b574d7ed58fb97e81f75fe00b0d4f306569abc88421fc46da77ece8ee687de3c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39296b8a99ca89f4635007ff141542ee_JaffaCakes118.html
Size

119KB
MD5

39296b8a99ca89f4635007ff141542ee
SHA1

7a211d30c207ad9e9fc895004272758cb0c33f02
SHA256

b574d7ed58fb97e81f75fe00b0d4f306569abc88421fc46da77ece8ee687de3c
SHA512

afa49d39295369f99dd78b63b23ad6b80e8b9dc78e90ddd358b091d13fd7de1a41aaed9b469a32690dedc70ae61ce80506a92d464c99f4af967f69bcf14f04b2
SSDEEP

3072:i+WieC0hpllOUcjvG8rMUDEyjitKzYIVt6e:i+WieC0hpllCTC0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4248	msedge.exe
4248	msedge.exe
660	identity_helper.exe
660	identity_helper.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2812	4248	msedge.exe	83
PID 4248 wrote to memory of 2812	4248	msedge.exe	83
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4932	4248	msedge.exe	84
PID 4248 wrote to memory of 4140	4248	msedge.exe	85
PID 4248 wrote to memory of 4140	4248	msedge.exe	85
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86
PID 4248 wrote to memory of 4492	4248	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39296b8a99ca89f4635007ff141542ee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8736146f8,0x7ff873614708,0x7ff873614718
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16826980753441890852,17184807241090119251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
c6ee151c95d5bd2339c67eca774449fe

SHA1
c2de7e4a87b91ddd246fee53b8274b35fc55603a

SHA256
65edc4727e2bdb04a0ad28564af17bcf3bd7029811429804d283c8f0e186ce09

SHA512
eb04604f00aba42cffeecf266cc7dbfc096708ebe615ed2141bd422585db26a12b54f9c22041c798cb01e4c3d3e5c70fff935b0c7a508fbf61f6201c3dc678b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
647d0b26964b0d67e3e644ddc999901e

SHA1
19e69737a16365c8469b0cf2f7fd02d6108ba86d

SHA256
b3d1b50d89d99dc5ed0f4c6d690f44fbc454c018842ac98707faf8407d82da56

SHA512
2304eb71fa27dcba0c4a64a6d9e7ccb205e215afadd4cfadc11f1f5310bdfc19aa761702e4109502e70ef72304309d09aa5313d8e004d04f3878a21e4c91bf5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9c26376487bdfa627dae6ede8e11d43a

SHA1
a9ee777021da70fd87c5666315e4582b410efa87

SHA256
7989043891cca2936fd8fd3ad199c2a695aa0650e08f458362de50fbd7fac06b

SHA512
3eaa7df8f6b62e13eeaf25a136af029a9a42055d8c3b5d2146ff9015f5d6c33e49c890ba13f58880bc02f22e89a2232e1764c603c0853fc94215f9c6170bfded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
163737f4410fce4de663624692d5c300

SHA1
3431f7606e66ef9f0983d956ded583317a0aea28

SHA256
712c3ec07889d3187e93dbd9a20b70a3b430f81968733cc6a50659cb0e35272c

SHA512
418c81bd8a3394790a0869986d03614a304d57e7c8bf1b2fabb45fc19306ded14ef267c537ddba24fb0adc0a8faad9237928bb608e3a38f990946be1e203464d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f6306e376e819433e7c1e5db9f20fef

SHA1
3dd552310d4b7aecd330b2e6018ca98f8be2a54b

SHA256
25178939cab7493e179919c9e3a1bde424113531e456b08ce9b9e27ca51fb626

SHA512
7052abedf18b4469939b19566c5119c2b1b276872c241eec4b06845a0cf2d94dd1719dc3f192737ae6c0a75c3f4b30ef977d4b04eb59708755d7f0935ff79189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d8517013edcb95645630fde13c8e204

SHA1
21ed2c348df60a77f2c51c6288541f2037b83d58

SHA256
b55fe0070709916a556222efa01741616a8034cbf7d7f8fcdb9e202284e6d926

SHA512
4fe0832579a492acc8e3f29d3b8f3eb1473a2c3ba90160b9b01267751e449562168e4a83d893b1a710c491ef4f088249f5aabdf883d2f30a2feff4514b0380e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
51d140564cffe77f8b286209d9911966

SHA1
17962cb6018a15a5da12aea1aa8f8afa12b195dc

SHA256
f0882ed472e2540461596a20f4ada5867a2bae53a24320fcf1998a38490cc86b

SHA512
f6f0335358a60bcd35cf34257b33cd3a0d02c8fa9e01358509448c9660aec3579b5f54bca67ffddd5abea3b766ef4fb5cc9e5902b53ff294ae7136899766d2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a8e980fa8b3beb3d4d51ea5545f8f609

SHA1
723c0021892799ddbbe9dd69d215c77148bfc82e

SHA256
0aa9c7292671e1b47c93eb1008138857de7f7b3a0dc72d45905d6127255ca6a6

SHA512
752bd84bbaf6e28fa9bcb8d105d30ba4036b25e4305d1dbcdaefb967c407029475a12253485ccdeb65f20685b734b7a60f56c1f48e970f72e99465e62af982eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
59b8f986bc4fe1779a18e74beaf506fa

SHA1
c29fe3f65c5758e945c288718ab2c28c66b92954

SHA256
6f10bf5944b45a925b800534ea08aab5fe9539d1d70ddf104cbba8c29fae9f18

SHA512
0b310a0233ae7776c479dcc051da26a87a59786a0c59ec124fb75c74a10011409e150ce37c0f0ba9fc65bf374ffadb1ad483d1fc416ca2189828984881c33ef8

Download Submit