fb4b077209fbc09c19aa0b62389d5ca0ed94d12d53db2f86663dccd9cb7fef9a

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0798fba1f74a4f74b1124da6f987a5f7_JaffaCakes118.html
Size

19KB
MD5

0798fba1f74a4f74b1124da6f987a5f7
SHA1

3426e77a30a32b9e475b1c59ffc7b2a1594d40ec
SHA256

fb4b077209fbc09c19aa0b62389d5ca0ed94d12d53db2f86663dccd9cb7fef9a
SHA512

e1d26df2684e77f1c10afbce212d7920e4d938a5fced1ccafa7968c7bbff4c167e52a07782dd9f594b5fd9807bc3b30e553e1b6d2965480d6a7c13b7bc371657
SSDEEP

384:Sj3uIqwDMx2SOmMFFjEX6GwDkT2mu6OilZVUbiykmpJd3h08pux6bP:SqJwDMA/FFTGZlOilZVUbiykmpbh02uq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
436	msedge.exe
436	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2576	436	msedge.exe	82
PID 436 wrote to memory of 2576	436	msedge.exe	82
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 616	436	msedge.exe	83
PID 436 wrote to memory of 3380	436	msedge.exe	84
PID 436 wrote to memory of 3380	436	msedge.exe	84
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85
PID 436 wrote to memory of 2824	436	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0798fba1f74a4f74b1124da6f987a5f7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe59d46f8,0x7fffe59d4708,0x7fffe59d4718
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,17901464262691954809,5227880305549024545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
4deb24d90dfdc9d25ae76d03d575cd95

SHA1
3769f89237189088ba38df4c8d481ca55a9e69aa

SHA256
4654497675711be72553a08926cf7552ac9551a362536fcf59c8b1b4548df386

SHA512
9d52f8c77f1972f35f7859eee7efe2c24794678e831f847ec02b06a8a54be983ac6b1da45b0ebb839af375a78fc2d757258f0335865198456e2d35c985937b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
2acf4e2d4134d354960fa7116a4f5a97

SHA1
f46e14dd57bd5f0689acadd06153db4b3bba50e4

SHA256
b3089c26d667b7b97302211677f7800149b534a93b5389f23c2ffa8fa3e2341d

SHA512
37a6f24e4b4f781e53a443df20b18c067b0c83e5f302852345b50ffef3589d03dfe52d3d90a0d085f0f3acfe9265b1c623c479b90f0c227b054b81c7bab45aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7c76ce4671aa057ba91d4b0a4f8eb077

SHA1
23cb918a8a648daf276e53c6ca4a9f24f47beca1

SHA256
586ec7399c5396ec311f686f20692cc2121b1660838e1bffb98d05bd4399f774

SHA512
71b807c7a668eb88c45119ce1c79e07dd7032b3b2d79bda44e7125c768895530b6ccb8dbc863dbaeace36667973cfea0c80049061acae8c54b2e4e54e7ab28e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5932906cdfb302566c31cc08e2d7082e

SHA1
c91d70da94ddc8b0de9f1c2534ffdccdf00bdc66

SHA256
c100c88c1531ed0195f53d79785f0939c1975b1b65099f5a32ff0d8c89ce45bd

SHA512
ea4a9bd863a1e09a7be8b32819fba03e733d6cf596ae78028476b487989085dd57a3a34d4f77bf48b4e973b3008cf23247c29928a30f2a67cdec38686d2c3e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cde2071f6b6d442c94a05f186f630264

SHA1
9fc664973efb0fc17445ba12e14611d209f20586

SHA256
466db7ed96c69991a5d6efd198d4f437ca46430f0b12983f98d3136df8cff6f6

SHA512
5ce45f6442f5212bbbe0cf803b26a9d062c4481315cdb8990158488a444ad10152f1337f18de233db7cf58102734fd51facc52a16e3e85c057075672307b632e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
207621d0288fe043af16858c68abdcac

SHA1
ba6d8441521e5ab0b7f1e70829b261b84e8ca62c

SHA256
1ac1c506829b18ae687f6d524b9e4acdb3b53ff3fd63695e14fd3c294b701969

SHA512
7eecf8d278956f671b9fc1190689674e573fb155276c3b91cdfdb29eb29576f3f79af0f3f55d186858fbf2bcadde13669de1518674c79b87741d94950010e9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d0e1eaa153b6f9cfbf1dd02b3c15f5d

SHA1
7a8965cf9c33696ff536413d1640003f237a0b09

SHA256
7a9b97e171618b9fb5f8fa52fccd001773984d5577e8a962c55ac0934735445b

SHA512
385de24b6495052638c2dc2bc2f216c5785f4dde298ec96040caf6a2fffad6a19cc6fed42d9185e21e29a099fec2b041d3645ba3a2262b192ee0047c2bc47f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9595898d8bf50b760d4e006bbceea630

SHA1
20f92e3638cbff0f384dd2320f0febdf65aceb5c

SHA256
c499d68dfc522ccd58f06a6d01575fb82cf3a3751d0e7e518a56b0cff9e7509d

SHA512
e0fd1d1bdd7340a19d797474eb4512f5ffaae7123f5b41bd3ac547a6c7fcddfd9d1bcf4ff2075138aa43946648357f76a3145e974dc7437cf119647ad6b4a74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58e3055b573cf7b08b903577a9d78445

SHA1
5b620f6802f581aebd1c1e32ffa01e58e8a4e7df

SHA256
70eafd67b529044200c4c688017561459e61f9065c359e6115bf992fad96d8c5

SHA512
385c559340f899e1c67321173ca3fb336885a0df3b40fef83ea1613c480af243f7423e5c6002373025c8cacd7a46e30e1c31c09da53afe842aa2981591a4b7a9

Download Submit