375c3ece759cd4093886f3b721482d15ab93a7019f178dec91d0df79ff6620ac

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a9fdefeacb81911e270f40d4a3172eb_JaffaCakes118.html
Size

55KB
MD5

3a9fdefeacb81911e270f40d4a3172eb
SHA1

b13b5411020a6a5aa3816a44087760ee5366cc21
SHA256

375c3ece759cd4093886f3b721482d15ab93a7019f178dec91d0df79ff6620ac
SHA512

0fc1989f39e0d827558d244e2ec609d9fd9a915a58734a18869956011cb60ec91ff26b763857ce04f918a4b0d9041648efac6f46627420718cbe9d8173aa31fd
SSDEEP

1536:/TavPTupB5NoX5PFpTly7lYs0dZqG0oolpwGCU3ZJfvKm:LyipB56X5PFpTg7lgqG0oolyGCU3ZJnX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4432	msedge.exe
4432	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4704	4432	msedge.exe	83
PID 4432 wrote to memory of 4704	4432	msedge.exe	83
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 1980	4432	msedge.exe	84
PID 4432 wrote to memory of 4852	4432	msedge.exe	85
PID 4432 wrote to memory of 4852	4432	msedge.exe	85
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86
PID 4432 wrote to memory of 1860	4432	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3a9fdefeacb81911e270f40d4a3172eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6dc246f8,0x7ffa6dc24708,0x7ffa6dc24718
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,5108815178771113500,3990497601804203451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
29fa29e2847184adac7336a4789eae67

SHA1
79a799b6d927fc61f3cfac24187f60b14f997dd2

SHA256
b21d2d9fa4521be3331a1a39d0f3a3ff4f4c858fc71069b070b5095c887a7aa6

SHA512
bdd17cf0cb93648ada8bf6192d880aa984d43a4e5ae23d31d37047fe81775ff7aa356f3d799793ccea411d8c77661fbee989b31d9835f32efc15dd16faa8d4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
23KB

MD5
c6ee151c95d5bd2339c67eca774449fe

SHA1
c2de7e4a87b91ddd246fee53b8274b35fc55603a

SHA256
65edc4727e2bdb04a0ad28564af17bcf3bd7029811429804d283c8f0e186ce09

SHA512
eb04604f00aba42cffeecf266cc7dbfc096708ebe615ed2141bd422585db26a12b54f9c22041c798cb01e4c3d3e5c70fff935b0c7a508fbf61f6201c3dc678b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d956875346182818073784eee0fc9200

SHA1
aeacfa3c08326f53715ec5cedc2c998990e347c2

SHA256
25e385e26adf84b991203ee71681c86e03fcdfd3361d19243d71c10b7cdd36b3

SHA512
0dfaff2ab99da1112907b7e2aeb1c2ec74fe067645c9edf95871805070f50861b51460905fa456ceec85659ae61332f97c62a353a75b2aff6a338c27101ebb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9f1117c8a3bcb767b2bf6c0a262d17c0

SHA1
6cfe433bae8cf641cfadf3f600c973c26076daa2

SHA256
93d4cdd147660930a401be760f2c584ec80b8bbdb8f80638835fa836cfb223b6

SHA512
379cf33ebcaebf27f2823daf6a8bee3ef60d4f461e189d657293ff129cfd1b65400d1cb308f988411a6a8c3aa6c9e4eba48b9b30ff9e476f4d056d7176c2cc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
980bb8734134f36d4181cab82a2cc656

SHA1
7a64b8be17053e164aedaadf08961e3329cf3488

SHA256
1427149a6ca9c584161700f32db7ef8657825cfe56544721e023991a2e2c6e43

SHA512
91e3c3decd93290cf5add59d88e20dd5486d6b17851ad3bce86d97198874daf34e87ec509f94c3f0e37319de9b446b0eeac494f7ef1faa0aaa21babc518f0273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
21bec2ee7a53b83c60f8fe79a1ef6597

SHA1
23720d6cc459309ee6c2cc59696d71136beabe69

SHA256
3c2094c4fb763bb3cd5ca5bfbed431f58edc5b982b34d32ea4de882965c92e47

SHA512
cf0ab5428944ce8565758619669e354b8ca6d2933ff8d85c78e0e37c597c135cd6918979506b23769af2a9247fd900f5a46ecf5819419f44c188159c672a7080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53cdf71c0d3a465c5242d6ac8db4498e

SHA1
4d26e9e7c58659c2f0cb346841de3f59ee16760d

SHA256
8fc0e4159a7d24e862371137887bfa9e239648a9aeca4dfa49240a4d6580bdd6

SHA512
a240a79b260735eaf886da39b649dc17e0df88da36e1af8100abcb2be3d67c79dbcf22161a7bfc03e88e89e6060a9a5107a6253f52fd07ff67cd39f1ec0d6e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc4d7a90b1754103c9c4c9134b287ec5

SHA1
67e7d43dd42fd60e64f89a4b11afc2918c3c106c

SHA256
f64c076080896623c8ddabaa51220d97108a895b6bd4fc2064af006094bf27fa

SHA512
aada7d72d06727424b5562d7b1d7b17bfb03b3c48dd69543745fd80f96b00b38a5a6712fbf8132040fa778aa6d2a397e0ac2b017415d488a5fc9c20b2a2cbe40

Download Submit