f2bc8fc030637d432d38c4c74ae09dd7c912e6e852cbaab88a1bb6a553e56cac

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

217d0278424eb5d7a4b995ba4e957ac7_JaffaCakes118.html
Size

175KB
MD5

217d0278424eb5d7a4b995ba4e957ac7
SHA1

ed8cea5f527eedbad0c4fbf92586c378c2a95be3
SHA256

f2bc8fc030637d432d38c4c74ae09dd7c912e6e852cbaab88a1bb6a553e56cac
SHA512

84d9eddbcf4f287a8b2a1ae2fe6d61d1c9266157d707e1d6c4bd36f0beb773bed438ee59f337fea6bd026ec99c4aba6092d4e6289930d7cf05a93168f8a178df
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3YGNkF0YfBCJiso+aeTH+WK/Lf1/hmnVSV:SOoT3Y/FhBCJiam

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
3248	msedge.exe
3248	msedge.exe
1060	identity_helper.exe
1060	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1320	3248	msedge.exe	84
PID 3248 wrote to memory of 1320	3248	msedge.exe	84
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 540	3248	msedge.exe	85
PID 3248 wrote to memory of 2160	3248	msedge.exe	86
PID 3248 wrote to memory of 2160	3248	msedge.exe	86
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87
PID 3248 wrote to memory of 632	3248	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\217d0278424eb5d7a4b995ba4e957ac7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca3f546f8,0x7ffca3f54708,0x7ffca3f54718
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,15999252693666141100,5333654959921325454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
46KB

MD5
ac83857f0497a4a0e7669329827cf228

SHA1
18ea483c966969e43a654fcadea9719a8aca370c

SHA256
43337a1354f376890cdb73f3dbaf95a8027761c574c30cdecb321096be485d3e

SHA512
6a35c50764d31d4bac07ddbec2329238cd04f2c58c00629e523ae7fc2a7d6be5d1226f8fb6c3c1043b215c38c47951a66fa8a9d4f4d6ddce7664bd1d011db2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
8e3f85590dd2a8bf2b2a97afe84c1217

SHA1
d8d5c9ded154581db6dc2b721cbf39c41628767b

SHA256
f94d226894da5dc807b15da7869a1a8683a5d5f7f411d7d5ce8c05440968813c

SHA512
640b95cc4c7d7eac651fc4bf2941528134a3acafb3fbafd139a9b97e6fe98a7505fb943344308e6fc3c20b722f6ae0209aa68c916b60d2cbb1fa1361983aabaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
95KB

MD5
ddad9f197851bb0b70bf06491f11f11a

SHA1
18091a06704f3f44755b8abaa003a037f234523f

SHA256
acc853579ffcc2a6515cf5a2c59b182c5ccb3e808689119e6535ea33c32a8677

SHA512
b6221df22d58a762dbe08e4fe460da6e711c0b3dc89c8ac241e5a06461e323ee714d7cd817f4881320f2b11e28c42c059eaa78048d103fce223c44d219545ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
2153f6fdfdbaf3759cfc03ef295b06eb

SHA1
0bd2060c268246d21e5696c161adec9c5514f054

SHA256
51ec7103534f68a93d87d6e66180c1f4c8d2a5d4a53fc062e09c6a073488f3c2

SHA512
148317a5007f4477426b9a80837a498dc013f6382dc2e694946dae92f30281d8ac03d1ad71187c08403f3b43c04eeaf85ae20bf58c14de9d507e8fa6679a0dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c1a44b0270335e87ba42582e675d0fd4

SHA1
207a8892a9670a9a60a5260c93c1b2144fdc1fe7

SHA256
3df3ad281b5f9f3f2c09f30472ee9f9f50b9ddf15e3d080df169a79fc48fa0ad

SHA512
00061378d5eb9c63831220f35bcc2a4537b3b7afb59e1270723d60d3dbfe7834070f08b9c2b91d06047fae2f2a47529367db70030dc8100e39716d3ca951755d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3e9bf1827ba8cb4f2dffe5c88d3d2f4c

SHA1
a5c6bcbf51353dbe98c3398e597e0f1fcf0aa286

SHA256
e4eb29157c26688f8e15b354a2ea487749f5d4476f3c912bd8dec82acdeea46e

SHA512
6e37f9840f44c01323116f0f1a25b79f16b15d8552369757bc42a0777ed7115db5186fbfa49bb1e39adf49ba9b62bccaa31cb46b77208a520dc77e2860a881db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d7c301bbb4e1c77718f354701645be1

SHA1
ba3e28e81570efea0a7f3a378f5215245a1ae9e4

SHA256
354d74c3e885406a3e0d2392d8b885d4e331cf669576fd4154c352a840829204

SHA512
9a61f7ef46f6af54ed45fea20dc01b91088ebdb90ec5dec8289db8d6bdaf14b5f5dd7062fc5e3323521bc8dc8676ee00a79b9b3c59323f5c35fe26dea9aadd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
feda74637c1109fd45bf9d94ff27037a

SHA1
3f52da1d097508e67be785c3ab0d23f2493850de

SHA256
d2e6ff7d7ff06f147e54db8d89afa9d464ebc0fc625f59697806a213851e285e

SHA512
803351542eabc3e134a511c0bc1fd04b9479b2031783fc05d178dd9a06e7af3204ffcbddbf1e380f7888ba2520f9461150a67ed85481e4de8d84a15a482e69e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
778feb976e2a135f77a08253996f4366

SHA1
653d0ccddbebc5ecc8499896d9ea3f13d7e105ea

SHA256
e01133c1604b75cf5260064755744b04744640c7d88618c52a138b346dfdb10b

SHA512
939e3f03de553e8985398bbde4f0adc496eebfb5a613e8ac833a2550f231276fbb235d85146aee07976dbbbd4f335f798764d3e40738fabf4c893cd1975da22c

Download Submit