e452d8aa5fec65c4a6f5a6def1ef890bfe1f39536b47afdce5294326ed79d868

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3525d8984627f9872e66b259062800f0_JaffaCakes118.html
Size

74KB
MD5

3525d8984627f9872e66b259062800f0
SHA1

2096bf98d01f4bfa634ffcd3dadf90a37104568d
SHA256

e452d8aa5fec65c4a6f5a6def1ef890bfe1f39536b47afdce5294326ed79d868
SHA512

64a1304159feafcf8c19f051895fa84971e1703671388f77bef4cb40f2848aee4f2a12813dd6f13fc08373faeffc439e747377c609d9709fa4fb48db7b1dd826
SSDEEP

1536:lgUyKJdlVG7JQL1AtmOAcH7XI1QV5lzitBO6o3SIB:mUyKJdlU7FMOAcH7XI1axgO6o3SIB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
5040	msedge.exe
5040	msedge.exe
2888	identity_helper.exe
2888	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 452	5040	msedge.exe	82
PID 5040 wrote to memory of 452	5040	msedge.exe	82
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 1176	5040	msedge.exe	83
PID 5040 wrote to memory of 4632	5040	msedge.exe	84
PID 5040 wrote to memory of 4632	5040	msedge.exe	84
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85
PID 5040 wrote to memory of 1644	5040	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3525d8984627f9872e66b259062800f0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfb8946f8,0x7ffdfb894708,0x7ffdfb894718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5811121262399143374,5119218184940144135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
aa5b8a5ae8ec0d7349ae40f01ce6fa88

SHA1
336579be1c4773187f7a66c73a91a1f84c0776d4

SHA256
3b5eaaa417db9c85ec6fa49fc65937308553bdec6bb708dc9ce3da08eaff1e35

SHA512
6c3c5e692883d2a43ad0ac8ddd6cf840a4dc53a4a544dc123ac9715ce100d9f1f7e5f245b4e55b8ef86e764a2883fae3abdbc587eec17a89b326a02a96a1019d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
47f10ed59b5e9bed97cbffb9204904db

SHA1
9a3057811953cee3f8115e111c7cfe28d0968e86

SHA256
a4de9d2dbecb9120622dca7117911d7996d40d095b84e7a7e24a70cdd85f390d

SHA512
9a4cdb4f4380b8fd3d862a35310023a56ccfee501e09b79c25ab3367a46992d541802259ab19a8d0d411824ff5702819c4a43130b4df1cdd69b3fb8970df05da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
00c0b91810d696e392dba1436da06aa0

SHA1
c48932539158610d3648ad3feb12f300d35b2e90

SHA256
c20917e284c5cd48cb02dde3ebdf6ef3ae9c3f0ae10378a49db15a404b8c2cec

SHA512
141c42e67971d05988f93c69e858f0a9d26ad744a5c20d060722ceb79d52494917c7353df41b86e904df58aeadd4cb4cca3583e9926b092eb851c02ed7026099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7fb62bf78dd1c399d32262d21d5b9577

SHA1
9cab53a7765f6b464ceece9187596d990188f275

SHA256
71ff67071917346b11c4a4a15e73a1d87e7bb9d0acfd94f5001dc774eeec9014

SHA512
fd10549b8a7edf627c056ebb48786316ed7058dfa5d521415709d00d435ebbbf9b4223ecb9c2205c0c6265914ef176c76e594b96a77dfe77a235a3b63fb29965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc350f324e94e59298318a199dcae622

SHA1
d69eb9529c58aae804154a75bc311c7888d3ada3

SHA256
ed083ee7456abcce547472ae7de7ab52b447d233e5a16ec87803ca83f9858e04

SHA512
53be85d490945fa65a3dc493e257b9d501e176c9d8c2412bf658244312cdf6a75010bb88bcc201f7ed8b7f619db1704114bc21f3b6fffa797818e871ddbc3ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8cd60d8bf8492cbe6820b11b3df7b445

SHA1
3201327f64208c55267a3e35fb2750494453492b

SHA256
9778c768cb0199f8ca62f3601d191a33eac7cfc63666fbdac4dbcbece1b861da

SHA512
3f0e4498d80c9689d601729dd0fe83c7a0eae96b850f7613ace57ad2c4de42269b88d293dbc70cde74039fd00f0d702ad999ec4975e26656fc156662f9f443c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6ebdb71990d014ac6ff6a179b0eb9b1c

SHA1
2f9ad87deb99671f1e6b82401ba4ca24a26e3ea8

SHA256
a64bdd7e967f25c39f01db71659b7470f4f1186c33c5bf45a909a0dc1dac8695

SHA512
c91b8683b0b9cebf0b6c546aab5648a6887130e5c4e0a8d16ead505550fbffd57e036f76bf1278063fe3e69307e8ade7bcb1d2e20c92d66120dc96b76c42fc20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
85af7112a02dde9f7309fb842bbfeabd

SHA1
8ae582bbb01bce48f247479f44ab8ccb54d90cd6

SHA256
21a60e06c1acebf924cd693a878624e41581962f6ba400f876fddb30e9986c69

SHA512
2b41b5e17deec12f66056659eb2b267cadbe86e689768c60c3f0eacbb9018eac2e9497ad85c2a4f0464da404a99977ef6b8371fd5461914676200bef0b34b09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5fe2be154488afe59c69effb77b3ceac

SHA1
18bbc493510564dd71f722445b4a7b94630b7388

SHA256
9d48fa109a6cba18a62ba64fc3f885821d86c74f46a2880910d0f64c725217c8

SHA512
23423773673f8b22c9ab43385f11763573959b7cedf2bf0481cb461e74b6f7ab9561edd8d3ad4eada4dcc280e5bcc44a5fa13530d36af156a96513cb73040ad1

Download Submit