391280934a32eea55bbab4415318b5faea539ca2101816289630991daa36a0d7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e066d0e3bb89518a124599bf1c0e24f_JaffaCakes118.html
Size

175KB
MD5

2e066d0e3bb89518a124599bf1c0e24f
SHA1

96023305f70e71a15da9d0a7c53f738e15534e0d
SHA256

391280934a32eea55bbab4415318b5faea539ca2101816289630991daa36a0d7
SHA512

fbe819cfaf28e37c044c4138c55c07d6d7a7333aa47ff23c3499119a7aae929692489ead17114c7a9e835317f9ee6ccf3116537fb3bf9103746943cf4f554c8a
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3pGNkFLYfBCJiZe+aeTH+WK/Lf1/hpnVSV:SHCT3p/FSBCJi1B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
4564	msedge.exe
4564	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4412	4564	msedge.exe	82
PID 4564 wrote to memory of 4412	4564	msedge.exe	82
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 1636	4564	msedge.exe	83
PID 4564 wrote to memory of 3748	4564	msedge.exe	84
PID 4564 wrote to memory of 3748	4564	msedge.exe	84
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85
PID 4564 wrote to memory of 4972	4564	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e066d0e3bb89518a124599bf1c0e24f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf146f8,0x7ffcaaf14708,0x7ffcaaf14718
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,17494024191460504081,1773224621380598546,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
19KB

MD5
750ac1afc9ee7dd557768978d15fba50

SHA1
133e9d996f8168881eb07ba83a018f738f5c35d8

SHA256
e1210625fe8a5279775627c004cc39fa045940ed57229f39d3d472c53d306fa0

SHA512
1b1dec12c116459a70bc7dcd657aee3c1616e75c26cb02db4775177cc2a76d616e3156c3c12914b8fa826b9009e2715a7a1215c8ba317737d01129418717ae50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
95KB

MD5
3dfe21a99e36122cd7546f3715bea195

SHA1
cf14a670e3173a6a2228c2a18f814500ab40fc8b

SHA256
14fd31b8f71e6608c396c2016fc1679e154c31e83321cd66d4240bac07a7afdb

SHA512
8ff358eace7ff2b9561998755e47a8e85321fdf560788daa14ea0305183e8d6b999639775de37b1fa631c74ef05d9ce553c99190192ff1b5bc229d1c70ad2e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
794KB

MD5
94467638ef8d7e781e4a65449cfd0cdf

SHA1
07b315043c92ca7de37c2de6e791513869a17fb5

SHA256
ff7abe86cde71bb1d9534fe637e35b9922b84c1c9ee5ed2a447b5086bfea9b9c

SHA512
c8ea932dd4f58d981afbb465b0d64edf3ed79381e2bd14e1bb76b5d2284e1c72c17d5f13088d5adb062bb5367f33a045f0068b4eb15b35841233275575daabe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d3de48018f8956fddfca5ccf5ef0de46

SHA1
b506702b5ed501418730cf43956921b7408ba0fa

SHA256
ad2bd234030cfd4c9fe0e3e5ec210975b6a3e9d6268c3fec87041d6cc680623e

SHA512
78a6a156f89a5f1f14b3585d0d7fbdb1433e2281adad2af81ed53efdbd4c18144e8e2402452299ee5e3f320be3d42bc052bbc28d7d03aca708a2a600a5f409b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a006cabf89a77336a19c7280f0d0b226

SHA1
b6abd704bde34c121f897fc370f411c8186be162

SHA256
800b6201abaf692a3365e2a1963ecbb15cd2f8a05ab6c2b3e1e6d9392cbe2063

SHA512
9a7dd3712dcf8f9f214deb551eedb8eb464030f858c677db25f89a1a95a55e7ef82e4312c7f91f6aeb9ce57163ecc68375a34e8053f5057b2f52af675315bc34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fbf0f16ef3162c955c06ff80e91b538e

SHA1
a1a0f14c22299ca418272e97946e6c65a83eca82

SHA256
9235618e27350f3ed7b3adbc3a63d68dea74916f80d4e58b58c867bb535fb916

SHA512
af2142b145d3c9fee2e219452caa12d4afc37ae631caeef50835a1e1871a840a2b83df720777cdacd6dc2cd4cd98b19e1b85fe52df8313bfc406549974430698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4390c978831a3e569894036690db99d5

SHA1
62c36966ba00d0e022a2a951ec613d8dc75e5b08

SHA256
d8a287c3f63e82fae66d7865010a0e742dfcc8bddc8ae3e1eecac29be8a4dd49

SHA512
b44645b4d74b427d6798c3fce740cfa7d7bc9526f54b91bb99d80a945503a500e690651a2fe121f949e8a27c845261db75bd89a4e6e00f9ef7f5a536d5a7934e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d03b36d5d59fd9d272529930f10a346

SHA1
a5a665fff48b98b5adf0d2e14224c0a7a66db643

SHA256
2593fd4654124040a5660ef32420f718d1ba5d9079f3017e549213b0af58a1d0

SHA512
d78e438c2a1dc0fc04a656b127d71c8bd0304ce01e9a11eae0b29015853ad247bd2f0a1780c514fd368b15b62baaf550d9921c1db56ef864f6f41107873a972f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41aa5f9ba406c04afb97fa8154f7933e

SHA1
5db71a214a254f3697ae15dcb8d17c5f9b4e4ae0

SHA256
be148bf26a4ae845bed391abb7d3ae59a6c2b0481ad339d354ab9aad1a17af3c

SHA512
3ce190cce7d25f8f36c94dda0412035a41a5bf3b5c8d97367a7dce332d3cc903675fb9b2cc025651be6e9a0e3d77ed2060806663674f5652003159601f76eea0

Download Submit