935db91c21bb973b7d6e4642efa1bb67095646505b81ac1d6359c6a65e754c8a

Analysis

max time kernel
100s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe11c990b14e6920024d39441e1a3d0f_JaffaCakes118.html
Size

27KB
MD5

fe11c990b14e6920024d39441e1a3d0f
SHA1

40fc07ef1cc5e71d23cac5f16e5e046bab34684b
SHA256

935db91c21bb973b7d6e4642efa1bb67095646505b81ac1d6359c6a65e754c8a
SHA512

b62c7fd68eb97f0e043fb06e7019aa0eb37ee52808da01dd3416a070d01d5eb9801017089b1df637b6549151f75ede8d9d1491356e432163b62df489d55ea466
SSDEEP

384:dBorjpKAqa4ktyKDTTcSz+YfbVPdB92+usXJE7UBP/iYrJSWIrOxboYDAnFB:dBg8Ra4cUSnTVlvHJCnFB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
4680	msedge.exe
4680	msedge.exe
2592	identity_helper.exe
2592	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4164	4680	msedge.exe	82
PID 4680 wrote to memory of 4164	4680	msedge.exe	82
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 1144	4680	msedge.exe	83
PID 4680 wrote to memory of 3872	4680	msedge.exe	84
PID 4680 wrote to memory of 3872	4680	msedge.exe	84
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85
PID 4680 wrote to memory of 840	4680	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe11c990b14e6920024d39441e1a3d0f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2991146441661810640,12029004463964332313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f10045b8b3daa05634b35221c2ba8ef5

SHA1
b7dc1b2253b1799db09c0037f32cd08cc050fbe3

SHA256
09dc91981cf4a2442c58df465f9731e8c80581300904d0c029ff2b0ca48069c2

SHA512
d1e20a8bc510c7cddcbad1122b6ebbebeb1c2fca9250b381a992801ee88e8123993bb1984c0d8822240514d53ae8a59d2d328373fe3a999669373e7d324d3c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7bbc67c0fbbae2ee5256d4e6907b16a7

SHA1
fc49a531ce7ec5024677e03ebc696e0ee807b7e3

SHA256
90e2b5038ee231a76a1cb0ecf270dde4324c05ce5eda11af8357fe5eaf672cdd

SHA512
482b7c7cd4118c4eb21267c8c788c2fb42557d246531fff4c69faabaef7c2830a15f9f9b1bf18714e3040a4b4f791abad205ab9bfce22b42afa353cd7c63a147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
21b6d1dac08f88f573117149391b4ae0

SHA1
964a1c57ddc9620a7365334613f30715f2e189b2

SHA256
984c9a034437f3cca8b4a3e1ab68c2a1fe361be924d7af1f8aa6e99c668063dd

SHA512
c38e3fb79d1fd328fc2875721150f84a123f5f7b5a816ad05597afb39cf68f68361ef3fe6722477f56eaf82c72638d45247fae5d618e26067d4b1933212bada7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e54942a5dcd28d6f539b750cf7bb093c

SHA1
1554f6ed8674c148079f1e4ee741ddd4e1597fb1

SHA256
015216095b5621c570346355bd395b298411b8cb2872799aba433acc468f21b5

SHA512
adeaec317849aac1ef3f9305327193faaf3baf81204e7ab279632cd7a9ac4fdc447ae8328612ca9e1b031b2d3a6b91c691986b35ed12234afc3824f938fe555f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc1cb107fa6a1595195dd6789edee9d1

SHA1
67067a87a3e250489b55444b1bae61835189a2d0

SHA256
e8f6f1415e7e9ef1dc97516f985702884325e670c63a06958aea01bf4ff7c995

SHA512
37cedf91e3f6baf19b8aa7e46e3cc76640a582ae03c9c8764aa09e1ef213c7b8d13eacf53a359e395c12574ab9686acd87b4a1a1a6945eda386686623b7e2ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71da459797d8440cc5d1bf5013397c1c

SHA1
c1e72995f17eddde040f0075cff6b70af631981b

SHA256
cdb4c232c8a06921eb00fa5e7ac4c2a6d695dc800490c2453d45b238a3a03280

SHA512
2c2d5894dfc101317762c2d489ccd08c23f7c07a3131a7f6f9fb5d835258536c52be82cb426f73dd7f9b689c20ebf0f5b2aa8a97a7e9a4918087c27f51265d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08fecb15019f8e53d4b018930ee6c34a

SHA1
347403207662b92c9c5e85ee4ba9b8e8c429669b

SHA256
15b555be88835450c49272b964d1966fee7c9540daacce49ca6f6b62b0337ecd

SHA512
eddc2353be8cf5cb9adfaa8457657f3f07ad21dda160b525e020307c56cc1576b442a54a7ecfec045414d20c7b4c37d8a671e0dc68f6a5afb5758d1bcf0462cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b0691d90da8b91614d4d32286eec373

SHA1
ee79e0bff9a064a5b5db0f99f13c5874aad4ff6b

SHA256
d95f901299086e24daf4b3171228644559b4c0f01786b9583e4825b227908327

SHA512
cc08a17029db4a53402b46771c0bcc8780b906eb2e772335e77665db78532e5b5e2925e56cb2dbc7edff2d2783705c238fef2255dc828cea3b7dad6f036cb5f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6bd09b90877e9f41a2c9ca33e686105b

SHA1
a934471fc235022f2da1a013324529d04d2016d7

SHA256
6e2dc2af819728e94a5f8ebefa098007e2395c9bc5568032220eccdab11f2d09

SHA512
622d2910fce0cd58589fdc3e874380a5a3ec19511c4f3a306a894aa548391b61be6f9f4e5a00fe9eb49537c317df4b237f7ed1a931e8299893196e51cdbcf9f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0c41f864eb086d7963172e12ac3fc6c5

SHA1
04b3533fd6e02bdfb53651131118601788bd416e

SHA256
9b8f0bcf743d149e6c02d08f1333b30e90da5d1b12359574bb2a7d2f1775b366

SHA512
3828b6de6444415873f516e83c69a9ab18a260a7d17079364bf88168b23f465956b371e0b598fde3c0a14468da315c1086ebf3e09cc254cf27fb4d3f636addf4

Download Submit