551f72949fe00f3c6eee155ec6494370b914edcbb80fa0a18dc9563fc91bf56e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

759c1f5ce18b4ae526dc07b195e26c18_JaffaCakes118.html
Size

240KB
MD5

759c1f5ce18b4ae526dc07b195e26c18
SHA1

1108983c8ba907f7d24572fd2d3cd83b87298d26
SHA256

551f72949fe00f3c6eee155ec6494370b914edcbb80fa0a18dc9563fc91bf56e
SHA512

79e300ba46b7d2b95f84c695a5245fdd572f3feb778a9c4aa8b371d30477f82991b353c7c43b758d8a077936195f62d691ad0028922df2a2f8394c29095992ad
SSDEEP

1536:+ffOtVq9PHI8QAi82EFTmS+zifeVUDDk/ntGlGSa+256o3Ctv5NazPgYPpeLfm4K:D8QAi82EFTmVklGSYUo3CtDLfmkh4nF7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{AB0F6820-66F9-42CC-B2F4-D858E37D86B5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
2840	msedge.exe
2840	msedge.exe
3688	msedge.exe
1816	msedge.exe
1816	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3004	2840	msedge.exe	83
PID 2840 wrote to memory of 3004	2840	msedge.exe	83
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 3924	2840	msedge.exe	84
PID 2840 wrote to memory of 952	2840	msedge.exe	85
PID 2840 wrote to memory of 952	2840	msedge.exe	85
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86
PID 2840 wrote to memory of 4324	2840	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\759c1f5ce18b4ae526dc07b195e26c18_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa84ef46f8,0x7ffa84ef4708,0x7ffa84ef4718
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8071828155661576732,17152392023096369448,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a72430dfc3934ea37abf0f9a9ca2f8c7

SHA1
d88070703d2b5dc1af091b6c787d5c0294f3ce63

SHA256
39aab763ad0e520f40e0ef474afda8a08aeae01d5747e942367e6794353c8c2c

SHA512
2c78f63fa830c14b535749e88005c23d73ede72991406263914ca5b04196da840c84141781d450213d8d0aaee40342f68ebb7d0a4a5321971c47065d23fbb8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
202c80599e4f230a8033958566a7944f

SHA1
68b394fe7076573f33d22cdadd3ccce14b549354

SHA256
a78fa4ded9db8f891e43ace1a816594ec00a12e98da9cfd1ca73f0e87beb2736

SHA512
247d9926440b88bbaa84740001027b40b47a1e19334f25dbedeba416b078180186e53c0caece535461f2294af197cdf7f0ddf781e88dc7553423af1731897640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f11acd0422733b1a1ca2519dc4d1c80

SHA1
3c321c47b9073ef1bfb502cd76947c6a16b3ff67

SHA256
5e9a166fd34310a6600f6bbb29a6624e9c637ad05dd21a5c43819fed8b1fe424

SHA512
1335bf01f7bcd44cd2eaa8efb0d3304df8e8ad3aaab7839afe88b028f907ae4a54d3374837ddeed9132085171472fec6847431a3311fc1c0143007156a9cbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06044fe3d517d0d66f2c18ec022ce0b6

SHA1
e3392688339e4e2f461f6479822fdc82605a511f

SHA256
6721a8cdae8ee7b3ebb40106a0adbbc513a58414f8bcd450a239d55652df4649

SHA512
4c651fc7cd976659c2f30f4630e15ee46fac16d1dc08795b4383bef8f0223c6cd061ea1b4c9492a84e7e8b96b60ad120af21a2da40e9f03259f49025ee61d74c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
36e1813483527a1119d792913d2a8976

SHA1
4d2bc56f31fe0f7f3e7215c01b53a47017246c79

SHA256
0d8261ba9f9b2c3b2fe7ca410bff7e9663a46e05a7622be7c7a6d49e7031e25e

SHA512
ba103dc8c4129caa591e2eb724a048886e6362bf2ae0e8d0fb7e85165f195963e748838a242402fc924106587b5911d317c51d5531c851b32c21fc8634478a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c6278aac9196ed4fdf21c946c41e0d14

SHA1
88435e6b092f41ae8ebd7bc6c87928cb61678112

SHA256
aca97c14a000b76f3f6a9e42491b897f46a68ee5bccd7737aeb9de5f7f593b3b

SHA512
c0b962924efa77600fc5c661ddcc231bd5411fe28217ed68fa08f1cb7688e81dcafca8230058439d3d75081d933dc0226d46b970433f719835dfae74836e90e1

Download Submit