b594231afb4fd5bfa07d6747e599196b53986d003912ebda8d03b7f04ee579eb

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e765079c366ebb10d0f4f6e5dd2e771_JaffaCakes118.html
Size

59KB
MD5

0e765079c366ebb10d0f4f6e5dd2e771
SHA1

fb94bd4ea1304eb1dc2df3d45d29f25fe31fdb25
SHA256

b594231afb4fd5bfa07d6747e599196b53986d003912ebda8d03b7f04ee579eb
SHA512

c68965a0eb78feb7596945ece7d47bc3d14ab30dc0fc504a8157dc8572650d810141686b1f4308334b67a5fa05ac167d60d265ac2b6654a9f1d567b0369cb198
SSDEEP

768:50T0EipBxBvhRWOQdYtvdJMD9voPxpuz9B76hK8q29jmv:yTupBxBvPWOQmBMRoPxpE6hjG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4768	msedge.exe
4768	msedge.exe
2532	identity_helper.exe
2532	identity_helper.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2388	4768	msedge.exe	82
PID 4768 wrote to memory of 2388	4768	msedge.exe	82
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 1164	4768	msedge.exe	83
PID 4768 wrote to memory of 4776	4768	msedge.exe	84
PID 4768 wrote to memory of 4776	4768	msedge.exe	84
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85
PID 4768 wrote to memory of 1952	4768	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e765079c366ebb10d0f4f6e5dd2e771_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8a2246f8,0x7ffe8a224708,0x7ffe8a224718
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9614694571041999386,1387323937439647920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
9fc7e867e2e1c705a7abfebf35a5eae9

SHA1
d3c48fb4eff447f5c986109f3d1c2c935a9a4cec

SHA256
1764b6499a095c8052355c643f89b0e30c7fd521d42b8f1bfeb92425fecff62b

SHA512
ae93575614658135045712f0933f4fffbc0afb3d70c416ae2f382099dc6d6bb52507926f93bb0a1653d98030e2a0ecbeb50150299c9b8aa51a40d913f0526899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
f5056d957a3c7fc1d9619fa5ecc5575e

SHA1
d25994a77b31c19d35f1056503e4999f6c74f688

SHA256
c4ed7538bde9aad61801476dee29c5fd76353f1b11696cde62abc184aa8cae3f

SHA512
507b5e9aee210f5894c604323be0b2b091964fa0ae9e69952a20da10398cc561a3d12ea6e4e476dbc3619fea2f2ed12618075694650681a8b6043be7c4df97ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a5f055ca2e3ce4485d685fc8d74500c5

SHA1
c176dab9062c546dcfb088feb13fa2bfc6e6d35a

SHA256
2ae54f8ac2a4a6bdac2695237af0f772910c613de8cb6afb432038a75af06736

SHA512
f7906dd3419cf91cef6dbd8bfb413dc3d664815c4a71496cb2e341dd3cfeca08dd1e517f5ac542ca4ce6af7a71e7b9c7333869f4899b7ab643df105ce2fb45cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7ae6d7db7b1e0d00f08315bc46a5e525

SHA1
b4b0ac052990ea838351d11d6b17ab162ef77667

SHA256
bb8750c2861fc2d13edb10303622bcbb1fa54a4bbde07cd45d33a36be7fc3379

SHA512
fa8f7b49cae91f0cca92bc31bf6c007f6cb48d770387210e621f6d2fe9f893e99ad7de80adf3c88fb683dca5c521ce8c137e13349e194bc6ffbab44b9711495d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
798ce0738e456aeab8efe087edc726b2

SHA1
281fea0235c66eff1c2dd2913547dc0391a70ec5

SHA256
7b233586e1663b1b816fbfbde29e4b63c93017623abc084145d4fddd6b371202

SHA512
8e54d048ae65f039d75c7f3b62f45f8b259e3e98e71078d9cf992fec5630dae5e2ef60476006cf2f7d92923ad1e06f2f4ccd9e89cfa47d1c09a98d91531f014c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d046c762ffba68fd75b1324df0779b0

SHA1
3c05e330bbe9ab3e758ab6a0c35488ebd9fa27af

SHA256
d13558c5b2b2f3ff1590b839846b8c76ce378e1f7e0e8d745832170dea7b79bd

SHA512
a7dccb416804475eea716f614c2275f6c76cf42d186677f3c1042ebc7140f3a383721cea19bdb319d1644140e4bd3371fd5e278d1591cfc8009bfccaf9d3a697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f1ebf25a83a8fdf6d594cbace083eb51

SHA1
5e86768bee3bb3c41ec323082d91e72ea8eaa1f0

SHA256
1957c1fba3325d39e5af263b0260c08393520ddfde88faafcc1ca5ed9c17f410

SHA512
150e6a16adb3633f717fa09a12891f0c48ac52bcf30769674391b9c685cca219897086eae006852fd483c8e81141b7ca2d111b4569b3a470ce5e82d06cc239f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8dc36205d499b40e4d6af8dd6b68849b

SHA1
01f19706f12370cd03046e426c41ff96ee6457f7

SHA256
971ff90d47edbd9ab2c94d99082aa50530db8b2f73dffa8648b7a5ebe7d1eb52

SHA512
62bcc9d33a3af9e57e4e3b25cc5e2be5782a9e5dfd424ac940e5af2757701f330879cdb4af7a6d1444f00dca3042cbc22e4b6084dbc666885a5d8836f5edaab2

Download Submit