2aa0ae3e011371846b486f703e69e12d57c39b0809c29e4b099bf8fb07908bcd

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7e4f1839c46a5ad3b0d516f8611864f_JaffaCakes118.html
Size

60KB
MD5

b7e4f1839c46a5ad3b0d516f8611864f
SHA1

63a4e3cb77049918cc558a2a8caac8a1daf2db5d
SHA256

2aa0ae3e011371846b486f703e69e12d57c39b0809c29e4b099bf8fb07908bcd
SHA512

438947a85a084b1c91af8cb49f6969c9e9af8c91796466716cce77664f63c532887493b1e25e34cd15ba6485c8826a1400b1658f8edc3c6ba8a653cd8d6923de
SSDEEP

1536:cTupBTkteBo6z8qG9iEjEGrKtvAOaF2XO1qgOGZYGlo6suwH:tpBTweBo6z8qG9iEjEGrKtvvu1qPGZho

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3164	msedge.exe
3164	msedge.exe
1980	identity_helper.exe
1980	identity_helper.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4016	3164	msedge.exe	81
PID 3164 wrote to memory of 4016	3164	msedge.exe	81
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 4236	3164	msedge.exe	82
PID 3164 wrote to memory of 3720	3164	msedge.exe	83
PID 3164 wrote to memory of 3720	3164	msedge.exe	83
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84
PID 3164 wrote to memory of 548	3164	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7e4f1839c46a5ad3b0d516f8611864f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaac6e46f8,0x7ffaac6e4708,0x7ffaac6e4718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14799587923666776384,18169178201986306155,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
dd805a0d40b4ad2de2e26e84f380f0b8

SHA1
df6d0add1b2d038768ccc7f34f99adead06bf11c

SHA256
8774aa22f51956a11a090e83b27a6f562d397337faa5f733f7dacd618eb03487

SHA512
a40a42ba8e829bc08a11c258d37d81c1e3dacc162388a8672ab708153dbbaba31378ef5f34030f7243dc6469e2bae797458648427b2dc718bbac98be6526d422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
5706ac706294afce58fab74e0d25033a

SHA1
bf95554581851a5d0275d8afcfcb8505d7a2ee88

SHA256
1a133923575439f9707b145f345f3185a97fc770ffb66ccd2d09c03f7f188de8

SHA512
146f5e741548a8dcb17f15bf19058d64cb4802d1ad96c5ee16b94fa57f7a2031871657430fe1925d7a83841bc448bbc6cfb2e7f133ecb48f0a17109be6df8bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
1d60924b031ab50da6669fb3bb52be5e

SHA1
b0ed9e01e98a7f18eaac73401a3c5405aa694e6a

SHA256
ecad6f23749573210cb7d10e2990683f767c2a991162ef1e8c5b3515c16918a2

SHA512
58770ee99616d436b7f9a460048652ec0fab1d03d2e163f3b160c16b897849badd745f73521bd083920da7b01305fc5484350f24e448f8e8e7a9bac65fb8e5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
509d2057ea85e24aff9ed1a4cc867841

SHA1
1c66fd44f8f7060fef92aee53e67b70235dc8b35

SHA256
962c1306fe2b8846cbbe6139c830b724fec71a45ef138e2548b1f2740ca2c260

SHA512
36e9b2798d8ee01648864ae63061fba1c13121faaaf39b1bb563daf99f0fc3e9611f268ffdb87a372ec31a702657c6d35f69c0b7b6ffbfbab50d01a86c2feae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e20543cfba493216461eafe7eac9aed

SHA1
112f3b88cda1f699d3d2129d0666213dbf30392e

SHA256
d9751af6fda257b4699676d8adfbaaf8afcb2b4e20e0033e76b6b2329fd51998

SHA512
59504270469ae2dc5b672a41972e1956ed3710170987ebddb0b34c4c2870106226db21c4e09652a442315bc7d82bae240d241c0b1b6d51495843fc15a557a61d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d8247bfa6f32044e748cabc9f83c0295

SHA1
059936c8f5336dc2975fbf20b3bd6aae0bec8ab7

SHA256
559890e79f43f8097830aeda3504d17c918ade10cc7e7728bcd6ecfde93a791a

SHA512
fff52d6912eee527bf129327eb5251b1ed601e3837faa967242907a9e903dc3b2682ac4e2cceedee89dbdfe0883e8525a91fb0f5d646ff6c93692f2dfd2ccb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
393fca36e4d6281cdd12e570c3418f47

SHA1
23af24315c82823ec9b61dd92934cf3efdc6b7e2

SHA256
f1d5cdb0303f192235e3a3c514922fa93b31264f69db0372ad1f8466cc2b2036

SHA512
624c2b326f624a01a8ec78c9229da920490aed7be6a07694a87a35d71e328bae4299111511d9dd1aaa454f090e2426b29b4651baf5e1874b6b036e1073808e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
946e4dec04a38c523359049ae8a7997b

SHA1
937a49bb3e52763891f22a69b0128bdf6170d02c

SHA256
a56a262182888ca9dc6fd2b6cbe3f0d78b4a46a103733c490b33b01bc6e64c98

SHA512
1c4960d899016f1ddaa89ddadbf88e31548ca2111af64d86d0c411f7b5a7d156ca4cab1dd3216972336bb0d618fe26ffc1389d09e14308eb155ea68262847d4b

Download Submit