d7060fd2a0bd7b968bceed740aad0b48df5205586149ca2f6daca2047045941e

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cf3076296870bb4ef95bd04db0e7d93_JaffaCakes118.html
Size

2KB
MD5

2cf3076296870bb4ef95bd04db0e7d93
SHA1

7b7f8f55178a822d724c02e0db44c4dce0ddc280
SHA256

d7060fd2a0bd7b968bceed740aad0b48df5205586149ca2f6daca2047045941e
SHA512

037d777a5222ce626f51f0ee936ef4264ac0d5efb97da3354508c27aaecc957ff0592d6eb734b9348e42011a1009d1929cd9cbd5b3526a3a70ab3e4b8f46e169

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc
HTTP URL	34	https://vimeo.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d0075b9f9b46525
HTTP URL	83	https://vimeo.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d0078c8beba63d5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3568	msedge.exe
3568	msedge.exe
4576	identity_helper.exe
4576	identity_helper.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 3712	3568	msedge.exe	83
PID 3568 wrote to memory of 3712	3568	msedge.exe	83
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 1360	3568	msedge.exe	85
PID 3568 wrote to memory of 3080	3568	msedge.exe	86
PID 3568 wrote to memory of 3080	3568	msedge.exe	86
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87
PID 3568 wrote to memory of 1552	3568	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2cf3076296870bb4ef95bd04db0e7d93_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe11e546f8,0x7ffe11e54708,0x7ffe11e54718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15115148293186107530,10295830837183623040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3c9d520e3f65d85956b36800ff71dc04

SHA1
39a8e34092db89e479000c0c1698ff498c4b59e8

SHA256
b5e70051ecbe91b1d816b909236865d20439bdf4c2bcf5674337f46974ea0ffc

SHA512
6d11ab52184c2f85205c9d27d4e8f64d27daf302af1ade9a87b25cf221086ce9ee4a383344551c864b4e8d44f99decc5a205558f29fd9b896908ba9be5b0303a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
36e58de9c78479163cd7081c61617e24

SHA1
b43b7de0ab94b905916f5804e61dfbfa007bd58c

SHA256
44e3c5fb40e1b3c26eab0eb73469a18173dbcdaab56b667597c3072736c8a73a

SHA512
ea1bcb5003b1e5bb4cd41320b0f4c575daf7aa48c52e2dcf8dfabe1c25dae817e98d4871253fedde76affc84a3f9a046fae8b337e0c630b489cb0c267ddd8135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d4460b6106e3f0986ba34a567a52910d

SHA1
58fa232a223377ecf1b689f682f65d581891c026

SHA256
9e5c12efb4b48fd15656198a227688d54b29a70078f1db013f95de8f4e5d8cb4

SHA512
b8457036837fab343fc9fd635a9a04de0b4ff3c2033e5de7a96e7211d26b7b70c249b61b09ac69602171cddafd8f664fb9e4043382d2a7487a9b7b17c2b86318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6877bfd7cb3f9b7bd3f5eb77d429f548

SHA1
4542f2d0e85067972c569e8368c75f4ff52899ec

SHA256
28d3d61165baacf330398baed1bac080c1c996669375294eff0171451937f8a6

SHA512
fab2ab451a22c20aa250739ace3b61657c94faa0e1ab3cf1fa3ac78beca8188b381e74c6af039f13384e7d7ac6398bb7da1b5eea43b58f240b70b3052de0170f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08a1cb7cf8083ca9e5414525b0d81b65

SHA1
6e9976e1d9ee12e5ef0ae616adee70c6fc4b2d50

SHA256
c3d3057f28398a09bb849ff9f53c68f498ac2c67605d4ec9b70639592cd99b02

SHA512
01bc8406cdeb320b28d3689a2971bafde5b66fac36bd67712282c76813c1f64e8baa2cc6697475dcf30a5644fd076fe9bf06c4e5d8d7edbc9d6df232317454c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5aa1445457917cc00f3b03005c1c554

SHA1
a54497f6109a54fbaaff60113c6cc0c6c15802c7

SHA256
b8f1d105e7f922cf1e1e915cc3f8abb3e1621b9b1bec700757745d92b2ccd4a2

SHA512
053e445d178ed14e503d1146ef8cf897ca0a108a29087f7968e2c1a863876f40f22c924d7d82f73ba069f7de8f8a19eb292f1abf514947697ec0a65b36e7dae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ebd73777c9c20eee94313b73c36f6ae6

SHA1
8891bf5c3d1720d6f2053247de7b21a772a3857b

SHA256
429f588120d5868e79380e3acaaf8a4d3d4f5bf6e39d8e614444c2a4f08cbb8a

SHA512
d964fd57f5054791a85bbb83a5d23ced6d4229042879f32c64ae462a2192d8ca7094096cf5a8b246eff6110132fc20e9d8b11caeb0a6b46929638f1fbac60dfb

Download Submit