c6fec018e551cd153d14ac2494333dd436c888c561977a8c18744ade86252d48

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7696fc2a42371f9c8d5784efb5bc9c18_JaffaCakes118.html
Size

52KB
MD5

7696fc2a42371f9c8d5784efb5bc9c18
SHA1

4ad587a5b2b0857953c835b72cd5d20747b5cceb
SHA256

c6fec018e551cd153d14ac2494333dd436c888c561977a8c18744ade86252d48
SHA512

5e46584117244cffe91854af2cddfab8b76950ca4471f3b64635215ddebb339406541255d48759c0459ab7ac213acd4175ef56354bba9bf27369d20679d6337f
SSDEEP

1536:6YlTupB1lj9okeMyJ1AUvKO1TGY0cDLNOzy9u8UPS1TnaH:IpBvf90xGcpOzwbLU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
1344	msedge.exe
1344	msedge.exe
1780	identity_helper.exe
1780	identity_helper.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4900	1344	msedge.exe	82
PID 1344 wrote to memory of 4900	1344	msedge.exe	82
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 2792	1344	msedge.exe	83
PID 1344 wrote to memory of 4888	1344	msedge.exe	84
PID 1344 wrote to memory of 4888	1344	msedge.exe	84
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85
PID 1344 wrote to memory of 4012	1344	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7696fc2a42371f9c8d5784efb5bc9c18_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,16264886840962865403,7774835701249247357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
cbff385a1bf6eb96b6a3f84574390803

SHA1
385744d1c67fcaf7a8cc68150401971f371e209d

SHA256
4516764f53b44ac3fc11fb49aedd337867c26ba1dffe082ff66a94b007ebb4b1

SHA512
2e77be5f25e1162a9b0c1603b993f7244cb11ff59549db70fabf7027a9c30b3919f840bc93322fa2ef4f8114b4d9f39a73cdf92956c210bd959adce2a28b38b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6a3454cdb6c062fb60c0d5dd2dff5807

SHA1
1461f64443e780551bd2a9a0da9e51fcb875261e

SHA256
463a2c75204d39b274c7fb578f58c7ef2f2b3e8313e27498ff7a82eff3d42b70

SHA512
25fb3f84fa6d824dcfe416497feb0cfc5e21b8e7ec642f2650fb1995cf588bd861a1cf47d1845dab1ca2ce92a6f1d5aa43df1f6c4948950b716b99c03713dda2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
17dee6f7171c0b9ebcc1421c67ea9089

SHA1
983fc4b4b699bda734f74b13b2c79a60e6627e4c

SHA256
342eeb0711d62533861855a04765b91bbe6d4b080a04158cd879da8f869235c6

SHA512
d9f81a745cf612953c3bd47cc471de5a75718a9216286d55003cec45b1b4c55e555bd5abb08417f520d42e58049d2b0da612b840ba4925ef30a19efe22d7b6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3c3402a409d1b96caa439073395b7fab

SHA1
9df15184153df3b9d7153a6d4a9e691a46fab7b4

SHA256
a7135e8489326dc7e63adc526f9ec587422e0c65204764ca8ceb40b7201b02a2

SHA512
1555cbe9a9af798c8b8c46d9e41c7dd1f220372b70349e057764eecea937f68895cf0d51839fecdbb5bd873802f78b81b1782de89ddf6a003117b5d7fa18c751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd475762157eb2dae4ff7131abd1f6a6

SHA1
d4410b6739af96d737d9eb7c2f249c18ca9947f7

SHA256
53246f5f9c24587819fa589018eb5c204612c341ed24f7c09b135c089855b0c2

SHA512
518763af9b1e92ba89bdabc145c6820a2594f37a36801472a8e0a007a9eb3ec6370728b8404f80175ae12d381ad02460e59432737d1455772fa1288b6ed5fbc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f8006de5071d751969ea1d66d31a197

SHA1
9a536a2f6faca352e6120757715235070e69fefa

SHA256
b701dcf01dabc33bd4b061f73796302a60d7134103218a605cd813be971c4745

SHA512
e6bdfe285395df6e8bc948a3c332685f7d61927d96ef937a3657bf0e10e92d973b577e0599d1569c9f51e4e49bb492ff53512bf6d1051a4bfa183e6b80c8a88e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
713d94206db371b42afebd3e4ee8e02b

SHA1
37140a576b5fc7e0bb190104c127b03c518ebd9e

SHA256
948c801da4790982091ee4866b64241a62ed8a531ecc139a7e774fa104d2ab48

SHA512
7d34d229ce80fb2a95a9a23be9372c6d7660c6111b5ebfebc3df9f8dc990ebd16d2d9302a444f2d78226708ad221166e214ef4abfa99f5a405447709be7a073f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ee8f1ea6544a6a543df8f24407ad2f1

SHA1
e08bee02e4a010f276a1f401a3352f1563c2bc80

SHA256
6f36c39077f3d6ba500f3a2235ae0465039ef19915bf1a0ac4c0c5376aa238b1

SHA512
412e34f322fbe50046a8b7343b16b52641116a07b8b8485d6e39ce156bab6aa16833ce30aa08111f78bb6f623fd675e4a13c92543f368295c09afc473660bfde

Download Submit