bb338f07f839efa04817d8ca6c0711b65a2fec51a6091fc7697c855856f5933e

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9cdd643ac3c8a91206cd6d7a9043ea_JaffaCakes118.html
Size

175KB
MD5

bf9cdd643ac3c8a91206cd6d7a9043ea
SHA1

25249b659574c8745911518b19c0331da69bcf7b
SHA256

bb338f07f839efa04817d8ca6c0711b65a2fec51a6091fc7697c855856f5933e
SHA512

3b955a742db0694021d6d0c544b820f5e08ef3d7c62e1b0a64a0c10526fd3546956a19a73242a6e94df8788ad95646d38c250ecaa378caf21a1ee1e1842d4bb3
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS31GNkFXYfBCJis/+aeTH+WK/Lf1/hmnVSV:SOoT31/FmBCJirm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
5032	msedge.exe
5032	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4272	5032	msedge.exe	84
PID 5032 wrote to memory of 4272	5032	msedge.exe	84
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 3160	5032	msedge.exe	85
PID 5032 wrote to memory of 2720	5032	msedge.exe	86
PID 5032 wrote to memory of 2720	5032	msedge.exe	86
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87
PID 5032 wrote to memory of 3652	5032	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf9cdd643ac3c8a91206cd6d7a9043ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08db46f8,0x7ffa08db4708,0x7ffa08db4718
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2572718107088737475,11604260162580138213,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
6646660a402426d233a31df12057c97e

SHA1
3587ca32ecd9965dd3ba3bc52b3d7436f2d99c1d

SHA256
e76ada0aa2a19d88d5c47d89e81ac6b8b116f91a30bbb5c5fc334e8a90684dfb

SHA512
da8988bda6dbcc148caafeb8a801b4923b4daffe4d114dd462b5f29898956bbd2bb2f6249e569b94028edca70a79096eddad5385535bf9f5e1819fc2b821fe4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
97KB

MD5
a765426b87c443b61b2d36eba26bdd0f

SHA1
9440165d41b2449bbe48fdfa2219e18ea24dde70

SHA256
1b1db5aa359c45a233bb500e491a8f2fc76af9073eec666872648aa7012ade66

SHA512
f10f99e3e9bbd2c054503e993f47f504e783a6adafec6b530c43aa976de7c68ff30ea79a7a78a7b9c208542f5f0e7e5daf479b4013861da7d7ed7014175aad03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
20KB

MD5
fb6e6131c19c9bb8deeca1ffe5c5674b

SHA1
0daea417987257b8d807e92b9b61a567e5a2f4e3

SHA256
1a9381ed1c1663de3b13d144eb8f06b680836b376dba821550de688cf041c8ee

SHA512
3621d963eeb2f33952041e64f3679d779b8c05bac00238d104bc66f2d5a12033346c037a0af8962f050e9e00ac3460d171c883e8251d3598cbec973b448fdce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ab21ba213d0644ca62932084af195337

SHA1
6baa9d8de9194d8d5bf6b718dcd2399b0627ef88

SHA256
eed53fbfc667be4109c8137a11929085b408bc1a4fdf504a8234b832c0f9582c

SHA512
0fe1914f206e22ec9379e1337f31c07d95e0aa1072f3194e35b97e86449fcd88e6cbaca273b05f3e8da0d4f0a066fa5c4b3d4baedce7adcaba42530ec1a92d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
01e10c0409de35b0bbc88f3147cd813f

SHA1
fc494a4465ca37a836ecf1b40c065a43ac27541e

SHA256
6ff2c380118388b7d6afa29b29cc4554e980f31d0b7a2366866f7d79165c3018

SHA512
55a41a481f10852604d181e6f4d5e9704f3846aa91d14fdb27318742ea2a09a6c37c6a9ce356b419ba2d6fbb90c45f9cb522597d0e013699407e23a674358d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e45d710459cc0e09c95cc62e7ad087a4

SHA1
081e46dd4ed0724da3b819ff154178a3c0553f57

SHA256
d54cbf421c765f5d3e00def11c25fdf53ab7b7fd664f6e10e0feb80295f4d73e

SHA512
29d61118f4990c04f901432189f477c3c56c73148661fdfa4823baa68369191f95b79b0c5ecdd32aef0220820979bb1da0764a72cb7407c90fe36e1a067fd8e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c17c2b92b3b1b40891a65a3d115ccdd

SHA1
dee4115cdf51b36edb2c9768bfeef9aef900cb2d

SHA256
580193c6d03ca076b7f17b0ba6524ec03b00f23adfe6e045d4fbc5f4a7c862b9

SHA512
f8e2b6be237ae1215a777588f11cfae377c96df32907e7a7625e24e0ab9fa6f21ab4d6f3687584daca0e38b567abeaa68fd0248a3cca8acef16704d394ad8a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
033f64af384e6863b9aa4d6905de1c6a

SHA1
8dcc82dd41b8e29ad43f15a4d72dcf0b06f57817

SHA256
bac52e81397124a9648d72b037182a0cdcbc8bb53b18f26c12f55ce319efebbf

SHA512
eb1b6e89389276c59aa1f6e7400936f276ddcf473571b0e09b70a6d31e186fbc359fbca4e602212773fc2a2f94e909f7231d67290e0867de6f63fa7f3468748d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85c49c15a3ea776dbf451162afdb2ae1

SHA1
9204577b6537e6f407d5b54b59226c6a3c04423a

SHA256
4fa60c4d047a817c4fa7d635b441db1befb034b6b515070ccd260db363c6c134

SHA512
8cdc0d6255d6134bef731c2ed7b65fb5c2395828bb2a46cd26d489813e62413f30041df85aceb32201ddce51f0a2f93cbcad14b32ab28d597111ec093bcfd069

Download Submit