ae787ad5200b7f8260c223b80071e5685ef2d959db05e5126295eec5801dc81c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab30d3ed28be7b2475fff322e32d51a_JaffaCakes118.html
Size

62KB
MD5

eab30d3ed28be7b2475fff322e32d51a
SHA1

207a7bb33c84648b62136b43b89b227c0efecd0b
SHA256

ae787ad5200b7f8260c223b80071e5685ef2d959db05e5126295eec5801dc81c
SHA512

547a62432d01fabdcc98dbbd8b9f4c717014bf1d71af75e1797fae11324e18b3a8e1ae5755af982f6a811ecb24c1dfe4d784dda6ca7d9b84f0a77b103bedf36b
SSDEEP

1536:l3HH2lu8PFfs7ChS5fTwa721VspGYALP0:9HWQ8Nfs7ChS5fTwa721anALP0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
3288	msedge.exe
3288	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1048	3288	msedge.exe	82
PID 3288 wrote to memory of 1048	3288	msedge.exe	82
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 1760	3288	msedge.exe	83
PID 3288 wrote to memory of 896	3288	msedge.exe	84
PID 3288 wrote to memory of 896	3288	msedge.exe	84
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85
PID 3288 wrote to memory of 3280	3288	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab30d3ed28be7b2475fff322e32d51a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd50e46f8,0x7fffd50e4708,0x7fffd50e4718
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,7429590691930154981,12837204396217952018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
d02949f3ac1e85460b03c6d18edc1c32

SHA1
5a081e5e4b4634dd6b2f4f81b1bad97cd83dd75b

SHA256
c2d762fd03d677c6e0ab5b65c57af4c9ccd4500f3078a2bbe8faa870fb425ef4

SHA512
86bbbc02c6980b096a06a803a2a54b23be5f855df1a7c3cc455bd7eff5a38b1cd08271358641cf5e047457c11de43592d5a79e348c87c11717e91aa2f9bff313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
af9d2f1186727c071d5552b25cd0069a

SHA1
7149a680d6e053c2c2fa477d942903c54a4ed341

SHA256
43495a9c6fc8130900420758d8f6f3f2097af31a039df7224148b93f1182693e

SHA512
11de40437294658b528959f109cead7a6a79495795e078cd837d092f8ec232b09cab38dc209e0d90f700fd8f2b2595731b29c179e24c5e0ee1c1a0a5af26d5a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c44aec80f84ab7ba511b03c5a34e35b7

SHA1
8b151d2a2029224776c184a959fc6ff70e4de938

SHA256
a38363c3da3b3d36dc1304c416dce2491d185bb01f5fb0a8ea92bef08dc3948e

SHA512
30cdbfffc2ad002ae5803e9c92664547f23d49115efb07f90b4ea527f5269af8946e0b5ae1c39ad24025726021f92686b080bf5fc74fd586ad561eb3144280a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6b9b3a62b1b8527adbb94fdf132a255c

SHA1
8170f81635e178a0c6e49e2b6c1981d27bb7f647

SHA256
22d8804d42b2d8a0ac056382bacfd528faacd88d7cca5b403501f70e7b96d392

SHA512
3a90e8c35ab8f9cdbdd79357c82fc9a8ce534bc12d6e4c3c3bc1a72a8752ae86533877beb426a437d9881de3150a03a30223df3503c5f8ce8d17230b27beb72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b97f99f167f325d8dd2c3d43f5cde718

SHA1
cef713d30319832c9cc9805841d9030bcda3d6ed

SHA256
665588cf3bbfcdd8d1ba55572669dcae7b86e4a9b183af29809662178b76790d

SHA512
b8df991495d66fb7041f3edcea30c313fbfebacc9e3c1bb9d935effaec3133b077f2aeda98fd1d140ffa4b9275a2fe6bc816864dc46cc617e190a4a99057c930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bffde40e9657b6f0418ced0236c7c879

SHA1
6f8ea9943a187cb4f2a0c50bfaca35a467694a23

SHA256
40578dca3c8d0c8076d4b60a079fd9b381dcf51d27b13abc3655d4025524bd6a

SHA512
b92a7e2bd65f5e699803cee4c3b9492b817f41438e44c14eb65291b82458681c8484be6d13fdbd46ff9017bf6cff541468d492e3e70d5cf29a63a7a724129253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6e173efaba1b11b28f2560f07c33d04

SHA1
563e2476c8582af1fc79984080d2c4f6e7592f5a

SHA256
b337dae004e6a2a06862720ef3eaa4633fd79fff2824e1ad3afe286ddd5970b7

SHA512
f8075bdab94965370f6a7a0acb6b0b5e6ec56aa386fd709de7c71dd1196c359849453f7ddb9cf2a1883cc761e8abab895229e8d0597891440446c318f4776de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9febcb616a1888b57cf614754246f043

SHA1
9f145cc52ad15c3898d7d650c2ef8dd9b4abba12

SHA256
54aee29b117c699078ebdcf3cef030ad82c9b4dee9617fa85239107f305d727b

SHA512
ee0fbdb44ebce39ca9aba6a707e3cd318a4c43ace9c1fe29a9a9f2befa5b93e9047a15e8d903b8b323ab706b1647a3d408e4c1c68e79dcf4f45fa4eacc78d901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a1e22920897c76a4dd58134244f3a869

SHA1
824137d6bffe5ec0eb3e99f73ff991a48a0a9c1e

SHA256
67889075a0a3e8db2837e3331ace0e67d1026ff470df031eedd1cf4b9ffa5c06

SHA512
5fdb09130fe13d401407208aa5e6d7bf9002dd18ea88122f8c87d75e38fab880c26ec20980470e4917397eb728317011f5233a56f1307cd25ad70d22247864a6

Download Submit