342116bfd2dab26755547e3d1beda48b86ce3851876160e089d082436df2bea0

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

049b62c0ddf644aec9bbebf1fa56c6e3_JaffaCakes118.html
Size

61KB
MD5

049b62c0ddf644aec9bbebf1fa56c6e3
SHA1

17cf01b3d3a030bcaca8802159da59286ffb3399
SHA256

342116bfd2dab26755547e3d1beda48b86ce3851876160e089d082436df2bea0
SHA512

81becd1f79c0e2cf565ac9d424bc59b82d45e0f5c08f36e083efd2fda773fd0720343ba9d5348d8b7a43c1543720d8ab2b722ae83d6b57ef148587192759f622
SSDEEP

1536:i5y3qiocpqhR9EO7i0m6IY7bvbr0zg/yko0/yQ1qPHZe:icaiocpqhR9EBko0APHZe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3492	msedge.exe
3492	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1204	3492	msedge.exe	83
PID 3492 wrote to memory of 1204	3492	msedge.exe	83
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 2532	3492	msedge.exe	84
PID 3492 wrote to memory of 3112	3492	msedge.exe	85
PID 3492 wrote to memory of 3112	3492	msedge.exe	85
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86
PID 3492 wrote to memory of 3172	3492	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\049b62c0ddf644aec9bbebf1fa56c6e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85efe46f8,0x7ff85efe4708,0x7ff85efe4718
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,18322394639465394609,3578665589384849066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30fa8746-a745-4fe8-a519-22ade33ee95a.tmp

Filesize
11KB

MD5
a9d8ff4a6f2974dbdb278e661ffe18ee

SHA1
dbb231407a35ba37ff835ca3b58ea9bff9d26a55

SHA256
144127309c524b73ab572d456542c44390b0f8ddca76093c2b3796d37ca47564

SHA512
8cfd5f2b7cb5354d423fd4817ab95a0db41748aafa9da8cfcb6f26d026f8345df8282ffe7bc4de09dac93724f901cef0b271f7cb161e7da638b0f45dd2300da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9d3d369bd0d61acb39168671dafa9a27

SHA1
0a73bd520d0f88ffb852b2d00e1e4c596f1690c3

SHA256
798f3e0d0c2079e1825666f863b2bceaa514dea5100454a2c64abad9bb5905d8

SHA512
f5c1fd1135acae399fa70cb90be7fe158fac94370a9d1e84436472bf09f147b5e6bf16f77552dd9accb831318fff929a74ba96473632511ad7277ec714947e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0eaa63b39025e40680aab2d66116ec13

SHA1
69193d2b13970f9d661f56dc089fb5b5b309f0c5

SHA256
a4fb7c6902a9ecd3ebc90172ae9dd58ff8e214ced2f74c166e31a6f446c9157e

SHA512
f5d931d86cd69fe0664fbd19d7691ea4f4d565dcf213f99200acb12eba1e5d9a7bf0da9b395ed13b984d0fc40f62b3e7a44d3351ed1a5e9775c0ae83a42ece7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
edc4451516dc34bde4290b139701c4c8

SHA1
3579fff88fa9c5d8e0dcf37148fb11d7ca349310

SHA256
83edf410710a5e2fa5b17d0bb5257aa90da2d1bb6d3570e149db980c1ad6fcfd

SHA512
b943ef0c93eeb727ec439cd8cb0e6d77148cc160b94e95c154effda2d54eee10abb3da4f2f5a470bfd577d3bc14133c493eb2ca0c5ebabdfb66f6a632dd7ab73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
da827ca3a6d68b16b26e9ad8f2b6662b

SHA1
27931665eb2f87a60001dba5b61eadda1bc13f03

SHA256
c7619032a5a195070f3d1e760a0c08e9b65c7623ec6feb7d222c85ac2b4704d4

SHA512
216c655b72f37504c558a3e5433a07cccd8ce525353cf5bb34812a4af46ae993491f42633d12b32bd4d411a3bcd5986dd11b20d72a5c71520433e1b7c10118ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e514576951df059ea30e154b4d78fe49

SHA1
827af198d39679a18a15eeb2827567ce68aa642b

SHA256
10c1433a67ccffdaf5e859ec9698a749e3150596482cce44a09e08a95ad94e82

SHA512
bdac32eaeb50073338c4699dd2e1bc0ffec54d828fe3adcdfeab95c6e5c03b7b9d4b21fc5a59d65f250650205f542188faf00e548bdb3519332c93380a11ca29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3052229cbd65dc1650b7b32af8bb7273

SHA1
cf24e9e8140d4cfafeb70c2c5c1f13cdd14697f6

SHA256
0afed6c40b3b5c2da5664ce60fa64fe105e840d32f2ce671ed40f6edf5811d25

SHA512
caec2c9a5ad9ad6ee2ed137f2ea09271690312fe662373ce1a3c9ac3759cd32d64a875646d9cc9ac7baa13eadcdb726076f3d547d68dd25d9b448f4f7826f8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
881eb4454aa88f5f65a9f893c3540f2d

SHA1
c57f30704c7089730aaaa643604956a9dbae9a83

SHA256
e0546a279392346eb152f66019c06e995fee6c679b9d56cc12dd861d47eb7fe4

SHA512
94112ec19c7ab581544b09b6b916c4a0a17f1f462a99bc1c0431d0bc49baabdb36a97abdd1396612a8e77f0ebce9b78ad88f215f4eb03e9903dbc7a2a37f8ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9327d51df91ff876f0fdbf1ddde4727d

SHA1
f84eaa9d2da38132d5d8dae73aa5091fdc14027b

SHA256
4a7e57715b68677add0e3bcad46dc43c9e2731ce07be3b16f933481fa81d8204

SHA512
fff804c9950d89ae955e0d699ff38adb396d9387983526517d33f22b986c4c276b8da542c70b07a15b2550b19a3fed4c9a1bec5dc3ccb6d9f7f70a1a9b75bd41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit