c32b4e9325a05b6188e82a18b5496d79c33048dfdb1f14c0a309fe77e93a3ba7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b42950bf7d4f630bf9f5ed10dda016_JaffaCakes118.html
Size

141KB
MD5

24b42950bf7d4f630bf9f5ed10dda016
SHA1

577c0503ef7b378ee0ae90033b1f95a3786b2035
SHA256

c32b4e9325a05b6188e82a18b5496d79c33048dfdb1f14c0a309fe77e93a3ba7
SHA512

15892cc0bb4eb4c660b1b3a4a198e79c9ad2a2c93e1a8b25c512dd2c67433e89d7cc5cda36013e43e6612675d34094473871bda0f2b650acbe4962b253e4b38c
SSDEEP

3072:y7H/QdTmp+0+vA25RxWKjTQIC+jzQj/k82YmzKLRF6VxkV:8t25RxBjQdb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
2288	msedge.exe
2288	msedge.exe
4300	identity_helper.exe
4300	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3272	2288	msedge.exe	84
PID 2288 wrote to memory of 3272	2288	msedge.exe	84
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 3524	2288	msedge.exe	85
PID 2288 wrote to memory of 4968	2288	msedge.exe	86
PID 2288 wrote to memory of 4968	2288	msedge.exe	86
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87
PID 2288 wrote to memory of 384	2288	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24b42950bf7d4f630bf9f5ed10dda016_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe42d46f8,0x7ffbe42d4708,0x7ffbe42d4718
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,865677122002999440,7098664452247774210,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41e83db8-2c56-4282-b0d0-02e43b1099a2.tmp

Filesize
1KB

MD5
97f1ac55f5ed3828d91578e5d3804d0a

SHA1
d6ff4f11d4b867373a0a62afc01ac9e57ac91c8b

SHA256
925cb60d1bd8f610339a078d71f705ac451555b89e69cb87a669d85adc83e457

SHA512
728b82268645fd52255ef47187ee3f4ea6a0333555b00b7398104075f4c303f2906397e2af4424f2a16b30087bbcdfb1d96f81ecc3a44f16ded96497ee70adf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
491e9812d91400e2f7d5232b302ac256

SHA1
5313ccaafb69ddaa85e36b1ffadef55818d17161

SHA256
a5db2fc44710545a3e0b3b47d314559cdbf45c2c98ae8ce113d0f79d4cba7604

SHA512
1f2de640800c343661b732a308f610c0c162aee9b1427f2a35d17d2ecca0b5e7dc2a6cd96c0f6a9cdcc46c7a4859f668a76becddfc73d8730da079305e674316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
3a6777764ca44fa8cf755ed847a6742d

SHA1
2bac5a400ccbeb9fc7d4ec01a79d6b6b988a3e7c

SHA256
b99e1dd192d95b39a1bde4e6b96fd32a8147df5a42f6fc40295941aecee3aad5

SHA512
2e9c68e3b238e7345a2ed73e90d240246b11aa241f276ad6a820afca6e8c3d788ebb384ba0a4665fa92da0246842a6994f83bbc17b93b64f9f11ddef95a4750d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6aa465cce1885f527aa2c5591e090b14

SHA1
a20517e6a9516eb97208364cc62b44fe4620b3ac

SHA256
0750c170cbcbc3aacb1e5a961aab337c51ace2dc855d9d988d4e0b0fb704f340

SHA512
8f0a713d5f02a7c955959fe36a225d7c98e68be3f6e7a4f74349b44e8de61155da63502c78ea4facc104c11fe985eeab62f7f1aa7060d06a5d5bfcdc9c27d814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6a5d0e40a955aec72ca5e6cdac4f2b4

SHA1
bbe58f4d42fec91a67269b35dfb21c305badc6f6

SHA256
6a1c73baf88388a9aad5c93cde1c40a67a26144c7cb6ad571a11a3bffa7e0c27

SHA512
fa1aa7e96f53accba4e41250cd3dde5aeaccb5071c288c6cf752819096336667d9b1e42b65db4b897fee366518d83bf594b80d44ff08ceb5c1e41941b9fffee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0938a71b908f04dedfea8df7a581e23d

SHA1
9b7bbe40dcad349fe552abe75e169593c98a8c64

SHA256
dbc516868dbb700f8188300fd9720efacd37b1644aab969022197e7315212ab1

SHA512
8aeb4db118e95485254f813b34a8d58249422abcf798804c6ad5884f6289498d3177beee8f9f3a5116ddef0669f748ab84aa07d03a4acd057c2523b438a616f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f0b5ad55ba186f6817a3ee172abbc600

SHA1
d801d3c7e3a7d6c4a1d7a65536ac807c9d403003

SHA256
b79ec54bb6b860e0f7cfd0535a313ce666b293808970e8049a624e41ebac9c41

SHA512
c65eaa8fadf817b39ba1d7b6680f6b9bc787a716e1baf0d741720d829103f7afa5dfbaf5cf455e3255f41305214772689bd2a1f6fa2e3113a9948f0d425d2539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
376bf7beb7ca742605e5cb91fe313651

SHA1
22560b6c160c799093b7bf8c1aab5561779204e1

SHA256
b20455d259e35752187a84cd17853cf8ac0649ea2bdf02c475c16683fa4ecc6f

SHA512
fac1d146339183bba5843bdb78971882f3043042aa06a695286845b14e5f639c4f7d35604b5effb09d0a26a7873084633b2216d5d2f4d6953385d2c7001bb5f9

Download Submit