375b82f4d7a531dbbf00f49bc3962d359f873df92cfb56cda5a48a56608613fa

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94a89e9596effa37379b80c8a9d5f1b8_JaffaCakes118.html
Size

65KB
MD5

94a89e9596effa37379b80c8a9d5f1b8
SHA1

53a6cb198f7419d55acd6009529af8db1e9b9435
SHA256

375b82f4d7a531dbbf00f49bc3962d359f873df92cfb56cda5a48a56608613fa
SHA512

8bf76050ccaa9a3a96a34d91225eb8fcaa8467ea273bb5ab27a64b2bb7e76f19520219085ea2fa23959d16dc47d8481325e810d7638bf9bc976a2b10c746a9a4
SSDEEP

1536:RDvD6I/cp2nA7+jK0TONJSWY1GNv1ntPfy2Y:RDL6I0QnRjTONJSR1Mv1ntPfyf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
4152	msedge.exe
4152	msedge.exe
3376	identity_helper.exe
3376	identity_helper.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4508	4152	msedge.exe	84
PID 4152 wrote to memory of 4508	4152	msedge.exe	84
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 3412	4152	msedge.exe	85
PID 4152 wrote to memory of 1292	4152	msedge.exe	86
PID 4152 wrote to memory of 1292	4152	msedge.exe	86
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87
PID 4152 wrote to memory of 3132	4152	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\94a89e9596effa37379b80c8a9d5f1b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16948679318520417427,7637743357386765620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
9ecf139091dc359c733a39f28e7eadb6

SHA1
01a72e9cc3f05896d85e0c0e2afa6f398b594fcb

SHA256
686c3add805639819ff0e205ac339e411e2491e0f7950951a7427ee96dcb51e0

SHA512
94c567f13e987920684ab4a94df3813680b40be7fa614de1121b39aef57068e4ad311d521d217ac56d1b849278373b843e8c0d3c3007d86058a2c6302d9e0eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
e3b625c18481e6f4868068b060edc417

SHA1
5c57df8eb14743d222dc8920f1504f914748fdd5

SHA256
58cc0637dd180480682342c8f9abc707a125a4aaaf6c5b2c4958813197a495d9

SHA512
d24f8db7e780096c638205b87c89bad10604c43522a5d749edbba3b0ac103799b184f6837524c13dae92a9dceb803231718ebc3584078b213a613b4da3f9a343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1d752d6c1c36d1a8dbcf172656d2c707

SHA1
b3c28f85e087b95a4bc29be883029b5a0350b9bc

SHA256
aa24a7b92494cdef9007eadfbb0d5b6db2ff3b22b1a87b71b42816d1b8312d1f

SHA512
15bb20545da3b7b68d1eac5d2bae78728334498a88f52ca7f04e1389901b95c114575325890676e4483d2d339fb15dbb08abfa64a54bc75379498c64d0fba2ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b5442cd3663a0ee80c9dc8f04e4a35b5

SHA1
132d5f79b2eab59758721c81c8feff9cb97b8e55

SHA256
4ee1a87b8ee5cca363c0abf7700db130a52e49c8ae1a26eeaf7752c8d7c2ef9c

SHA512
bff2321b41606e829ed8766d8e984341d3bf92da815293508a5b7c0e4c906994b642bce066a6e19c6530f847762e0437deda4b8d5d1ed3bd15a98d58909ccd6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5282b5e109ce0d95f42dcbbd269ae4a1

SHA1
ab743d2c7ddfb7453df40c576f7f77efab126e1b

SHA256
795f017313aafefc0116f334d36054b892ef2170b31a008f949c4b9b67a0c8d6

SHA512
54b0bf281a468030c87007eaae77510b617161b07e579f745da1abfc5ceea170af783a7973a20051b668063bef3a8970a6b87ce1330120d812d73e7d07b6425c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f885f4074b64ba88d3846166979d780b

SHA1
bddb544c88b1f454a3ddbc790568b40c3ff52243

SHA256
efa30416fdf737c28d389ab3ef1ba1939a07271b2348b9414f02cef77c75fa22

SHA512
ed3ad939cfe97cf31231a8106e6ae06935a82e7ac0c165aad319ec73f876b346383db459870f5377a12c369e9de222d3b93af9ad4f2aa5405dee577c69ec869e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
26a3daf5b26770b6126c3cb665221245

SHA1
34ee109ee026e069ee4f372432b366fda60aabd8

SHA256
0533f642bba1a49c312a6c3da852b38be13219dd8343a77d332fb00cd2b4da7b

SHA512
24efba1e8286fe5b76128898be0e4ab283eb91d5ede12b3ae30cce5ac66fefa31781b7f32b0df7abd11bdf12a3a26cde5b4a9142a64ed4de544bdd4ac1bdbb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d81a1fd1ba0075893be1bfcb349f77af

SHA1
c5c849c23dc5c23fc65b13ebb6bfaf3799075619

SHA256
b494c43dd327a234ddbfd1ca2da59273e653c79f45af8eec95199a024bd0ce99

SHA512
df289130acb9ea38f5aa286fe8c6d0a9a97700ada3637ff6687ca1397e5b7231e6e4ae5046e2c8bd77c5f5c9dadfb9e0a4e14730953db9bc6e3526d41b8f4286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8c8e4be20b258d8cf5fe1aa4cac1fbb9

SHA1
ced8190ea8db817f65402360bb524bbc7cd3d69e

SHA256
b6d9d4f7fd3209565a33d5b49f89d63b8e94bcccc3db2829c8c7c64acf7d958f

SHA512
434563ae7cb698a53af7521f5474866e93950fb7bb1bd6cce0eb6f05a6fe91eee83f64a3ccd54b8d43947548aa3b6729daf6f733be57bbd48521c5a0a895d3b6

Download Submit