0d14a442b3a18afa3c24883d688f59ab5bf9b8355f179b77185cd38a99c5b219

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5f45f077d4551da3a520bc62f1f797_JaffaCakes118.html
Size

187KB
MD5

5c5f45f077d4551da3a520bc62f1f797
SHA1

7a060e4be45eb2ad8098df71033d96a34782231e
SHA256

0d14a442b3a18afa3c24883d688f59ab5bf9b8355f179b77185cd38a99c5b219
SHA512

ced27dd3873b250dff4e18eab9ae5037e728d5e0a3284d4e3f900b80f43eeebd9d78366c0c835665f472c5a94e4183cf57a73d8682863dc212f80e3c7e891cf4
SSDEEP

3072:oZMXanXdRBMMqUSzZl2L5LwPMx0hS70sRiKRP6MoBDdmOOzlWzlbMwO7cf:5XanXzKPmL0hiFpzlWzlb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
4836	msedge.exe
4836	msedge.exe
3428	identity_helper.exe
3428	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1704	4836	msedge.exe	83
PID 4836 wrote to memory of 1704	4836	msedge.exe	83
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 1596	4836	msedge.exe	84
PID 4836 wrote to memory of 5100	4836	msedge.exe	85
PID 4836 wrote to memory of 5100	4836	msedge.exe	85
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86
PID 4836 wrote to memory of 3748	4836	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c5f45f077d4551da3a520bc62f1f797_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb24718
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1771646199212458864,8811378307265346040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
40KB

MD5
5ce7bdeeea547dc5e395554f1de0b179

SHA1
3dba53fa4da7c828a468d17abc09b265b664078a

SHA256
675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9

SHA512
0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
47590d43d66d200da305bb231157e187

SHA1
aa9935afb82107007c761f480f6ab3f9c4a265dd

SHA256
0bb1a9a07f1aeb6e29e9e9b02072093994653cab53e9a33e3f02f1b80238011a

SHA512
e5a46899c35edc1dea114f868dc355379ac99bd2b482ef84d869e0fb4d9b5c6bc9fcd75af175e073907d9cdaa0e7d8f4cebd58dc5685cf59d70de2bbc0c1f7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
106243d7daa16ad59ba623f3ab14a181

SHA1
6cac05be0040c78e249bbc55f6a32855a7fd97de

SHA256
9ce18378b903d6aacefe8b6f829c690fa49bb81a338788adebdc34f2cf13c229

SHA512
b93227759fa812a20c7d34cdded26d73596812626879d33203b75e957b52bbfda66ad58bfaa7d08a672840d8360929edd6a4994c6fdf3a4a7221b5146384bdee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1685e7099d5e281229a22a8b22871d17

SHA1
fce49b03311282d6c54f7d269fc9213f46478d93

SHA256
b08e430caae556e639b237156d73471677063c423d72ead50192df2008b43988

SHA512
dac73712e0065cb61e4222813ba7b7a222588f2301258dbd5d88aca99dbb77efb2a7efa3ec66ee53075598b10012f6ddd55845e3b1c9b9f36fa017d366d46837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b0e97c8839806612982146f96d48ba1

SHA1
eb352c3e02573d2e2bdf82df6c6772d5448dd72a

SHA256
db0844b7ba8aa3c9df44412bb6f4c3017d820fdc70d56b6d87fd148573494ce7

SHA512
fd4f4143b4efa2f829755b3c71f343d39da16df34df76b8da5502c21bd01f488640606c20aa4f97c7cbe11859ac2ee5990e87745022f5848e2b9b146b4efe15d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f0d3697e9bc671043cdc8fd390288be

SHA1
35370dec3aa85e22b660cc8a0bb4d7840e2e6f80

SHA256
0a6d5988e44c891a2df34534c433f3d3d41a4fce93a642490e7f2fba6b79f17d

SHA512
735703aba118eddca7549845519f2a0b4bad3a53830635da45e041c3c43b7e9023707cd842fa1823e63d4a0c60617274f5444e240b5cdb443c9392cf1b6efa97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
311ab8eba3f144c5ce2a7faf37f47857

SHA1
13499b8ab2246edc1d6dbc527df8b49a51157a39

SHA256
776612390bfeb40f525833c89060222272451d77d053d2d836666cd3346d56f0

SHA512
6221c2e9baf4d1e0daf8480b3d382ffd82ef553dfc0f919eded5ee6a5204711bf1dc3d2df484b52d09e268b7333eca39f69023d19e1ecdb0923c5581c232f443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8607e40cb73fdd6a550b139e05934379

SHA1
34a327f68003f7404554d83d0b9613988b483eb3

SHA256
d7b818eda144a605536eaa6d93dbe3f880e01a5484530672b1322e92f9620a8a

SHA512
d1bc77e214f76fb153bf4ba8b78371e294881ee64692f8cfd756dac6448b85269fc7891f058aea7f1a142c06b4cb7965d36355a4d2ed4a843d7521c4e65b6d15

Download Submit