e57ce9b4fd8b5c271997b67852f664adc3e1a2e4ac42573240c7884f90f3b2f0

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60a6a24fef25aa13ffdf956c59a20b52_JaffaCakes118.html
Size

66KB
MD5

60a6a24fef25aa13ffdf956c59a20b52
SHA1

36c6c28ca77413eb387c8c7c5207b12ab1cec1f6
SHA256

e57ce9b4fd8b5c271997b67852f664adc3e1a2e4ac42573240c7884f90f3b2f0
SHA512

ee859fc3cd3121c3b52fd53df0931d6ff166ac3fd59398cc0695586b62349705a57ae12723516f50fc0a6a7ef7766c8f084cce51db0e22362883d175b5f8cc8d
SSDEEP

1536:KPkcldAOATEJU+L+AzpR63JVapdo8bKoFAcd:qkclqOSEpZOJVaLo8OoFAA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
100	msedge.exe
100	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4592	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 4288	100	msedge.exe	84
PID 100 wrote to memory of 4288	100	msedge.exe	84
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 1320	100	msedge.exe	85
PID 100 wrote to memory of 940	100	msedge.exe	86
PID 100 wrote to memory of 940	100	msedge.exe	86
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87
PID 100 wrote to memory of 1528	100	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\60a6a24fef25aa13ffdf956c59a20b52_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafb2746f8,0x7ffafb274708,0x7ffafb274718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14468180125932688312,3892784669463426778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c0 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
41KB

MD5
9a25111c0e90867c7b8f41c5462abfaf

SHA1
0619625d479f31cf145c2e3714de0df4a69169d1

SHA256
41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

SHA512
0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
1b5f05acffabfa068731f19d0bb64ede

SHA1
c63a28d412679f28330f99daeed40c119290e5b2

SHA256
890843a4afd5b1e64a51140183e05a051a46718e041d3007c385ba54d5f82134

SHA512
9717b792c40be92cc4f08ed995976dd37188c679135ea22446a07d871fb24c94fab2b7ce35dcca944e4f1597589b30fbe4e89d3a2bbea87d4cefe5c28650df04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
884e97c51a7a33987bff9f8170a3295f

SHA1
b50c1c08e148d832342e5365cf2b67c4d006fbcf

SHA256
ea364b4a1ee65993f8061c381d0a0a20aaf5eb3becbdd5f7ed55089f5c4d7daf

SHA512
d216ecde75c3e3ab7e44803eb7036b79c9db6b89925fd9ce1d6d1c6bd4e01eb93107f3b79670ead3a3115b34fc519f6917190db1d789453515614689894f56d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7cbad0fe944f1fcf3a7ec4094041bb5

SHA1
5e4e228d2fa38d51d50458f55f763410d1e227ec

SHA256
1ee7683de2c25c5638e319f7f9fc86857cfb8825421490c049c3389df885fcc0

SHA512
f6066659dce52b87f29731a002d89096458cc80b141bdde7481f4e366cdeec15b8f0c1666365180a1f294a2badf6b8bb44cd620ed9f33ae62804119b62659f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
610b3052352f46905945ad9c3ff6c276

SHA1
02c1c9945c5d4ff97120783341a526a971e1fade

SHA256
c7336e6c36cfe1709031fa841d7dd05ba9c8ecd84b9b265a88c5eb5e05a5af26

SHA512
3404df982d290810a06f6c9f72acd6200db69fbc6810b33cf9dc50217cba170d98842d6a2e81d36d29f5428d8f65d157ffc1c5a69ecef521855b7ef3dd58f1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
974b9dba07536dd5e3f46b6b98302c66

SHA1
74625b8ba750552edcdfeb2c6d3b8411ff876a13

SHA256
3d926ae708e61296744acb601bdda9b041e7884880be45f06429800fe80a3f9c

SHA512
5cfe3a9cbfd8a6a63a14b49aa5b776a19722a2e2667fd62db2a362e21a09a8738d258a8aaa6986974592c0cd0967d82dcd92f3089b37451814314c5fd2845754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9a6a1045ac2356bc85c0bf2d5865e26

SHA1
446bbbac3e1d0fb0e611318d0f186d2c3c6a5730

SHA256
330b83e3dd5d50773bfcb179a5a50e6d83c4c801777b298e4fd1930362b6a2f0

SHA512
d791b95335b57a4560b91f2a5617aea9b0cb7fbe0a84a222045a7180e130cac95dff070b67cfce36730f23ebd082c0623f78487ea75b1038ff1144a5f425b857

Download Submit