7bbe61774de33fd39007ca2947fbdab343d09aedbf4eb79ea045ac30b2f05b16

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6e7326e93c737aaee74d8f134e0aedd_JaffaCakes118.html
Size

96KB
MD5

c6e7326e93c737aaee74d8f134e0aedd
SHA1

93c858544b4ad9f361dc4040b7522ede8d298727
SHA256

7bbe61774de33fd39007ca2947fbdab343d09aedbf4eb79ea045ac30b2f05b16
SHA512

72da3eb38a63465c2a3940a9ec226bb995ff0c434a4f99bab501aabed8351ae68490d39deb0d6d6802b7d4c47c66b30d7782d8cc3621cc16e455639cc17b7247
SSDEEP

3072:JyLvE6UfJ7RCY1t8KNluEi/BKrM/3c0/Vb:JyLvE6st8KNlQ/BKcv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
4888	msedge.exe
4888	msedge.exe
2296	identity_helper.exe
2296	identity_helper.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2012	4888	msedge.exe	86
PID 4888 wrote to memory of 2012	4888	msedge.exe	86
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1492	4888	msedge.exe	87
PID 4888 wrote to memory of 1440	4888	msedge.exe	88
PID 4888 wrote to memory of 1440	4888	msedge.exe	88
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89
PID 4888 wrote to memory of 3448	4888	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c6e7326e93c737aaee74d8f134e0aedd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1b8546f8,0x7ffb1b854708,0x7ffb1b854718
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,18324080709404330160,7871655768499471604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
94abd9b75ee0b73577012256a35ade50

SHA1
cf502751f57216fd15b600c342d0463d7890a22e

SHA256
1178188069bab938575615c06d0249cce4fc62d6f89c6ae0411a0f13b5407998

SHA512
4c63a34dc427da198eb1fb5df0891048c87d4cf3950979bba538c106dfd5cd58afbf86ca44b7e4a077ecea2f668ced9dea32dad1bad5b4dd1f8c37c0c5a077b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\484661fc-06ae-48a6-ab17-6f430384bc22.tmp

Filesize
11KB

MD5
e0fdd544c239162d764043bfb11a5365

SHA1
9a7494b3942bc684e98998ad67c5b0c43497e9c1

SHA256
8c0acfd5472bd4a34f11fa8860c039065c491ba785ff20390e7fc7c81fbfbcf3

SHA512
4df9df96460203c851b49e8e61de6679e8b6d1550ce6de1b06ae2583698e840421507cf1386c71833a7ceef392c6b048771b318004ed1ebcd628f2b9f54b12df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e1e5dd2f3b4ecc4528327050d49e077e

SHA1
c75681eb8d55c92e16a935d5eec53880a9c5b54b

SHA256
992064ffc1b38fd544f041e7eff531085a5e70ec192af7fab3bc72aa424e91da

SHA512
20e19a392a04da12908330fe8324f2bae4604ac462faa50997365b1234a6fc52b688102119a09db6b690e36916340ed7e3d346888dab8d4efc2c5dbb3a3c4d62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7ab70c371dcfc3f2c3c0f1fb6149670c

SHA1
32cd71a285f0dc229bb236a325b4b80625ebe0aa

SHA256
b119449488183c62fc5cb95ff9b7367f21f5d81cb7d6728c614d312b0984613e

SHA512
24ee46d4d4abc03ce415758a8cb53d6c6bbc806c1efbb961b2e313183354dd4b9373064f179105d8722966aca6b41e8fb278a2fc31c3d9738a38233803385b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
28c7cec5e935a32ba2652a5508e87c51

SHA1
f35deaa5d6e6bc14454ec55fb3bd9b2a0a5c544e

SHA256
840408fdfdf756528e0bb5645c42ae6684748383e874f2d407a80588900c7792

SHA512
4f1baf34a7ba2e02be39305847e96d20f4138262aef011a5e420010e86e7abc47cdd03661ce4aed95e5ff4ab7e9fb3caac860a8e2dc60bcbe2ede7dd8c812b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
207a7d21497ebf0f067adca29d4c9918

SHA1
ebc4096e9d6a2bfd5a700eef156bdc6bc4da103c

SHA256
6a94bab324987f0c916c9c5c03c11550abed6a3a67ae03eb316cbeb7188db347

SHA512
c7a063ab6aa097c69bf4605f9c88ec6aab87cc02f52ccf990febbb3728abc8d636d6c77b95c50f01852a92026edf6c14ec818bdd1be039ad1ad5fefac60cc39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit