bb5187a53627d9bc98c342069d19912886f7afc50baa902e3262ec8b183933ef

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbf0bf19b6da998568335090d10a7fb9_JaffaCakes118.html
Size

204KB
MD5

bbf0bf19b6da998568335090d10a7fb9
SHA1

c3268941922d6482f7d21a6bae03dcf96b2bbd83
SHA256

bb5187a53627d9bc98c342069d19912886f7afc50baa902e3262ec8b183933ef
SHA512

1b36485bfd28ac8fb53cdd46d5b3715b804625c28cb0c7739832eae8143ee860a0aab12ff961d332a4c42d34a6ecc7230b04f7f3754da6179552a107e2673fa9
SSDEEP

3072:FUcjvG8rMdcXmNRSfQdrrwvz54HpX8FFIfTruVa1zzSDHNIF7Z:vrXmNR854HpX8bIfTaS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
224	msedge.exe
224	msedge.exe
6092	identity_helper.exe
6092	identity_helper.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4752	224	msedge.exe	84
PID 224 wrote to memory of 4752	224	msedge.exe	84
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 516	224	msedge.exe	86
PID 224 wrote to memory of 4068	224	msedge.exe	87
PID 224 wrote to memory of 4068	224	msedge.exe	87
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88
PID 224 wrote to memory of 4284	224	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bbf0bf19b6da998568335090d10a7fb9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb538f46f8,0x7ffb538f4708,0x7ffb538f4718
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13785900242152927928,503954351519845784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
67KB

MD5
b4b711f3e747704ffe02b49791ce8cac

SHA1
ac7ce4cbd3c8ee66e3c8d9d209c1352c160c3b89

SHA256
f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1

SHA512
b738deba57337a9147927f7dd35eab7c999dea6d2ff11f57fdc2e5b6f64326028a54778886548ba128a3f03ee333cc9e43de5162d8b578b85c290626577042db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2c3471a34a16ab61767d860cc9029b58

SHA1
244c490d53e84bd19b3ebcf4a604cd9902455d3a

SHA256
fcc59982b21ba36e81458156f99d88609eed4fcd04c4cd6ba7597b6c60eefee9

SHA512
9b96b40ddadf0a747de69989639bc974cb5085db3f3fe9571726d9bc45f6c46a346d6f3bb5f7ee14028aaf2cad094f1d0bce2c842afb330fccff15cad5244cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
47ee53ef83f4a7d41843cfc4aa056618

SHA1
4e044b8517b91ab781db8cebf66442105eeabd6e

SHA256
2efd1a0dd5d5c3e464f8a09c9b8e6398cbb994d468e30bfed3c55ef0b6a9d007

SHA512
15dd3424a0c367177db17378fb4a1d2dd85276a895d0bb5f4547388ec2df4b70660d346858a9ed6eb5f3d65f6faf27d8e992fccddadb9aad3020b7356fdb92d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1bc2c69a4049198b5cf0194d89cb2924

SHA1
c11bd9733e2445e59359f86aa1516caf6fc485a8

SHA256
d87789730a090eaf9b9bd1c2c267f5fe7b887859e618867c9fdcb0f93e9c1f54

SHA512
74f9a144b072977448236f73e287f9909f7cd55bbed97b4d1e4868ab387f7a212c31dd137c063aedc5571d5849c0088a32225646d66644cfc9656d298ec9d1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7efa88d5c08de3cdd41e2f3a4e9e2c26

SHA1
775c6b0e3e26f8c05aaf131e7194bfcf3fa89b36

SHA256
7efc56ca2c787eb20ace6f7f9ccbbfb99d310eee761ee172b1c577090c3fba2a

SHA512
89671c0fb806c66a5bc5229eda0b05e96d1ec37607604efc8470f304ad77cbae0270dc9375e38736c9ce57385d83d2ac116af4ac37e514bffd8f77cd849350d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eca038b52f9677a9ba9db580dd9b22ae

SHA1
11b0cf759d7fc72ef84f2ed67df74407041ea8fe

SHA256
6ab2d81900952cc50e88b1c201afeca96db69722d1badb8f050da6f47fe08c6a

SHA512
c044bdfaa410fb72e28a6f4f537c3ef27dca38dba31b2ee5f0c34e0c5bfca54e66054d73756b8c75adb77a15084cc05c75570699602ad9c50e5406a51b9e3b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a10f83ddf720f497c822cbf736e39e18

SHA1
a93cd31a334149606d9575881d7a8f635d039021

SHA256
ad14276a833c0372c0edd7d5b1a0d0794e2bdd932bc07ad653f41022ba6041b1

SHA512
636714de57165a5a8ea39fa1a9219971b232053b71eeb415e3f5cd68c68f44ee8a7ced0814466eadca3765ac26d5adf66fd97618a42d197b41caa3945babfebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
72a004851a26e3e80143cfe95750a416

SHA1
ae23d2a15f7e5798d8a34f97c012c5c5562dd37d

SHA256
732b83247bfb708a54345e9e258b7ad421671f2f2b4c293cff4655c81e830c15

SHA512
962329b6e521dfacc5f736d3ed41cf7757cd290b6034ab66280de49e9595b5edb3e0d7dcd18f4c2dba21d7c9e018a984ef776a7a1cb98a31e406ee90f387ed96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc88e6418e281d651da72d6a31f4923d

SHA1
e6e3fa918e6de1d946c67fbc4eb833af46512113

SHA256
061dba1886455768f27ac1a12185cc5a12b6402fce6c68efe6b016fc18f250b2

SHA512
f18fd2eb37cd58a1aa2cf18e14db3f5d6e240fa7467b8518bc59df97ea52d84b199a0c6c13ccaeec2b99779fd5be22cda5b8eaf89ccd99789858e28b5cd55097

Download Submit