b538f69159128be13991e3e2975d2756cbec5367024b91cfa2df8cceab6502e0

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48fb81bb4861a2f2b9f8f46455b021bc_JaffaCakes118.html
Size

31KB
MD5

48fb81bb4861a2f2b9f8f46455b021bc
SHA1

e3116e6bd4a6dc151abe388cc46d0fb18943b6ef
SHA256

b538f69159128be13991e3e2975d2756cbec5367024b91cfa2df8cceab6502e0
SHA512

0468c8521abea05192cbb8061306e94c7e239c55468e9da71a7ce06d37452f5dc481b9e2162aad922e232475523b115a25cbad41cdbe61df9a2772fa9f43d536
SSDEEP

768:nVekip96/obOMOZIFnovpxtbDiV4JCXAS9I:nVeki2NIFngtbDiV4JCXAS9I

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
2876	msedge.exe
2876	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3408	2876	msedge.exe	83
PID 2876 wrote to memory of 3408	2876	msedge.exe	83
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 2380	2876	msedge.exe	84
PID 2876 wrote to memory of 1164	2876	msedge.exe	85
PID 2876 wrote to memory of 1164	2876	msedge.exe	85
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86
PID 2876 wrote to memory of 1996	2876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\48fb81bb4861a2f2b9f8f46455b021bc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffadd346f8,0x7fffadd34708,0x7fffadd34718
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14244427197582307069,1062150940342792432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
32KB

MD5
f69ec88aaf8e4e6c8757a523eca2a6bd

SHA1
23c42b75e088886466fca7dc0295d0e3ff20568c

SHA256
a8ac8c6c9cae5af31953ff6be9933f5317856ed2305a921928ce21f87958f43e

SHA512
2b08955a87cd41a5cb97673eb086bad6049d388131813494f551d97ee95d5899a4dc4f9f3820f9a56c759cccf442ceda2c14eb10be440015aebb59cde48d5aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
97f199034162b1283dbbbfb994def15a

SHA1
539f1d9814baa54fd3425ec0139f3cfa932301ab

SHA256
3cc79470f85abf02f16c22e1ab349ea126a5d6d1a2da8d302155e0dbc26f0d7e

SHA512
ba709e9f101f44349e356d0d2c126a7eb07b6400d4c2ed5710caa4dbeb5fb33788b162f3b96d6ec2e1957d14229ff17af3be8606740998bc4ab82f153bfadf2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0a6df2719c0996fd35fdd8912c871b5f

SHA1
3defde567fd75022fa1f27c8b01fba0543c513e1

SHA256
ce9d0f3b8e7e97ee34016c81a7484a4273c2cac48dad4958c44cbce2f1bf9f1c

SHA512
fd4337443c4367ae0e77bd23b6931e3489d2ee6144f17ffe3c0a3e915c696a523d1e1216f0c4b3c9c688280d5cc379874f39b8fd88bd20cb6444e0cb6eeafbfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8b5174f73a39b28c5576175d8867ebfe

SHA1
e40759a7d0dd0f453f06f5b8488caf9bb172382a

SHA256
c6d3949503d95390f7c3047aff425c6612f94344de4648cdcc4481554c510336

SHA512
848d96519f1d48d472fa76c976c5ec08ee88045941fa0a29c2d1267f853781aa6c2f4af3ca958adc87dceedff20fa7940c8d9fd41343a3c993cb7af6d6700789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
eeef0f86539a32ea7ba5b6911a0ba906

SHA1
38ced88623af9d4380a7444607bb533325eb96a9

SHA256
a4af4db98c3790e762262c94e6623b238708cf2b02cb582e62a9b0f000c075e5

SHA512
43039deba6a4b66617c764cef33870525ebd39101694d7d7c66efb14645552d7d8c64620264b5a74e2f3a01689c889c38fde2d624427a7a7b1fd5dcf10df7e34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3dbb698d51a8501228428a2e17e47014

SHA1
2e45db3d7c5e860409e81675916c77e3a2e8f9b8

SHA256
f7c0b245948da7a658cccc80b2bcd8b2120912dcb3d427a806bd9e0657c1cb0e

SHA512
ba04c0800b35854bf9b2171a5964944e581fec16b3f47e4b0ba72491980de7e75f15bacd81d39b9e7bcc714ec73c3bb089d0441d8acb68bfde9d30b9ca6e220e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f61097a68125592ef3c99d3d6eb6b68f

SHA1
6eb9deb8e6668c2ec8cec93ced83cc3e26daded3

SHA256
2c98ef787622bbc8cb10f5c2ec8a3c2203ad70b1fcd2b48c4c3fb60fb27967d2

SHA512
cd3a86a51ef2b8f0ff75adda4fd607f54f649b738568cb12afd3efdff0fb77ef946559fc2255468bfb36a660377395884c4bf2b0d3bfe96d51f1824d04c1e9aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e51a91ee-c4a1-43d3-a0e3-15e728ad8138.tmp

Filesize
11KB

MD5
0928c94f8338fc5f1b5de400b0820c9a

SHA1
77ea52900446cdb11b166dd35c9e16799bd336f1

SHA256
a4b344a6a5117725c317193eacbed44aa68a3663fa803a69bd34858655b3008b

SHA512
f36df22111286e827025100d92866664a967c6b35d910c6765a9fb285df5d724c39642cbcb52d2880e7a70c718dcc247bc25124be22d95b58082a44626605aa5

Download Submit