6eb589b4c555a55007798caa61a1d48e3e7710007c975d39f5b78c8b12b61eeb

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

254046380d8360253fc364a6feb7d84f_JaffaCakes118.html
Size

27KB
MD5

254046380d8360253fc364a6feb7d84f
SHA1

27bbb608abaa8a066a21c79f7743824c9f41baf9
SHA256

6eb589b4c555a55007798caa61a1d48e3e7710007c975d39f5b78c8b12b61eeb
SHA512

713d52c3f5165d260ea4e35aa54f8557123b672d097f6a107c51f22d1ef81a42075b665cb0d13a21363e1ffc3ddaaa763665772bc2f6d7d8c7cb4600f057ac8f
SSDEEP

384:rg6Cy9c3zykgxoMkiSTgQe1Ov7Ng4D5nxbpHxDpLJvJzZvJb9hN/Lwar9Xlbd97P:rg6Cy9c3zykgxo5FgQe1iBwPvYlrwENx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
4460	msedge.exe
4460	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 908	4460	msedge.exe	83
PID 4460 wrote to memory of 908	4460	msedge.exe	83
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 244	4460	msedge.exe	84
PID 4460 wrote to memory of 3348	4460	msedge.exe	85
PID 4460 wrote to memory of 3348	4460	msedge.exe	85
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86
PID 4460 wrote to memory of 4916	4460	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\254046380d8360253fc364a6feb7d84f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a4546f8,0x7ffe5a454708,0x7ffe5a454718
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,7473143955737527401,10310345754064222093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
05743a07c67a6f90fc1380d8d091f1e0

SHA1
a3c1285449108ed79417c900b2eac0d2c56495fc

SHA256
a34631696091618e72a361c3daca2ced5eb14ae397323ada7b5becdbc4b1c31a

SHA512
350e53ad3afcc601efebda068385e99cb80ccefc0bd99a20079ca455a8b474b1399826b22de31a11056946259b50690ee0b68147940e367cde72c020c3842f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
138e38df97769dedf304b28348141190

SHA1
b7b01afcb999f3cc63b8ff96d2588e8a9c8d4ca4

SHA256
6a2122c0b7ec8ae7f362973ee243f306c4eb2ebc4c1e59934c3ba2ad4d0ef20a

SHA512
c8f9155f66e84edc45ae9b05dfad7ecf2e8469a4c7cf2d683e57be43f8de74d15b752270f726b8cd6da934eb2898651afc52adc270bbe951c057d47736e964f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9631e530f549171daf3cfcbc46e0a46c

SHA1
be58ae684c05217f1d9e3230e2bfcc92164a57f2

SHA256
415bea0ef8ce200f051c846fdd74bf5a8d8035d589adf5d2240fc792ff2f54a0

SHA512
1f0a90188a25c1ab72e7127f312b3cf0f19ed129ce7f524a4549af5f188fb38fa18d5483111f269b78a92c6c8e5f9a66d390848d7505ef9c85cd80ab08da77eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5b977ac9bd0b8432188c6e2ee4bfa80c

SHA1
822a4475e9b2d7454ad42fee8064db501b2c2e09

SHA256
55331acbfd59099fdaf8a0864f2e948f85b783462bd01ed18a88fcde0a6b726b

SHA512
404407500d51d6647584c3efcca3f19c57137facbd1f174745d10fdacba82f2851f3646fa1b622e078821ef62f30a2656df3c5417a6719ab088a88de18fa65b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c4f2808f6a199d9e7888b4d6dd7d19b

SHA1
1a840a9a264f79b6ac7cb97de09492f0c92f5544

SHA256
0c89d9b822712fe63ee765b7c1a7de061e2bfddf204dac8bbe15d158b98f7663

SHA512
11328194f038df9c05a78d1aacd809340af37ff1525bb2f4561adfbe381bdf32ca2e68b2d1c65e4740bdd0699a5396ec6e986014cd9cf08dddffbbcfe2a35e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aead67c215312a793e77e13bb7c5e0f9

SHA1
f2842fe6902cccba8f8ee77ecb948863482fab05

SHA256
1114dd8eace25b66c2986f42d22524e499f6b709ca52049dc2c77c904b5531af

SHA512
ababdd6cb5fba45ca79df2890c51bf26767c729b03fa5bd43fc51909c639501508d6ce50b76195692a710570b4fe71f31c57a404107d06a62ba5b2475f1728f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09840008f6c50afba5d25be783d87486

SHA1
f554b98045f75e50c0100baa6b7be648150c33d2

SHA256
c5e3fb15aae2618496033aa68588f629a8cd0d5c89e858ff1b6ef124a7c3805d

SHA512
c99189339ecda6d49657671da7e9df30a983c014a3fa6bb3135e7527aaa6554861c9c492a88e6366cbae9994e878d9b75392e2261600b60712971815a25e3242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c0dd437551ab3e742824594c137fd7d

SHA1
a0194596e4c47a0d1de6df998e5500c7a3f2ac6b

SHA256
d45e648d6fd1dcb8e8ddab0b13649682d39522308333b7192a758f6529686b77

SHA512
74f15db5a0e4c9fdc4273a8ad1b48a024ffe967c8de92fb4e70fa7a32c128ba211c07ce58916f161ca7f14a840e418182083069110ab6bbc50f850ab1eef67cb

Download Submit