0a2a8e988dd149cd2178ea2834351b1d711228d67c695d69b6f2af5d53ed71a5

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35720facd215c50ad134f756b9da4265_JaffaCakes118.html
Size

86KB
MD5

35720facd215c50ad134f756b9da4265
SHA1

5d256c7fbf0aa9b56791d98b5a783d550cbe384f
SHA256

0a2a8e988dd149cd2178ea2834351b1d711228d67c695d69b6f2af5d53ed71a5
SHA512

de3c452f56e551dcc40f533acbecff421b20c6955eabd2c1652bca9f87be2327f45ea591806d48b9e047624e96d37ddff78a9bc7214a1c2c281e9ef0b0133047
SSDEEP

1536:2wytHKIRpRqr3oX1ntcq4o3N66r5f/ZAV9OmTzHYKpnzagklQMM:2wyKIfRo3oX1ntcq4Mhr5XZAV9OmTzHB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
1156	msedge.exe
1156	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4484	1156	msedge.exe	83
PID 1156 wrote to memory of 4484	1156	msedge.exe	83
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 800	1156	msedge.exe	84
PID 1156 wrote to memory of 3624	1156	msedge.exe	85
PID 1156 wrote to memory of 3624	1156	msedge.exe	85
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86
PID 1156 wrote to memory of 1668	1156	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\35720facd215c50ad134f756b9da4265_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaaf3846f8,0x7ffaaf384708,0x7ffaaf384718
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1904 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1636 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13655683172609623884,4349106624382891741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
549baced2c151db8a02c3419aa5c01be

SHA1
1f36a9716da201c5e45c1cc23c349bbaae44a3c9

SHA256
11938f83bd463e29316808f3e118440f718f1c7a0761bc860171255a96cbefca

SHA512
12c40a66af58d9436d7c3361de906077402cfeded97361c81d9900d69d405b5ab002ac36aad3f8152c6083e00755442bd1bcd1766af26c097638051dfe1aa9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
45KB

MD5
94019c00785285cd78d6da8a1bdeaf80

SHA1
33ba11bbe8c91eca17a84c3dcae4667638a61b57

SHA256
2ea5a487d117c082ab04c8b2d979adc04c18f496af90ef2caf9910d9902ef8a9

SHA512
b58d23d9333290e203ee3191cbcca4686ae1f9b4c135ee8a8e0f014e7db4efdcffe6aa82b502b2d8e63bde705895a04726d799a4c6b0e22783b6925b4d297d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
8654ccac65a3ce3da9541f39fbe3f26d

SHA1
43161e98b28f9ad5df55456e498404586ec4de7e

SHA256
ebe2366681050380402deeeaae70850f02536c5143fb60bb770aca13992b1324

SHA512
b7dcd7b8449e8f97b28d49cc869f8376296213d331acd09e3b27864af6f2804c528ad5b29b25e5b807bc5aad112af6cf44c9c768b0372d7133ad3ef623743732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
80f39c230e5997034e0b802079722b8b

SHA1
3a71ca670e9afc0b01b3b257bdd3aa49e22d1990

SHA256
fd4d14da0d5466f323e6179ccff9a953732169225ded904446abdaf4a002a64f

SHA512
39cfce7f5b77a05c1823b54a4f3b95aaf369450531ffbe1387eae583ffae717bf71ebc4f5e1d6e1e9f3aaff05b64f46facc47bb77cfbe47c50aa3bd4367e2afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
642cfe4337efa8910ae123201f3c40a8

SHA1
9be69569158eb68be523101ecf7500a6ebf6cf14

SHA256
b5dbf52375613a5bd0aa830f7b3d03f979bcdfe12f371a3a25aa1d12f44bf637

SHA512
bafcf71fcb5972ea877b954fd1ddb17facec3b190a154140cd527f53599b82c55e4a0195c19bbead66fdcaa5c2827f753f638c051a0147a2cd21fd69b10fcd4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e44025e2ea1229bf968382e32490716d

