076defaab54fadacb5670fe26425355efe18dcca6ac57fc29f629f6bae9e4a9b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0613d211499641433da9c9b5435fe4ec_JaffaCakes118.html
Size

38KB
MD5

0613d211499641433da9c9b5435fe4ec
SHA1

b331b08d079122d024581a308bffe1ffa2257ecf
SHA256

076defaab54fadacb5670fe26425355efe18dcca6ac57fc29f629f6bae9e4a9b
SHA512

90145cf99f2506ae6e523cc2bb5477107c3c31fe5e43ed75cb0f6515a5848dba73de3d73e2e5b9fbed223ef07a4c323288bbd46b8a41d8413761011d09f1d3b4
SSDEEP

768:/Gi1S5y5vWybmwKxtrmYGlmzQd8XdJ2Shy:/Lg81WybmxVmTMQOXdA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
2528	msedge.exe
2528	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3264	2528	msedge.exe	84
PID 2528 wrote to memory of 3264	2528	msedge.exe	84
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 4596	2528	msedge.exe	85
PID 2528 wrote to memory of 1504	2528	msedge.exe	86
PID 2528 wrote to memory of 1504	2528	msedge.exe	86
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87
PID 2528 wrote to memory of 4480	2528	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0613d211499641433da9c9b5435fe4ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0bef46f8,0x7ffc0bef4708,0x7ffc0bef4718
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7477367654509793770,6443982956190511124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
f7c2b21ca39bb878ed3e9d7f61805607

SHA1
844d3f26a089187b1346cafd187637ecd81c1688

SHA256
ef27d343eecaabfbcb65990725f01fed181061f0fa8a6c4c5819f2daf2d5a009

SHA512
ad6508b406f583e7f7aa2a901a9f64ba0eea2ae8700e6500c28104b57fc4db042a81b48a41ba980fd1aa4e71a694a26b483011c8907c4ad848f7850b85c1a017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ad487a11b4a7ac57dc5d98caec6e5af7

SHA1
907104cdb13bda4fb7cc47cd2f57caecf21312e8

SHA256
406532f7bf7f7cf4ec41206567c433fcacf2be028cebf1cdeec43880a9118323

SHA512
a14537c5000c9dc15d59772c0144e8060dfc892c3ed592866f1a33d2b0eeaa30a143981dd620e3b71a9857097e2449c74a6cdf82194d3ee0515ec14d46039051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f3270073074932509674c600a9a885ca

SHA1
e1c859ce38cee3a3a89d3bf20b067057b4539669

SHA256
b656aa0fc8dd255d25e78f8d747b12afeca44f5b26d10c32bc61338009db9dc3

SHA512
961c01b224b2c66f80cb2ce79194538152d7a145916887284e702a57a5ab20bada807ea33e7c442d2ae3f529282e0cae91da073cf0710151da2042f950e9df06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
597f970c66b6f145b1243d02569c1658

SHA1
82cfd7a90d6152e482aef2e9abf8cf04566caa89

SHA256
f92ad22453a3bfcf81cbc4bf9488b71a965744dd1356646de0b49a84a4ba2423

SHA512
8cff31e7192f6fa9d2ed0aeac46266ac60716da3741d41cb634d22a4ee0e1117363ac35a80f9cc99c12194bf944cd618e9ca8dbd45812593853136c8effcc2b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a92149597c0f2c6635732db262c3752c

SHA1
8363e7a62058f371604cc15c25710fe990a5e7ac

SHA256
72f7733f990d55d71ce08fcf0151fcee9ef9415782e43508431ecfd1b0f059f2

SHA512
f8cf64145fae856ddecd92500fc7869053d370fcc7282fb253f889921bfac8d739338f0e02eddbad2556ecc3f7392da82a9ef879d465310e72d4d91b2f0b7b8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba6ab0cecfd1353c1292b324b02e829f

SHA1
43419337490f54a1757c2b166e88efb0e795a48d

SHA256
2ff1d5f4992cb1f3f6aa807947273d57fb54373592a78ccf8eddca7803050984

SHA512
132536fa0e3d065aada29c79c9902b15b03d8842eaa05e44b5c15e203ec6f67c8b187f9c6d2d4d4557e936ffba4d7c3ef28844ac379f8b444b5b447fffe546fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9e879c464dd519ab22a0d6a9b24e7f6

SHA1
d546134154c6e753cf0ac79afd7495c951abf183

SHA256
b578b82795cccea2b178b64356aa7929226ff5ba2a0b3a6f584c56918f4aafee

SHA512
f7ffd04c02aa0c551cf5b22d006d75e701610cbd4718945dbb6dfab1b91a179e6989be6c9303578f81f7be92e78f3c228d5621c91aa82e961afb91ac57cf6805

Download Submit