610d8419c4d149ea21fc7a9fd520478a25b8b03d414610b8452d612f54ac6571

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73618f066e0db1b077fa82d2ed4d1f21_JaffaCakes118.html
Size

175KB
MD5

73618f066e0db1b077fa82d2ed4d1f21
SHA1

f112a060869c59254b0f2df705cd10c2f654ba89
SHA256

610d8419c4d149ea21fc7a9fd520478a25b8b03d414610b8452d612f54ac6571
SHA512

6e403db9e8c8b631f061cce0a3a1b2aae7572c04f436dbbdc7ee3c50d6a7603c08d7175c774a379b26a55297dc6137bf7fd762b781599a3a8c934fd1697334cf
SSDEEP

1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS3QGNkFGYfBCJisI+aeTH+WK/Lf1/hmnVSV:SOoT3Q/FPBCJium

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3088	msedge.exe
3088	msedge.exe
4260	identity_helper.exe
4260	identity_helper.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4684	3088	msedge.exe	83
PID 3088 wrote to memory of 4684	3088	msedge.exe	83
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3644	3088	msedge.exe	84
PID 3088 wrote to memory of 3020	3088	msedge.exe	85
PID 3088 wrote to memory of 3020	3088	msedge.exe	85
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86
PID 3088 wrote to memory of 4892	3088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\73618f066e0db1b077fa82d2ed4d1f21_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff956ee46f8,0x7ff956ee4708,0x7ff956ee4718
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11185269902283258965,14560190971196979348,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50784bb1-64a4-4404-9214-32ed793e10da.tmp

Filesize
5KB

MD5
bb71849d5e5246a05e400c4825387b44

SHA1
ae7cbf6e79a237901e605ed2284cbce7e9de5c27

SHA256
d04297835217ceb9854e5535a31f5e15d776466738089f760543b72448784162

SHA512
476b115b118afae76f1a1067ba6d064dd782054da763ac6e9b7c5f5b3c3e19eff1651435817063490b6c6443b450ce779672783f1b38408882ac9b7fd3972f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
16c0a2c82dc0ab50f23123f7ecb11f51

SHA1
fbaef7794f352126af25aedaa99f1bc22d131f71

SHA256
5749a98e9383a271b4f6cac8caefea4d86a6b40e203a750d45fda652e167583d

SHA512
0bf3c5458b647601a1f28c194ac1bcc424ecdeba91871fab9178e8daf1fdf2ee956ba55bbf61b3cd2f54cb1ca008dc894e6a54730f5caf754c61d9ba20da8244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
578582fba4a837a6ab86c37da3786cd6

SHA1
cc8c7a79e44d3066c3c2a60966d2366991ee045c

SHA256
c743122554715c293f40d53640f079e59ecc8280d70b9cef0a714fbc3ba47312

SHA512
b118151e963d55bfb2bee097bf2e21a793ce3cc951ee36bfb054f18d16e4ee441c748ccf3ee536871cfd7c06adefe1149f09e7b34f3660bc1f2e88ea78ea8d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ea0695ecbcea5b65ffc961a41fa669bc

SHA1
3000918c9ab8f16d6c7c7d9f911fcea80a33324b

SHA256
ccc7b975ddfe038a0bdb1e2e7e3b811379c0d83c6fa856eafe4afd79c8400f14

SHA512
6cbff9408733f334511d17f6ba3932bd5c7ebfe8f2115545e6f7aec2c3bce24ad931578307d8a8d097f138e3344843804b45c96a096cee2e999286e1c8b4cfa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b6b479f3de49927ecde035fda37121a2

SHA1
807a96d695e87797c8a9ad939642f7cec17d695d

SHA256
a9bd69c8a0e69df20b91ad109e70fa05954636fea61e4abbd4806f27de56de9f

SHA512
fd346a0d467f048027679ec18cec2f820af83c7a95757e81a258d83e7692a7e01e841417b7ffaad5ec06109854d22f58cb93f5edcb8e7df0a2990f965df47406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2b6fd32653dc8fa3d18e9ca1c2f156cb

SHA1
27d09bd627768f3646254b53e9cd5201b75994d3

SHA256
d532b265017bfed14021b393a232761dd068c395dc4acf3441550d68bdf0ceaa

SHA512
ab3d0cdce4657670dc3b6bc7bed628db03727239839d01db0beff48e53d2764b2dc842aad4eb7bfa464778e387f897d8e7b638ef559b5c13939cd2f322b2aff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da735a3b2d4e25a53e78045504642e10

SHA1
4fc7428906e0804d4bba7f009e9b1f061d627ed0

SHA256
1ad9762700e76aa18933c731c459a1b5c205f4821aa30778889225597c088d51

SHA512
3fb8a3af252df8519c2c4507b57c4b8507a1cd26a58c7a59e7f55ba76beccda9515f33f5d0652a03e53f4a5ffb9a95d33a098a4393d9f232194d4d21657a1b44

Download Submit