SHA1
b580c56b815453d86156af4379d3cbe1fb9328a8

SHA256
ac7e46336ea08953d0dcc40e3bf394793e3de49a211eef68b50762879a22c999

SHA512
59f8d5277973beb30094f5dbefbc7497fd7fd7b4e1db80f42faf68d013f1b71c2a64cbb9dbdfd81192f5dddda5c43c52e857a964c208acd4ee4795b3c3977817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
955977dc5363c81bfad347649cda3814

SHA1
6549ce7c4353071f9ade6a278d4f3c2c330e3ab5

SHA256
2efaf1834b6175e54f47720f39c97b56475fa6e473e83304f8637d002a062531

SHA512
bb24d76a60d2e57f5c7a044721043362b5c45e8829084593146d3ac51a3f4369fab9fdb8d5fc9505674950c55267823dd07107e06a82eee06bd07a600a27d0c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
625f44523086464392ead5efe9548a7b

SHA1
3047f90d2c1091c081d4491626e8c3096db0d305

SHA256
9d7a9db537b70524a1b5c7c7f8b317516f15656e076c8dd0211b3c9845e7c12f

SHA512
acf268d5eacdf465e19b74135225c31a8c38ba6ad3b4fb4e218d2a5ef625ac003d5e84cccc87d059fc141439ab4d90868b36da5ccfe1cf66d0f653d365b9e4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e3b953094923b4d9577b1271ed59e5f4

SHA1
62d0ba870e4d0198e0b605515476b938b1e0cf28

SHA256
3d1d8e1e23cc2edab9d53b51d275ed084d2598df21bc97649d06b84edd2338ba

SHA512
3efb528e122087bb37ca48fc346d397dea720d6e3cda13d92314d887beca7f8fe260dd74ca9aa239289ab900bdfb45961715d7158b97b61575ecfdeb2085a26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c93aa7790626536b8552a45fc4546752

SHA1
e160ca43985ab84243d864ff656b780d45d1cf08

SHA256
8f42543a9f33ac91103869338d5218bb665c00374a0e03bf84653e3c46bf918e

SHA512
3bbf625aeed929d129eb723480a1ffa1c3c713107d6fee3e4e9cd9549644c5f110fbfd2906a5a7c01282e818edb913335b881f7b8824d2249427a275ed5d0836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
49e8f208952b4a3b29245ed6b4fc2c91

SHA1
95a6582c6d139baf0f2008be7aaa114b8ecde656

SHA256
0495329193175fb0df716b90c8e6395d625a5d8ebd995eefc52986383d2a8561

SHA512
0ebfa634f18276a1f3f00b64186da773cfd8f49f7dca248bf08f670724a8dfde1b6b788132b981ece4d2ea8f9e6aeda80b348cc1cbb43ac29ae69ec99eed889a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815c5.TMP

Filesize
538B

MD5
c39cc2a7dbd696707249992eadd4d69c

SHA1
6d18e5bd7998e9841759f286af43b91718da9473

SHA256
9a7f4cd3790b2fc0564f716118d44330bb2149c75733d89cc9c19a957327e5e8

SHA512
6e1d1de0d761295d45f006bb24df8bac5a5653cf307405c7777b10556bac53f6eee4bc9c0a9243c9f21e2dc8c6cb024f41fd1ec93abc971e9d41d511be04421f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23f6ee5898d2b94cee3a94e52165ce95

SHA1
05995925ec8d8f10ce28cca1bc8e07a93ad1adfd

SHA256
cc15cc6f57743bb97729b6b7def1eaf6974719750d45bf845b775f304d601151

SHA512
f544a0753f0531fe18dca9a44d9c8a4bc84977a53f26a85c29ff29922f3b1fe9e17f15f9b035227a54699b5f7a5c5bdf091eec2fb925b710bd48ff86fc8821f6

Download Submit