ae714b2f67fd70d6dbdfd607d665e1af7af097fce251b5c2dc6b6aed3daa6177

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

414dfe663d1c5cd14033a573deaff249_JaffaCakes118.html
Size

60KB
MD5

414dfe663d1c5cd14033a573deaff249
SHA1

dc0bb121a8dbb4174dd1567b340d0c9bca34e966
SHA256

ae714b2f67fd70d6dbdfd607d665e1af7af097fce251b5c2dc6b6aed3daa6177
SHA512

655ad3269cb54923c6bf16d8675355f46979025a8b0b7a681f000f518c31ae9e3437e8e50bf072ebc83e6d0455a8ed976524136a633d859cfb72366b80ae2b92
SSDEEP

768:PFYT0EipBfiQSZAPxLlOWigB5FfiE45WHEfFPA8n76suHm29z5Z:GTupBfi1SOWiG/fiEYWUPH6sKX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4640	msedge.exe
4640	msedge.exe
4956	identity_helper.exe
4956	identity_helper.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1624	4640	msedge.exe	82
PID 4640 wrote to memory of 1624	4640	msedge.exe	82
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 3904	4640	msedge.exe	83
PID 4640 wrote to memory of 4652	4640	msedge.exe	84
PID 4640 wrote to memory of 4652	4640	msedge.exe	84
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85
PID 4640 wrote to memory of 2084	4640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\414dfe663d1c5cd14033a573deaff249_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa7cf46f8,0x7fffa7cf4708,0x7fffa7cf4718
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5064620858200885436,12676387747597547372,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
133KB

MD5
4d1bd282f5a3799d4e2880cf69af9269

SHA1
2ede61be138a7beaa7d6214aa278479dce258adb

SHA256
5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693

SHA512
615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
a7f396a4871b475de19eba3dfda4d708

SHA1
98947b5c9b19e4a1e6f823b5b05d580702c4b151

SHA256
1fa83ebc126ef0cb1f85b23154d61b77d1bac1aee5e29572dc9137a18db7b3cd

SHA512
cd9e0bc0a71aff19d39b9e8664a8d2887de5df7de436dce3021775b57936ee4cc07e277ae1b9853ea3548736d0c1ae339d4d90191ce644309d38c2b7531b0038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
4ec3dcd8f987d13c195036a920c6c22b

SHA1
fcfb59d08aa386e8f421a6c280c22282922a41dd

SHA256
8704936169e1229c072b319f82e55bfc108778969d472ef7d5e50cb476eca025

SHA512
7151164580be75da454489614f16fa714611a895a5bbb21335176adeabbff8e6a00cbf6dcb4b3c1d89b00c65006e4d5693db768154d53a81ffb32d01883a2c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
63e76ad5c9e3f7e5cff8357cf0668098

SHA1
4f7f861ba5859b1947e670c9ea1171cf599b003e

SHA256
cbc0ed1b491a8be860285e6156d7ca296a3b01462698a9a96ed37a64c7f98194

SHA512
29747422173795a45c8a3dbfeda21eea9ea2cd3cc6563bdffd3dba7a019654a45d16af7797d96c367c59fc4a0d79bd8a48a5b321e5ec58bdfb90538f250f7466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1f3877280f044f6a2a63c91f12bcbb69

SHA1
2f4872bc7617b27bc4d61b4c984cf5f542781872

SHA256
663c355c46a954092e71a5c4dbede7eb8309edec5a94e1153b1446b8550c6f69

SHA512
a22e0c2d4fe42f7449ba0bbe62dae420175c0dfdc9c0f0ce190ce15911758f1264b4300e168dee16eb892a130d2ca4e574bd98f98d7b158edcf401accd208713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f27e84e52128b20f7ea5b88fdcedbb5

SHA1
02463e19361f57c4a3394fc7af3a691813625111

SHA256
827a9f646f0f126a9668ec6e3074b42e04f019e253b159ce226f245e71aa350c

SHA512
b578714d90b1d6cb871dd1280c011f3a7a798931e38671bd15c7bdfea1e899eb7d7e5a3ed89447b177837ec364707ccd607715d4bd654a5ad31541877b9a1dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1ef09c7d01c67d8dcc515843432f304f

SHA1
6c2f0c731db6f683c7ce741d794801ff8819b0ba

SHA256
5e34f2b36017495d414c0fc58af631171cd7468e2ab80375d8c6855621dec759

SHA512
faf1a7ac86432a3edccc3c5cb5ed97c6f1fc4c5c7757a301f1c3e8a2f950400f0dc851da6d17e75dd1e91567c05022a0ba6bb4b92c0dfe612cf4e1be1eadcffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e091a9071922924492b98b1d4ab5d6ee

SHA1
51ce819aa7c9bba58487988ac77aadf642e94852

SHA256
88f61a3c9345a4f21a698f713a37525202f82e231df6ec037534bf9f6a7236a1

SHA512
723bbb32f35f5120530881345f5dca4b96d72dc9037bccd1e49c420fe24a648528db069db03414c6a1376f918a05a573ce9709aae0ffcb633828bcf1ba217c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
072c94c7831a42f7785a2e136a47a041

SHA1
e630cfd6d896ac011b4e022fef3dd6e66e69a612

SHA256
f52c04da77847a9073d6d4340f48731c0e71a32f855102627e3a9fd89b13408b

SHA512
ba70ce52302d87ee666e23e999e592fcad9abddca6c77d3cae976dbd0e6f58b653d095de8f1e632c476dd4b3772c19f80aa6cb8485afe753487c69f26172ba52

Download Submit