e8569487c54baad56449e176b4573b343245df4551929f945deb141c80637763

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10c11b5775d990c019568d651ccb5bdd_JaffaCakes118.html
Size

125KB
MD5

10c11b5775d990c019568d651ccb5bdd
SHA1

7c22112aac62e736c0dbeaf537a77fb90a8a6f24
SHA256

e8569487c54baad56449e176b4573b343245df4551929f945deb141c80637763
SHA512

1b9f89558e215df6bf45e1873fe32b5f8e7bfd98078f59dd1cb369b3f2363f7218ae4177f89c6cdccf5bddfe37242027a73b663bb4eac7a1314af7c00afe66c2
SSDEEP

3072:k/wGe3/ToXqbIrqbI5BU13G4k5QhLpOatVZRIZK+:k/w3VIIIq3G4k5QhL8atV6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
1772	msedge.exe
1772	msedge.exe
1456	identity_helper.exe
1456	identity_helper.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1876	1772	msedge.exe	82
PID 1772 wrote to memory of 1876	1772	msedge.exe	82
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 3860	1772	msedge.exe	83
PID 1772 wrote to memory of 2468	1772	msedge.exe	84
PID 1772 wrote to memory of 2468	1772	msedge.exe	84
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85
PID 1772 wrote to memory of 224	1772	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\10c11b5775d990c019568d651ccb5bdd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6dce46f8,0x7ffd6dce4708,0x7ffd6dce4718
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14391050412049176403,9971759645465886714,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6b2ba380da560d72a105167865be6f33

SHA1
828af158e3021593a40f3fc111813e69c661c8d8

SHA256
0af749798cfa1d5109dc3e11371e00f84f17476e4a6e3bb90c42f6618d78736a

SHA512
68ad753cc097ed6647cae9421bbf33e28d5bfb754a72100bcb1acae65575dd7e3cb95b3dd92863a931faad49a5f04b4662102b2bc11ad62b2b055732f681b041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a9b5be2317471b4b9641e1b790202429

SHA1
67bdc58478ebfb503dc7dc73318e3300ab075d0b

SHA256
c50e5ef12baf38cfcd03546a7aecc8fb47507ee31ea8dc374823db1109caa4c7

SHA512
d486c36badcdb2a4c7da87be8c6062ba6331187f94a184b495207c45a734bc391437fe4e799c1ce0a2716907eab16a59d6c2ceacee409cb5593f2eb0ae7dd922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f950dbac24f0dc773999d2bdc3586c60

SHA1
1c672168b43fe77ef4255e695b192ced13e4b14c

SHA256
df73e4a2cb975a44b279d1409dd6840b78b6ed9bdc7425b253354406cd22a332

SHA512
3d958678b91d3857a27a88cb803f5dea753d4cde3ac1274fc6f253d8ae29e96693565bc90aa8c02e37c79f94456809789d2a16538c1fe5deefbbc8c4e4ac31b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2a417f59d9bdbf821e4adbfd0bb79d4d

SHA1
d2d7fc3239cb3ea5f75c98f3b31a8498d0e7eeef

SHA256
f266c7bb8219e1454d62039ee97c4fa3468cd7a1cc4c2458daaccb11ca658dc7

SHA512
39957553714c545d99007bf3833481ef4665d05a7823c4bb49bc1133f1b415dde2d752f9110da16761dbdaebfc606a2d78aadcc03bfcc7e732b086f7830e6139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cb8ab4209e5fef7a74eeb7390c38937b

SHA1
61b268485ad7c731c3c375bdab028ede4a460e00

SHA256
b70bee58128c061121074d9f7b8a9c04e6e0bdbc46bf77f93ed7e654d868be31

SHA512
04061ed2b9df4bdd55b08fde504fb0b3ca8fd41b06fc1ba1449f4354856af3537f03407fe91e3892e4aae83f38880d92f5f3ace5448d5662f109931b8aa6f0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b81ec5367896831ec1793344b39f6285

SHA1
78cdfd1a1465a547e02feb86cc9c2114ec75fa65

SHA256
cf41ed0b801a5e8055aee4d99fe172b6c1e0b09147b0b8f6660b239d8b256095

SHA512
4ab711a08cd433ed31422b54104e77b9acd30666431ab527f9aaa44c06e9861f9b532b8bfb876bcff8bc57a788f8d18465fda143609e1ad2f21f8bdbb3df091d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a96f287f5ee3fbbdf9a02bb683472fba

SHA1
5c4e27b85e8056ebdf45e877e252bd66f1c7b036

SHA256
06aa34b562540ff66820db5adea508d916b31e851d0be3f95d16f0a2cba2dc4c

SHA512
5ebec481e85efc270fbe5c4f6c114e113bc75cc5f77b5f889e484b4fbb04b62755a02d11fd669704f8c46d035c4d43057c6e158b2cf22f699b78621dbf9db15d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38fce27956a92032b708dc4d95a217f4

SHA1
22a24e24862ccb66a8e5c2a4df0c9d9f5992e5d3

SHA256
60b0caf95980083503f829bea252154d020d26a78606b23823a520b2006ed490

SHA512
1a3c849d009b192d6293edaafe3b295720b00c3f844b3086ab443302ae85d9ced667761c4a68c0b859a1799cf0947e827fb4a7d93838e88c5095d9643c4863f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
157b6a076eb7ae63473ba768ffe6b87d

SHA1
6ad2d35a49e4a8ac7f8906e22c3527ef9dedb467

SHA256
5c48360d82c3f7dd990f1cb69708e95339775e5cdcb288c58b05f781c3b2a69f

SHA512
28030019569678660f73ecee710d9962259953894ab01dc14ac3d9437c52fd93f443ec044082520ce77a27970de974ee214a42bf35ac3b9eb8fecbd30978b177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d642f3dfefb0c1b53a622d95021e5a3

SHA1
0f214c84d5ca060940f56a045612e65e3179b09e

SHA256
b7594f96e43bcc26149a8f233007dd136c249e0eb82db4c13e296796360c2dfc

SHA512
948e6c3af9350791b1ce337681228e525f694267541e6168b3cb2dd750c7cb07f174d99d7fb1f0221f7e7cfad7c6fab6b747d2e575bde2270820a5be8c3ff72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29327a0c9fbae666a7ff10959379a4da

SHA1
3098ac9d347ac88123ad248cc8f5cda9a9f46a12

SHA256
69231f5eeb92849997f218b054c7091f832ef5f4ebbe6e91a13a7ae52ca0a770

SHA512
82b0eec6c82427ce6c247181b6d8e93a64cdc35216c9956efd13dc914c4d5db424a76813ad9e63c15d49441b629196aea7dc583625eec4b1903b2d8593311109

Download Submit