c316302bc6d1e0b4fd5d1df98d4b128038e49e9b30822d41175a1ea7847aaa5b

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44d29a79ae63c5a266b09cf33d71a3a8_JaffaCakes118.html
Size

108KB
MD5

44d29a79ae63c5a266b09cf33d71a3a8
SHA1

4c4bc9ab5b8657031a2bf2f5bee6907b91eb338f
SHA256

c316302bc6d1e0b4fd5d1df98d4b128038e49e9b30822d41175a1ea7847aaa5b
SHA512

02a6fb160d236818b7f26b0a4fb7d7cf694c697b915c59ba3c2ef84a050be1d68b62cfef7d75e008179afff1ad47da751712f725a91e5ea10b15e6b19f228cd1
SSDEEP

1536:t9uAjX+btKO/Hy4EO9odUhfwf6ocWni1rq:NjX+btKOP9odUhfo6ocWi1rq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
596	msedge.exe
596	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
1792	identity_helper.exe
1792	identity_helper.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1424	3316	msedge.exe	83
PID 3316 wrote to memory of 1424	3316	msedge.exe	83
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 4408	3316	msedge.exe	84
PID 3316 wrote to memory of 596	3316	msedge.exe	85
PID 3316 wrote to memory of 596	3316	msedge.exe	85
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86
PID 3316 wrote to memory of 4012	3316	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\44d29a79ae63c5a266b09cf33d71a3a8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbc3746f8,0x7ffcbc374708,0x7ffcbc374718
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,9780620851798471134,3793128032601288262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
e3f65218c11b52793a7b8e1252bdc9e3

SHA1
f21d659f2486c59538a223dbf6984b164fd1ec7e

SHA256
5db068aca5b7124e149f84c95c1da4853ac8706ed56cd11bb07edbd1cc2f57d2

SHA512
c7a6fd1eda4b9474983ef5a5df5d8858062440fd627c2f5a6665812b5016ff1ed0bc97cbe8f540c8ec251dccd9b91e671e5e05f858acc49b780c0ac3c8703580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
7bdab950dd07d08f2845a2c770726315

SHA1
d276c778c004a0d97736759f86c40a44f0a802ac

SHA256
3b5b5eaf70aaebe4c6ca09fab51036747cc5d4bf7b526eeb6f19150e4c0f5c0a

SHA512
43fc8a4d142192111b5246d415d3fa48368f0b94c48c100a5dfc95e5b62411f0ddb855211a9dc2365c34fe85325aff65a4e96ffa8eb5612e3b354ddde958122c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
64eb35fc05572d7bac3e0769c11da52d

SHA1
2fdc432aebcaec376ccf3dd3cfdc308119d8798a

SHA256
626faa3c2dd648349371e485c1909b6cc7388b6b0185eeb76726f4ab2a157a79

SHA512
18d63a3efec2f9ba349b02516ddba89a541da6d1781946588d053435fcec89b0e25369612cbb6c4fc454d7a85ddc28492ac09fa40eca5e6cfbdedccedc3822cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
044daf4591d83de371f38307af480e1f

SHA1
8a473c3ae4fa80b911e8ee53adb824ca5d456900

SHA256
4f97cf64ebf333f2e284259ce7ebb035be7788d688373a664a94131f55c3bf06

SHA512
c12cea2aa7e24c858616e2323a79b7d5ca71109423999549dab071a487000a4c8db351280fa46d77ee2d02fa3aad7f200fa42b1e4803ddb5f3c39a363f99a117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bacfc8df74764435e82450c5e538c35

SHA1
f915547da58a284a27404b366926b6367a4f445b

SHA256
965fa4369a0b1273e848c06c341e3cb4a22522f3dbb97bbb15b6054d04de358b

SHA512
2a92c15f863a972293bbc14ccfb1eff52fd2fd88c84a6ad36029ebb7ac2b1033d37d782bca111f8cc6cab88374ea2381f358dd8ff7b3c3bbbef2f53650f20996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
384337c03d571964a72b2044fe39533e

SHA1
deda6112d32de47452447e7fc124ab7c034f27de

SHA256
e466a83a93b96684ac41915f8a73778bbbc7700788bbfd48da4bec8cf46d9880

SHA512
964be234cd9ad2cd5d80b1fe770965082dba626e32ec4c45e47e5148477773f61016bdc3984c79ddaf1b9a9c2112cff15d2385c11bc4cd7ea48c08214b97dd5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8a44c5a1dd0f3310715a4dbfd3995bef

SHA1
a4e7715143c48fe959fcc89fbfb1106ebd20b763

SHA256
d3c4be6b4d4c4decd47be7e0f5dc3cc8d8d74e2058ecabae316d5e7ea2597757

SHA512
9206a1e1f74a4515da55a62324319bdb43e2dff2f84048abf5edbe82394e5ee60ec1157fe2612850898ba93cf5d8eb61f197ff8edb807cb92d372cc45fcef7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b9ae85e49d929dd2a9184d98dc1e19f

SHA1
7aa66dcc187aa5bb8e102daa38686f91c1159e55

SHA256
3ca55168a8c327cb0272d980e94309b51c434c12e669a7140ef6a8b1f72854e6

SHA512
28c62c97ac54337df296f1446b1e000381be0de0d84ab0dc4c2f4a62fbf0a8d267f9a5d950a5e47a9049dc878523786f5f4fc1544e0581fbbb09f5893fd6273b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a301.TMP

Filesize
873B

MD5
29e52138fedf4abb65f657d825cba96a

SHA1
c55a00b89afb9375a4e2c36f4b9b06583e2ff190

SHA256
1998757523e2aa44bdbf614e45ada3b72d0c40487be3cd1651515dd1d7da8eba

SHA512
40b71984900a77e29f2fb219365e5219a041291b4b3859ccf79282d7f83a7bc9d94c49905dd3ea715b3f8c14a2215dc04019f8b7472b6b2043e738916362c0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86af51a28728f8583bfff7cef3864d23

SHA1
1df26eee1d3f088d10c022db3449aa64e093e115

SHA256
cf76d2abe87c324167c871d1ab7830cff632704fb45f25b9ae426ae4605807fd

SHA512
f647097f94945f48c54ad1855f883f2ae80bfdc02446f8eb91fbe7282f10f52a22cd416d1a1cb263882417f4cf2c387ce98ec85597bb6e9075da0096b11c77bf

Download Submit