079aed530229426f26d2a7ae42dbeda6a018ad88db736f71319609af41627e86

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6996f383004830be475f57608784ca95_JaffaCakes118.html
Size

98KB
MD5

6996f383004830be475f57608784ca95
SHA1

7b4da77b044a7fe4ae684ba8a8190790bd4c66da
SHA256

079aed530229426f26d2a7ae42dbeda6a018ad88db736f71319609af41627e86
SHA512

cd53dfe14a67b4aacf5851aec61ea52960342b6542021817d1f33d4d3dc6dbf5db29dcf9b5912e0f92daa41b5b4a0f86928e04708d4c42a33f2b4a26943bc76a
SSDEEP

1536:7G5o+DKDY9pxaUdGF9tZlVxpvVfQj5/GyeSwEOrVgQzRjaiq0topP:nrNvij5/Gye7EiVgQzRjaiq0topP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
2660	msedge.exe
2660	msedge.exe
3756	identity_helper.exe
3756	identity_helper.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3196	2660	msedge.exe	83
PID 2660 wrote to memory of 3196	2660	msedge.exe	83
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 2872	2660	msedge.exe	84
PID 2660 wrote to memory of 4356	2660	msedge.exe	85
PID 2660 wrote to memory of 4356	2660	msedge.exe	85
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86
PID 2660 wrote to memory of 4456	2660	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6996f383004830be475f57608784ca95_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffab46f8,0x7fffffab4708,0x7fffffab4718
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,10449730195495354052,6686754186746977130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b29591a77e0b7ce366b2424603f4adf3

SHA1
1eeebfbf2a1abe4586b82ce174704bb9a165ca9a

SHA256
8b018f97221fa47dac6197df76487430077f7d02f0c96c874576a72181b69ad3

SHA512
9c0236d53ec0bdb727173bc2f3bd722ed1d2cb9261756046365e5dbf61da750556a63f91912713244dd518b7f87caa5f68b5f62cc880e648470a85cd02797479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
fe6e1ca3fa93cc5e058a1d8ab4fd202b

SHA1
419f2fe870c7f0db4e259c61cef3035501172d0f

SHA256
bf975fd814d94a92fcc5d7ce6320d2c10c359b18bb262ac3ab9f2831a212845d

SHA512
45cd0c72634f0284a9aeefcf0ebe246365a9c9057259bf9450ee5173142bc042134ad3a6ac41e435e5f2735d9501867cfbcd2b1289e5f8d7cf3013885f5c0662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
66c2c45523bd5c1b24dd27a607d7c885

SHA1
01e6d29d64df49faaa8d57ab41d00a3f1ebbe593

SHA256
8aa80b7e9324bcd98ba4c20ad392f4f38aebf50e82c3337fbaa173b37386d85b

SHA512
2f5ca10b9b6fcf28b5a1fe4b2ef9328455ec4c1529f6fe4db1f0d870b6a505e455d50bf765c38adb0fc448b9a724e5e0d61c9740845fe07919e5d2420370eefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f4f5ba9a955fc4f0191eae431b8f0903

SHA1
01baa35989249e3a4d0d6c5d3b7e5c1e6e7136c4

SHA256
217d2a0c3e8c7d397df7b7b2c1cccfce7a135830c63d624efeda8645d4ac0741

SHA512
69529cefb5c89a3f32a62bb0fd7af7dded14fd08176600652d3910bd3cb36d779c24e9112622434589b39256582d9f08ba897f3ef267771ece0e6e81de651b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a1869e381f6874b9b631ac8e4e6f7d30

SHA1
199a89ed1a06f293a1f55906f82e435bec607597

SHA256
cd64b6a4f6611be448c498fd3d2f55a71fb2e23518e7e1f5b6aafcc6d4301b60

SHA512
eb124447413ee7ffcbb14b4a82819dbf351dc7b620e55f52ed6e01f1258c5772ea35b35c6942c5a44d2390001b338bd3ded1f8ded41f108651744ce5c6e49427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78f26aba266fb628abba8e5db2645760

SHA1
879249c3a070ed6ec750d2a1803cc93037ea5a73

SHA256
6e623577f7b4143a0d249b4f5269b35996e49b6d5e2dfcbc1a7f7135cdee31fd

SHA512
d0b1d0cc72ea70100c1cb74f6f8b1969fd74782a3812983ad6a23f3481ed1427dfb59f11a17fa6db9b75a0099fd1d28eaa0a6fd3b2c5e410796ad24155efda3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b951eeb45d0355204e833fc7b3fded6d

SHA1
5730ca4234975316fbc06a3b8baf1388fe0bec0d

SHA256
bc5840ea6adab2d6a720cd63cf762a90bdccbb4229c572b6d2eeb46ca7dc8996

SHA512
6ce0b0d4fae6c7167112c9ec7c3f36736dc8242aa3c3676bf6e68afc930b9fd2b3cd7e93b3d1d2493c101a81416becd8158366b6fa121e1b198d20494bcf165d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e008d6b3b11e2c542b4153f8a68c9334

SHA1
49597ea75da5ee8fd7a30ed8bf7d6a2461e7db3f

SHA256
c329260fb3b7c9982f53b360b2dab4b521ed53b41a204c6eaba0c9b7a037840e

SHA512
08e2f43d000d71aef88412c44661d3a2caaa00e7fec893da47a40b078be43acdc8e17b8fd8114d4b0cd963f24d4d51ac8725dc3a73268cb516b54bf61de3d3a5

Download Submit