be7ca90631de91e8f7c620bbfebada2d664960e26b1174e1a5ddcde5fbc53caf

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

388a98bcb20db1e3e239d0488c656dab_JaffaCakes118.html
Size

55KB
MD5

388a98bcb20db1e3e239d0488c656dab
SHA1

01430e9955ec96294c637ef68262bf384138edeb
SHA256

be7ca90631de91e8f7c620bbfebada2d664960e26b1174e1a5ddcde5fbc53caf
SHA512

89f5249c671ac036581c041dc1dc085739ec47a02e5f86f1edb5a881c800428381b9d48a00a74330938d9d0e7c5dbab88921f04d668b091425acf076084d2f05
SSDEEP

768:PFoT0EipBTk7x9OFQtgme5LWnG+QmEYb6CLd6oWZ629Xx14:uTupBTk7x9OFQCme5LWnG+pEYb96oO8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
4352	msedge.exe
4352	msedge.exe
2844	identity_helper.exe
2844	identity_helper.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3000	4352	msedge.exe	83
PID 4352 wrote to memory of 3000	4352	msedge.exe	83
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 4880	4352	msedge.exe	84
PID 4352 wrote to memory of 2472	4352	msedge.exe	85
PID 4352 wrote to memory of 2472	4352	msedge.exe	85
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86
PID 4352 wrote to memory of 3916	4352	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\388a98bcb20db1e3e239d0488c656dab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdba7a46f8,0x7ffdba7a4708,0x7ffdba7a4718
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5031089022964872584,6352245782698748546,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
b264b6713ecc72e6f67314b2a8ebb625

SHA1
e0ca717f41f0707741f020763d0e5d87dcc3e7b3

SHA256
4f3446258eb63178c44f6a48fb9ca36bf18f08f16ce89215b88d24c97bd6e882

SHA512
934fca9bbbcb79075737ca6be72119b09690ac900d53d17e4ddc5e30e963e8204e5bb8aeeaca30e3481be4e85c5f07615cb5c55f264b1179877dd7b78b79c5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
df460e9c73db577326167bc5ae3a5ab4

SHA1
1f237c4a792c30f091f07d52f674ac0cef3e5c2f

SHA256
97a1d95d8b6b808a557e7388b35e1fdcfcad68095c8c3c0e2f9369c503148fdb

SHA512
0cf42a02b9e101d51a2bd0ff94267db9f479302fc2bb598830e0683e42339e830a53c82c7614f17a6b8a71b5fa9c96c0baa4795cbbd53d90514d2231d9350297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
237ed32dfda0e1d151031056c5745d9d

SHA1
4cf82717dff786d15c9e936ef942af217c768b76

SHA256
f33b05af210fc5f130c69fa645a8b5660fc3c679be453d96edf762a55a851c2b

SHA512
2ba9fcd2197b6f9528ba0f3d4016aa218a25d982545b17aa0434f16c7321c57063d8948e802172034048fa2b4f0a724a4e45d14b62fc0739cf8b0e2755f2df20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9a2d1582cde3e38e6c62feb3d6d0a0d6

SHA1
58a2e2c3a823d56dc3a891bf544de22159f220a1

SHA256
2a058a3a165d0553e5cb824dacd74e362bf75349f115af89009e96f570196207

SHA512
4d8c531df0a81c35229f69016c40d93928ad12ca2578dc16d0ff772036989d19caae4c7b6b17ce53d519f2c626865fba5e9282a903d8fb24b1d6eb1d453f575b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
611d7ed3744d7561c6815e83fbe4e246

SHA1
1b2cf263c1bd26f4d2019dd4d5d758c53de10b2d

SHA256
f47aec0588548762e47aee50687b2fbc5a9986c841fdf97e63a1349ad7131c68

SHA512
350ac2fd908144d716dc191ad6f49a63b311870615f33b56bd76044aab4918f0fd2d77890286edcb23e0bccd7fb3b4a2465ec5517a5d4f0ce28d811627739032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb4bf38e4b7da80d7f5deaad0d971ee9

SHA1
1bb0c3ed14ac22431a0d413a466ec8149047875e

SHA256
37d69e9da1dd6a568e6f857020a5f1f6b560e9ee90f579da701f647171440cd3

SHA512
c1d6e6d55a1db6e2453058a8b55f4f317470119e70855271b82bad00000f180caadfaf0bc6e0330a7a50e3f30d3f7c2b3be4c0cc458315534ff89892b0eece05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
969368c1006b380bd6e8b8982e6d8855

SHA1
275ea5d0fce18fa456b28c4024be618b47c8a9ed

SHA256
0ef5d991c69fe1cc7d9f8f860562f8f01857dc320895e74f865723268235d809

SHA512
1f5ac63599a99c4fddcdb7a7edb6b8d48bce7551f59282c491eb643967df9f0a256ca7b72edf7590dcb8b6d50c0f7e2ff846568b5f0f0788af3d4f9eb220a081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d31a3ad60c23aeda1667993b5f487a93

SHA1
9199fe5895a544a34aec5a592a42b19c7a333f56

SHA256
8adbe13901910d6be7c50567297a0a4a022ac599aa6e31daf9a24fdf7aade20e

SHA512
ccb4cfbf74f140524980a00a15e9e379e8497dea2fa41e7c44a5685530f03f177d50050ad3fc339fe68c123eee28798955ce1b2a756f514c970fe95ef19b9997

Download Submit