42876b750859f2d79eb9feb243dfb79c023eef8ebcd1638ab56bc2c9b2118f59

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be361819931c8e08b0d8ca6324c80a14_JaffaCakes118.html
Size

72KB
MD5

be361819931c8e08b0d8ca6324c80a14
SHA1

b34aa5214e5973c3d228277fe73741876f8232eb
SHA256

42876b750859f2d79eb9feb243dfb79c023eef8ebcd1638ab56bc2c9b2118f59
SHA512

5985659ea4a749abcefa5a18a2183c6f6d2501a11301943c467fa7d4c75d970f6e0df5014d723fb47189761213bb497782a6d3260d7974b42fb093cae0a68bc7
SSDEEP

768:tEen26pMoi2pN2uPBEPxMyfK2u8iyTVu9XJYyzji7jRD5OpN46GeRxP3wOYHGV72:tH2tobDeCB2NTR7jRD5Op3hxPgOYKKc2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
4284	msedge.exe
4284	msedge.exe
2752	identity_helper.exe
2752	identity_helper.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3124	4284	msedge.exe	84
PID 4284 wrote to memory of 3124	4284	msedge.exe	84
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3836	4284	msedge.exe	85
PID 4284 wrote to memory of 3364	4284	msedge.exe	86
PID 4284 wrote to memory of 3364	4284	msedge.exe	86
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87
PID 4284 wrote to memory of 4768	4284	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be361819931c8e08b0d8ca6324c80a14_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb53e546f8,0x7ffb53e54708,0x7ffb53e54718
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,506383300814671503,7770650579503425251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5480 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
67KB

MD5
b4b711f3e747704ffe02b49791ce8cac

SHA1
ac7ce4cbd3c8ee66e3c8d9d209c1352c160c3b89

SHA256
f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1

SHA512
b738deba57337a9147927f7dd35eab7c999dea6d2ff11f57fdc2e5b6f64326028a54778886548ba128a3f03ee333cc9e43de5162d8b578b85c290626577042db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
41KB

MD5
9a25111c0e90867c7b8f41c5462abfaf

SHA1
0619625d479f31cf145c2e3714de0df4a69169d1

SHA256
41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

SHA512
0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ff64bcce3042515b9c56a2519850b510

SHA1
bd1494f3ff7a0ac8dab8d17e5c908c05c14d1c33

SHA256
d90d3bda289025f3578f185c7b382afaf122e931a3f1b4173e469659764886b9

SHA512
736cb0aa857f0cec53db5fe24de47b4b23840958ecff503ecbeb1f77121bc7a64fd6c30ce865c5ddc72b3049a39eb2cab8e14654df74f1fa674f76d5914a2aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
c8d9c233051ff5840ee78226030f4735

SHA1
02ec45b699ff28401546301a4589efcc4aa67eb4

SHA256
1b2d502f8895f03371268287bf0a55be7ddabbc4ac76185469b7fcb277c1e688

SHA512
dde8c3f5bf08a72d72a162f58d018234b5ed4f02e713845f0d650c3c027cf8ed018015255f1ca6e5fa902507d1cb5d458c261a227b3f0813b71baed1a4867189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
91fa2fbfb9efd936f8930961279b9139

SHA1
da8c050b79f56d2231d2e37ea5b74ad93db742d6

SHA256
5d51123feb3617238004c7e4cbd23e34ea34a5a0c787031934547e96e61cbe6c

SHA512
33890493d377267ce62383566b1f55bd301c447976aad7c82eca6b4b4c152d89c130ee3cff957245db7af7919cc501d6c956e8b64067e1c94fda4a4521dcc7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cdebb492159907406c3a7f9264382a9

SHA1
cadcaa90dab46655f4f6057b8dbdd2b5570693ed

SHA256
a11d1f8e5308bd2fe5dc54309c107ed46b97f3c00a4863a3d1f4cd27e77c5e0c

SHA512
9e9aec915d7b1f2b25e4cf418255ba47ff7159a9d2086e85fd16b07d515f8da1142c724bb847d79a4e451db765d4bd3628bb8dc8e71e9beff510eab3da27859e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a1709cdd297d85879f29325dba87c4c0

SHA1
10b547f9f647345997100296202c53a1dedddf7a

SHA256
986d9f5b64e943773f462db0005dfb31619c5f2e6287dc9680ad16961d65f0a8

SHA512
dfcc442ac5737479fb3149d16e542fbab0c0b4b1993c2f71844d5cc6f5e96ad391f698620e870010cce100d38ce73f8c2f0dbb5c3ab5d6995f0be89cb3b0085c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9d2ddaea43e2647e8010000e3041f7d5

SHA1
7d068d1eec88cb1a8e7c8255bc6f64ba2d877e92

SHA256
0b0863663bc59c8b6bccf6f1d73f530927baaeb5c05d9df6abddde810939b56b

SHA512
f1dc005d7dfc6e1393a8c030ef5ebffdf85c8a627c34a465929ab36b7ed581a96ea3c86c4d81b1f538db4e2387b3982eee7162eb9ec5b1d216eb3a7e62535f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e2f3b9554e6bf8087e3893c579c8a6b4

SHA1
da9e81590a884defd329d8ebaf1c062fbb08eb7d

SHA256
3cfaa75009e76fb6e9adfebc7b136aa6c7a582829eb8ebddfe5626ae5559f079

SHA512
c97ab8405c1e9a8e1108173a8ee8c232fdcd19fbd9df66a3022e8b29317dc000b6a2dd2a4ad71d1499ff83346e117cc40b34c10ae52df44a4d7d983d19ed9771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b5de65621dadc993746904e25a1b460

SHA1
ebe350889956887166d5fceb821d716f5122953a

SHA256
dc16fce7c7814744b80d51f75aee3f7af68dae2abeed49fdf7daad5aced3d446

SHA512
954213e162c28afd706598013a0fdb9792891237ec024e6030e4a6ea01bfe4d421ca8f922252a539fcaff370a4ea83c57dff35f0382790c31ba19d8a966861de

Download Submit