeb2703ef54c2ac4716e82f96c343b66ca644024009d425c8eeec78f9ca2412bab33756f94e1b195ecd63d7e3cfcc81187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7524ed66ec7c5f1bba091fcdbfbdb43d

SHA1
b65849979d655ae1ba23be4201eb2fec270bec43

SHA256
e256e280e6a7e4d2d256e821cff62fcbf52f7637def6aea4fa8da12d17a95911

SHA512
f7c7712bb984bcb797a12264674fdd5fad26124efe58a408df6ff1236496fa48806fb8a1d3fef87c35e1302a025c2f92233d9a8c096c36836eeba2fbfc8e273c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
46ccc52815d0d1b50d1d3784e8b8e1ed

SHA1
8c978a3054bfcaa9f6b59993128e203f5ec729c1

SHA256
846695ceb85760571f16154f19a7965e7c039ba902503045304b5ec8b2d9f895

SHA512
30cf6671e24a1cb28177a06aecfeeab6b0f3d25c400d7a30fb05d20fbde52e6c8d516833dee52ffc57eafce722e71d624f4af3a1df906eb925ad501f2a54d1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb20e8c8ffbf59eb5387272ded2a2203

SHA1
8f4bbcf2b9e7b8959408ee9ef023b9db37ac08df

SHA256
b4eda6996f2bb956d03b08ae3689d9f416c75a01621bfb1116d63393b3a938ab

SHA512
f8276cde41e3da1078ee701fb56481195ef466962d9415609321eb62b7861c89f66255adf7c76c4840b417524add68e72227d2c9ff966f86ae7e09552a13fb27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
f5b67ba57ad36bf732ff2710e520905a

SHA1
7c62e1a616c497a1a8f83bf688e702b7d137cfba

SHA256
041b8d6b7814105646457126fa7c3d4e8b3b436ec27f8932e01c06d45f09d9b0

SHA512
2eb9ed716649a68ca5f8185f88a05800903cb7db7aaa69e6498b6edcd7975e30d49dd3d3d4ec4c225fe3ed480c8d931a4de7401905d6bc1da7002385ea6417f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c63e.TMP

Filesize
370B

MD5
5c90b19a483559e3d5ad5c7f207c39d6

SHA1
6a6fd06461363c5eea58ed00eedf329dd742a7ed

SHA256
6b8ad646d5887372c47fa5887506b243c6e412ae3fc1bf24506dd4998653173e

SHA512
ef57e9aabc98ad856e7383f49012887b0f6205fea3903fb2c9cd4654517d1df398380f3e5a23a68d649ddf39ce154d97c74a62a04f31a000b0217ff99bb2ae43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
786bd6b190110ea73cc804444e37a7e6

SHA1
f29d07788c7fbe1af307ce84fca0ddd8a055029e

SHA256
5f3a8672d39f5b0a69171083f0d496d97ad7feb5aa0fd13ee53b527dc397f268

SHA512
92815e6c581b604a635f684a466d334bf58819484ae0b88ee52f1cd669c61cebd3a1e57dfb504434b58444e7df53a40bedf692e3a9fa01f693e8b7346e1da10d

Download Submit