31fa35d8b10ca9b80e17424fdd389460a5686dfc441f350dccf74c506c241025

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f96e6ee74270aa3318b2acea8f70da_JaffaCakes118.html
Size

41KB
MD5

38f96e6ee74270aa3318b2acea8f70da
SHA1

a401b0049a4854b349a85bbc13d540436d773e03
SHA256

31fa35d8b10ca9b80e17424fdd389460a5686dfc441f350dccf74c506c241025
SHA512

3eec5e9f889e103d616c77486c73f4c1591bd4b4a430d7cea486cb724abc4e8154202fa052f069df5a114ed15915e8794a2d378c154260afdbf5af324250db22
SSDEEP

768:W5eP+yUbVLS6dpBagHwPvsHuDs6NeVJ+PMpeHyOVPbFiC6qnKa7BRu1m4ct:x+HbVLSmpBaGfHuDxk03HyOVPEnalRuE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
1748	msedge.exe
1748	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2780	1748	msedge.exe	85
PID 1748 wrote to memory of 2780	1748	msedge.exe	85
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 3856	1748	msedge.exe	86
PID 1748 wrote to memory of 4612	1748	msedge.exe	87
PID 1748 wrote to memory of 4612	1748	msedge.exe	87
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88
PID 1748 wrote to memory of 1620	1748	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\38f96e6ee74270aa3318b2acea8f70da_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef21e46f8,0x7ffef21e4708,0x7ffef21e4718
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11016048215335674890,15095598741961421108,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d593029-3b65-463d-b8b9-19ac960bd809.tmp

Filesize
8KB

MD5
2ff00130fabd42be72903f85cfb2ee5a

SHA1
4c0ec8ae3a674cb5167c79988cfffdfe5e5211ab

SHA256
26c96149a36a7f48cfdc4ed51b8906dfe30548e1c03aa27aaabee885ec324583

SHA512
febf06ce442482adacaf8fd5d52e761f1cb846d49364bd3ab683f9e80562bbfca57c226bd608b089d392b7c6aa8189b45fc5bec14e7ce8a0e6984b3a439f2288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
b30038520a508a8c6370f4bb18d9fa65

SHA1
ba9ccc855c9aac6465e33255fa43834ec9b467f6

SHA256
07430b3dd6d53f2acb73bd8f3d450396bb418c51da295edb2f0890ebdd16265e

SHA512
f690e90516575a46e476bec8d0a803756a7c61fe82f940433095ef7db32b1e7837f059d331dc4805911d46554564faf22640b959c266c4616ad29fef2939dcd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
53adb523cd46d3f35b79193cb7d9a2a3

SHA1
df10101ac76abfbaa43766bce2986813da6e32e1

SHA256
0ac4800dca12892c237f4a7ba0b76d46c3a14858b82e6f00ff91b1b420cf3988

SHA512
2a37570849ad6d2db4b8c694ad1b41f3788e67b115474bc480a2eee26397a9c6b6cbab104a789bba3049c25e737526f992e57312ccd94ddab6b4d889176b3638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cb10227a54129b7442cf8f9eef72b072

SHA1
e86ec9f8fb011fcddfae48012971a3ecd22bf90e

SHA256
4f3da85a2b1556a4b51ddc22c11ed4aeda2572303a3b67864e215a0c915db6ef

SHA512
290ee902f8cc17d73d498d61f0b0b782e8840abacdeadf954417415acb89eb397ce08f03314db72fe6d83c1b5f111d83425c8287cf190814e12b2466d483248a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5b1a7984ef94370b3bfbd9b873bd786c

SHA1
ffa3cf69ebb38e1cd7f0ac6cc7155133130be40a

SHA256
805f2583daef236a21190d06e05112483d427768b039d0a21cd055a377780f15

SHA512
ec1aab45e521a5f29b5f24f4d051cf9eb499412dee548ac4b2cb8e752ababcf0b683fcc2bf98ee1782189ccc3d837bd697fa31d8ca99948c122b4a75f4ea9baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c194fc873d86e765a8d51c36b2f477b

SHA1
56fe875fdc08b476124520a71ae236c693e9ea50

SHA256
3e78f697436b69cd7cc22cec3b71c8a55d15cd1b8da95f324df26a144c04a34d

SHA512
d636d9d1f6f6b6f77cf9576571361b4fb59d96e56ce035ad6de9be3eb224341375f221da5fbec36a41007bb4ff649ae2f569a22fbfb024239c04d16afcba251d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
873d740f451cfbef84b465360537457c

SHA1
6e0978277a62d94285ef434a90f670f34ea2b00a

SHA256
78a8163a3bdc6e66054ee83e4bba8b8e418bd567757c090cf6de28745e0ad004

SHA512
d4b48532252a1b818ffce2e109c7106a6aed01f5edc92b1aa4f089337a4389f08aef4f4ae04a520c137973e07edf0592296cc825f894ff1993013273c1adc30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
426b23c99e80f7a671a1157fcd666287

SHA1
6681e69612be8f51333cc2edf80a3ad75f92e5ac

SHA256
43112749a71c96bdbceecd2d7e368869119296133be40597218d1076e27c804b

SHA512
723f509ede6b0172619eb049d08d1fc16804596f2b0faddb3e24a070e9a03116bc75c9b485e25a8bb991bc22e35457e3561f57868e43854b15f48234e5082610

Download Submit