2e40498a34bf6df809178c8a1c9c936b037b3b883adc7f72a3b2af37abd800c0

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2345fc93bb2b802f7f8be01e4b55f432_JaffaCakes118.html
Size

175KB
MD5

2345fc93bb2b802f7f8be01e4b55f432
SHA1

48ecb0ee640ff022874d5c7eda656717e26f2681
SHA256

2e40498a34bf6df809178c8a1c9c936b037b3b883adc7f72a3b2af37abd800c0
SHA512

010b8b332b53865ef690d94454cd5e18d0c79f9f0b1d298047ef1d4a92045818ddafce24589a092af266660a47b417f456e8f786180e2bde3a407ef0603e9acd
SSDEEP

3072:Pz40pGw1V5pY1nC8JxPRjA6KgTh5lKMtOza:Pz40pGwunZZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
3128	msedge.exe
3128	msedge.exe
6112	identity_helper.exe
6112	identity_helper.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2260	3128	msedge.exe	84
PID 3128 wrote to memory of 2260	3128	msedge.exe	84
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 2236	3128	msedge.exe	85
PID 3128 wrote to memory of 4624	3128	msedge.exe	86
PID 3128 wrote to memory of 4624	3128	msedge.exe	86
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87
PID 3128 wrote to memory of 1752	3128	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2345fc93bb2b802f7f8be01e4b55f432_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedecf46f8,0x7ffedecf4708,0x7ffedecf4718
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3982910816231634791,189192848217438839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
77f01b05638f312067aee748af8f5779

SHA1
305151240a4f1f68e88c405ded93418c334f47cb

SHA256
faedabdf06a991e55c7534a3c60c7f8df2fa50adbd50ffea4100693f17411e5d

SHA512
47e4f83b033efc175f5268512db08d956bdd8ff3998418b0082a5a7893d7f3d4de0b000311d201357d5c14cb3d1c1f510613f12f8054e34bbbdc83c88a7b4a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0f8d2f23fd02e875624cf6e33b10d617

SHA1
57ae8a92dc82765aaf8723cb7409b51b1d9636f1

SHA256
14eddc2b358cb3ac7cf1a3634fe7b8ec07d268120638efc4332c6ba9663f2b8e

SHA512
329a51aec96a1f31112fbd36cef15a2047b21a39c5ba9dd221c72f0317d957b922335aeae60cb6564a50d313b0bf7cddff5f4ec73e7fa1ffa1489416f8779a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c1a4124ff18f3aa218d3d6357bd56080

SHA1
f24752edd4db25dc75013a66a49466ab50dbf4a7

SHA256
46f85d0a8d8c631c4b16b52ddba0077765937043edb75c00a4bfd20b667f2151

SHA512
dd8d3f4a5aae2335332b3fae44382147d44dea5c6bd5cd11262da71bd047946074b0d7d6ff6c5691325c60448e0f5c7d2ea653a4205f0a0f48321a11117154e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
679056cb052ad39c9b3e0b48138a5063

SHA1
7e764238a366c797437626d48d0dd8bfbd87cb7f

SHA256
71dffeeda4c6b74ab41f8a2282eac4d7e623c95a77f3d672e89c33615a1b029e

SHA512
e65f3770bf4d3bc33dd80a6569c6eba7d3a0ebbb79b6877f33a0b10c05d6bf8575083968765743651f54c7e5f111162d19b741b2dd54ffc32ed0233ace315c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d73f4db99dc429502c5011c5524c13b

SHA1
ef563b69cd602af8c2644af185f46a0c447edff6

SHA256
10d2b704be437efed79a947df16b7c3cc3ab7b0ecd73c270ad4759f72cf4eff7

SHA512
0c63720d1972e72e103e3506a7b29ba026d2c8ea95ac82a393f6a9fd2a0fb666e05b1f7bbf6e5c2e462b471f5ec4ee3709dccda3ca791708205074c698cb4c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79203b5d3092c65b6e1b4c7805d457ee

SHA1
aa48c0b65c57cffcc6e6859c9c462e51ab84d659

SHA256
ca8451b0d112c97876ab85ed6d6ed13486505f05a695b8c9a0ad1104bf67b441

SHA512
5ce00eb0d10824db113eda8da785cf8662312acc18f908de5ab911f8fafa015c5016d06e69b6991db5b1d37bce0417fc64b8d7e02ddd12d858de78626d9285ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4505e50d176292aa074a385f8c3af40f

SHA1
a7b66e78a33cef1f530f617f8a62f52ab02c93b8

SHA256
52051d7693cf0abf0dd481e42fd6cecbe2319a92f3372c18529ee850772cb216

SHA512
f67e4a7c74a43c5b65e269efcb4131844da0095b9a40c972c60de275eb96f3be7ac04a6ef90ff85b878b7883c8ccff902241d88d2c1613f560514ee85ebc0be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2353e958ad4d0947be6f508dcb828cc7

SHA1
d7acec082479e43ba8cd55aeadf67089764ee7cc

SHA256
88fee00fa509c85a6fae354f92d8d3326f50bfc8961c99f4254edd2a00ced92f

SHA512
90289333c4d46cebd20a9a7e7c8032ce1dc1f7d09230374436d21a876791958dbd46174552b46836bba3fd5c4c0aae59c64f2d221f6c7fe7c1614464ce341afa

Download Submit