f2505bbc026d32970e18dd6e46f3f49efcd8889e308fd8ec7cd40c0f24b6f01e

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12fcbcf79695d9adc84ac89e121db12f_JaffaCakes118.html
Size

114KB
MD5

12fcbcf79695d9adc84ac89e121db12f
SHA1

8bae231523b63962ea1be0a6b2c36c99ae936edc
SHA256

f2505bbc026d32970e18dd6e46f3f49efcd8889e308fd8ec7cd40c0f24b6f01e
SHA512

841ef77acc2e7e488fabfee25a1095e50332f7ce08fe8cb85ba628c4afc866e337fcc72e2559b3f590c087db49467e6eb8c62e35c830ee3d6755b7083b95b3bf
SSDEEP

1536:kkclJQvH8l0v4hTO3nOUkOuOcOrOJOwi+Gg1r7Grg9OytJgUsxMH:kkclW/w0v4ha+UzFcT4Xy0UsxMH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
3456	msedge.exe
3456	msedge.exe
4280	identity_helper.exe
4280	identity_helper.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 920	3456	msedge.exe	82
PID 3456 wrote to memory of 920	3456	msedge.exe	82
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 5084	3456	msedge.exe	83
PID 3456 wrote to memory of 2332	3456	msedge.exe	84
PID 3456 wrote to memory of 2332	3456	msedge.exe	84
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85
PID 3456 wrote to memory of 2808	3456	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12fcbcf79695d9adc84ac89e121db12f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff61f746f8,0x7fff61f74708,0x7fff61f74718
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,13574367737306974350,10737542653698812548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97f0c737-56a4-47a0-b213-6fe7b765e5f5.tmp

Filesize
2KB

MD5
a7cc25a6a9481d3f66aac269f20257d5

SHA1
2e0af07942ea423c55dfce20df4559c978455c10

SHA256
3264769d604ce4b237a5d7016860039c2c0f20ed7d943226212d58ac7fd33320

SHA512
ea31b33687c9d73c8f99f9d5ea1f7d9e4ce688ca4580139470c1e9c07640f512d15b5c414123470cf244c92ac0b0a614251b9306ad5c0f8143f1413e267d7a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
ffb691e825f8c426a70e0a6ed035dba8

SHA1
4d0a62e26de4ac0f59a3036418e14660785185d3

SHA256
e244a2c0b09de4b27388d93ec98fd51d32e8a1f43fdeaf65c67a9bf46eeab5f6

SHA512
8ad6633f701a03569fce98a9ddd7c75f3fa697c6be240e978386c236de45660c60b2029d874ffa2d75136acfc950a0038f34dd2b043ab33186b8b64444eef5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b008787b69eab44cede7d1f8708a55cd

SHA1
4996708b401f1eaf318f7218f54ec1986f22ecbc

SHA256
f9f1973ab09702ef8f5aee8581ebf25ef1496c48b81085915a2ce74446009efa

SHA512
c76ca449ad078aa43a191a9993b0edd6024c27fd46d549f97f3752c0f08cd0c8421e1d6d329b60fefdb1a41ec241e73f560e98520fc06536d4f6c18c8bfb8855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
64899d43086704e8262442ccd04a12cc

SHA1
20bc4bd0af6359869aeed7d1fccc4b4d225432ea

SHA256
770b6ac16596ef5257c3bc6d7eb4765177aefa21d858a74c5fb6f2d6e4393cae

SHA512
22c02af053f86ad6022a433354d38c8b15a5057a88404e4e9a96eb25f7da4b88831f831e9a1dc3a7587b420971d263c3bd649cccfd84ca11c8464a5c8549d535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3ca02ba4eeeb53d5f7e7f233121060a9

SHA1
e74a147c08fa96cacb4492a235216492b385a82d

SHA256
5eedfad8cc23019ad440b82c3d33ae4ab896590147880e3f5acf23a9da8263d4

SHA512
d1433134396c56fbde768b0a8b03a23469428038c50d3cdb84290c9f2e11b226cb9710ee6e4253c3fb752d11171f4313783484a15fbba75453941e5c40fd8ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
869aa7b6767b1bf11a66a25a43d26628

SHA1
4679eff830937d4e306c4a2068732217323f5915

SHA256
5d529dad45eef5bea654f9d8d8fe227866ddd9d35d1f65215019670b19e46f27

SHA512
3218b635f5dfbad7615aef24d719c0c28eb37ce95450c3466ab4296306b1d4e23eea6b38eb53a4ab6cde7d22ab843a1fdc5c2be67362ffb76f633e5eb034060c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e36892c747125aecd93aac09c34b79e4

SHA1
2c75ee030a14c911bd3739e5726cbaef5c2f3a2e

SHA256
655d6c5ae084574bd9336806fd6e449911d5277b7a29e540520401e0404828bf

SHA512
9736af3bafcdf63be49ba7131fe340cc7e93cf6cd61d603faf7c97a7ff853279d65ab63b6d650b499b485848d70634c54f8a4bb87c70bbf2f3e6f7aa6609b2cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7363569bd73411feb482343b16414aff

SHA1
9d5fc5bd937f5a105600f9546de0cfa9b5d0b6cb

SHA256
7290dd7ff662328206dc670cf4a5bf4b582a12d769496e8dac33f6e6b7422e0e

SHA512
6bfbd05aac185666c649a0bc54818e96045d66dd35c910a998636751166a72d8e07ada0d5349dacd14449cd8e9541321e21e8814eddaf7168e5eb7352e40ff0d

Download Submit