82fa8da6e14bb407e0d4d0d32c91c7d02ef16125e51c764b778cec99b1b8b763

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bff7861142ffa1ca6fb2e28b36825534_JaffaCakes118.html
Size

58KB
MD5

bff7861142ffa1ca6fb2e28b36825534
SHA1

2c83af098f2746c07ed9d9a0b87c272b48884de1
SHA256

82fa8da6e14bb407e0d4d0d32c91c7d02ef16125e51c764b778cec99b1b8b763
SHA512

baf17bb4fc5397ab3163ff9394ccf6df043732c3888569e62aba67fb6cb3480afcc60d74e165e38f0a40d6fad461901bbdb29cdf1bf9bf2f37dd024272a8ef41
SSDEEP

768:PFhT0EipB7szzzZqECEmEUO6tBNQPepOAsddtP4I+76sZl+vJ29i9T:nTupB7OIECEmEUO6/5daddQ6sZaf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
4536	msedge.exe
4536	msedge.exe
5280	identity_helper.exe
5280	identity_helper.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1368	4536	msedge.exe	84
PID 4536 wrote to memory of 1368	4536	msedge.exe	84
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 1012	4536	msedge.exe	85
PID 4536 wrote to memory of 2864	4536	msedge.exe	86
PID 4536 wrote to memory of 2864	4536	msedge.exe	86
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87
PID 4536 wrote to memory of 4004	4536	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bff7861142ffa1ca6fb2e28b36825534_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd472946f8,0x7ffd47294708,0x7ffd47294718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1286652687898986600,7484065415639336666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
67KB

MD5
b4b711f3e747704ffe02b49791ce8cac

SHA1
ac7ce4cbd3c8ee66e3c8d9d209c1352c160c3b89

SHA256
f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1

SHA512
b738deba57337a9147927f7dd35eab7c999dea6d2ff11f57fdc2e5b6f64326028a54778886548ba128a3f03ee333cc9e43de5162d8b578b85c290626577042db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
54b4ef01bb5cc4dcbe21df9f5ebb4601

SHA1
af5b621813081eb6fe1974438d35cf6f7f3a2a36

SHA256
39d538b8d552fe885b56c87ec38295c3b70853d598e5af7ac34fa80fd31498a1

SHA512
d6e9c63f69fb1a20c3c2cc2a59798f3ea3d3c87d413344094fc90055eb194871a7b7b16a64a7306c174a3c93b42b283fab890052bbb33c210bf37e741c400ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
bb4a665ca0c6003884bea25c2154aa9d

SHA1
7c13cad51a344e81d2ddcfa08ddc192a79d9a086

SHA256
05aa88ca7f33c682d1918b8ed22cb7a316a03b99e25e2adc2347a3d2a5a9860b

SHA512
2d2f3aadf4993f3d30d7ae477088f8637853208b5df055d6d38376e0fe5481baae41d28094450e786b3ec457a6d93d52fff81d01183765ffbb6204c3608d1c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0c516fb75732466b326661b31488a955

SHA1
f30b7bf3a99e3e110f208045fef1a0476dc48857

SHA256
e3bb14e298de6befc39952ff9720ef180c0fcfc7f5c005a7a0005dc1fc79703a

SHA512
8287176c5ea1b7db656927f8b5d342e97a5d1cbc103141e8a5af0ed7043489fb5cd6fc4b3db93eb96e7c00d345fc96bf10c3555f2de2042d3e8e8adb6646488a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7142e98bafb60e14811e15c77e0a6e66

SHA1
4b4bba856106ac291f95213a5bdc5b45d54ed1e4

SHA256
a0f3734f289f9dcad9fdaf57245f876e8dfc3e6762c57017384f7a071df75dca

SHA512
381aa7960032def8f931ebea19f44784ae049a59ff9302d7ea19b27e4ca4b8d1d2389b75e9e95f90b2e292c68bb1a6bf3f179ed73a216c281ee3899d88d10eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8dbc698f525dd494e0128b61dec04782

SHA1
a49d7c1a1829a638236116232ed8a431e5ebb35f

SHA256
d2a5a31c077ddaa6cbc6b2f5d63d4cfdd697e5d3ebc4a61103f10b30ea8f157d

SHA512
a41fb778e0af16fcf9cecb331163a892b5295b3f93bc439ca83b1c005961ffa7aadfd5fa0ce7494e1dc091bafcc898d634cec11d086fd736269e3ba0be92ab77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f211e360cc1d6c01371ed896f39cc40

SHA1
3fe61073b252af52e6a4ae7dca76d96eed4a99cf

SHA256
f84e545aae2980a4674949a93a3484efbba87d765bd4214d72fdea82b3ebafa6

SHA512
f14765067943051d13e9212b6b021459bf56ba62b60f880e046e83ef57cd90418ade868c7635d5647463f2c7b00ccc1fa5ac27ed2042d25de988c473982e6eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba3da0802d930344f531dcbb773a4f8b

SHA1
be06af20ebeb47b10cd3104e09722aed81e25c97

SHA256
5941f63c9a2cdbba4a45dd3d227898f3e16d7aafe9c9d196c52205abfebb83de

SHA512
8feb93fb2b160710da3a128ae81c48089c3a03535124b06c0e18f971f99409f935afc1301997df31a882b5e86be478271c25df1be3b773dc22ff4e3be793ad0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
56a29dc3faa4ddd03bfec06eec9765dd

SHA1
2cdc51a89a819fcf82188801f252f0444defc109

SHA256
1ae0e0c2570ec7290b048cf04006be1c24a66ba65d99b8ab3530474190f94a25

SHA512
538f6c169c8b81c500f80a54cf1d928a70b846f0cf2daee173c38b4628df0a43eac3caa5eae7062a41f1de751eb9ddf1e1aa5c40f1af5bb4fb36cf9fff45da59

Download Submit