b726c9d2d583c329aac5329eccf55bafd91a1f631b83b506c6fbf3726cdb6196

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

643bd620b018106d8b48e2f7d8a36b1f_JaffaCakes118.html
Size

74KB
MD5

643bd620b018106d8b48e2f7d8a36b1f
SHA1

6606000b75e207970ab86428d9173e5fd8c1393c
SHA256

b726c9d2d583c329aac5329eccf55bafd91a1f631b83b506c6fbf3726cdb6196
SHA512

c0f52c57b1855606debcbc6a9cf6e379e7274593962a8b9ea959097ffb99c3c83add82b8933e1b2835ad9ceed42cac6ec853916a882fe8565cb3f9dbebaac8c4
SSDEEP

1536:eGw4I5khqCOZyP47jFi4o/LzM+W3tyffPiwBINTfjBgEJXz8SNgv7B:ecITclgtyf3iwBINTfjBTBzzNgv7B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
1760	msedge.exe
1760	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4432	1760	msedge.exe	83
PID 1760 wrote to memory of 4432	1760	msedge.exe	83
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4504	1760	msedge.exe	84
PID 1760 wrote to memory of 4384	1760	msedge.exe	85
PID 1760 wrote to memory of 4384	1760	msedge.exe	85
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86
PID 1760 wrote to memory of 60	1760	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\643bd620b018106d8b48e2f7d8a36b1f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8660172164419819017,8510364957634549370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2a71bc0259261040fde6252a7cc1e9f7

SHA1
6c1d1745f3c0ed054b85abcf2964059ea275c4ac

SHA256
baeb1fdf9f997dfe0813801b7bbc8cb030cf4d54b580f7cafc35a635f9af4aea

SHA512
d396c8a2239e9dba1d57c5c591ce1351fede02001cb0f7f7dd0b980e2b667bc03d4035657466b70b6bf12ee6c87d39509a92ad7dd967f20140274cac32ebc545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
4b132a33ecf4ce4921ddaf94c2de6f80

SHA1
36282bae3848d7b2cdd6ba446ad0ddf106f67e91

SHA256
9200c9d01a6daffbc3741f8bec18ab2a11354b0dde1725d161b615254ce77645

SHA512
50175f75ba15fe9ed1f55923ed19e66daa107f001b34dc286399892ae39000b844126a71000bf5fcd9d76355443bf07d57449a39b94c55d1d5c00fe5d97fe867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
07b2426d0f88b8fd4562b48778a2eb38

SHA1
b135c504e138b8b7f5fecdb03f60ac424bf85c48

SHA256
540618ebace2b464785d09723bb970fd79aa4f033b315676f5e8a475cb594f03

SHA512
ad64325e40e50a09305204145c93f845e092d47c971bace331481bbe17780d09678cf4af508904c662e9d5a8d7813f5b5a9e094675d162cae3ca1e3f9d8e644c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5b9656ad1aff3068569ee51c0d985e0a

SHA1
e7dbe92e91438a33f15a8996cd8bf8f29924ecf8

SHA256
15472e86e07ce74be02402c7403483bb8b9a23cc314f2d877284d130c92f9219

SHA512
ad90aab917cf5776c7db716fb95d338ae21627394d9f621c01fb9f7564cfb3045d38ad3a03a04322cd439ef41e8616f2036ae2127cf859c9e0950d267bac2b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a1927c74660d79a19e7df566e681f98

SHA1
85d5bdac791ef0191bed871620d68f407a9e9580

SHA256
3a6ce8791f4b17e1db71fe9f453db9900f4ba3879fd260ad3e51a28766009afd

SHA512
4d33f34f7d9a1d6cc8a56d493cc419e5f9f587bff157d19adffbeaaf44111ed98d522b39b29d70a6b7d43bcb5b7716e99ba44f81dba7e35c1e3536e3b4ef644c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6051b84bb4f6634ae372889057f839e3

SHA1
eda78e4fe7b8b79b0af3e34dd1c01dba35f0c49b

SHA256
b970351724757e4a202ad57dc0e436a6da77054addc6695d1dfb158afd55a877

SHA512
c88072b464e5b25fbbf1284e57878f99fc4381f2402bd8deec4a2eb46546280a3bc711e05c85ecadeb48dcbee185eb8a3ec6c2ee4d428aa63a50ee29ac45f3cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b368fb58fa6dcf4895b65c4baeafd7ab

SHA1
4186ab11da7993783d624066330f121ea8e5b8fa

SHA256
2147ebc6e7a54fa64f5e96fff6fb4b95a1869572ea7fa94f2357888b5fdda3d3

SHA512
96a1f0110c3caf979642ed429dd9402b5e8c277a8a7268930f4569d4ef2608a1b1adfa21cbb4a07ecbb20a7331a3455dfa31b1f404c402cde48de468c1e52023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d1264d1f515498aadc6db8534b5c0c3d

SHA1
e2244ede58dc4656ad85bde09a8019475fa6a019

SHA256
1a6fcfd129f69aef94b3e7715c081b5c8f95e5a37eb88d06f662ed27a4a2c9fb

SHA512
fbce4632547c04277137847e5559f64f83d27685adf89e5f3a27dcf32a779c9f4bfc32eff24a06bb0030e6f19e42f909b9d743dd63b83176fe2121268cf23f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22808cf6f1773ba0b96fb8d10eefaf7f

SHA1
fd9025798ca9c7b841aa24ce991f68b9997b6738

SHA256
1f38e535d31c20d50f744814a77bb3764e2457facb950ff685f8bce5d0e8e61a

SHA512
75afc18fd4f4bffc67abae472ea78c25906929625e47fa07ba09f8508e730e8b87981b60c58be71b1495d3b52d76be51e153ef3a4f56d82c64402410fa597aca

Download Submit