9ad4bfff1d6672994eac24037378c72112bff8b5ea9603a1b9eca507e6837da1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aec63641a5bac42861e21b5d5d51e04_JaffaCakes118.html
Size

93KB
MD5

3aec63641a5bac42861e21b5d5d51e04
SHA1

a90d6d54af3a19cd15d683d0b195bc41843e33eb
SHA256

9ad4bfff1d6672994eac24037378c72112bff8b5ea9603a1b9eca507e6837da1
SHA512

05eb229b2ee3d9f45412dff0e78f235cc060e0897608adf5d487b0ad70e58c535541be20ec373702f7793ee1bc08864895aea11e3b21ffca4cd2a9278bb67925
SSDEEP

1536:Jspop7BCIzQR8pKOhyUtCjyjKSG0cXod9hT19od9hUPMcj2amGkN:Jspgw8pKOhyUtCjyjAod9hT19od9hUPg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4164	msedge.exe
4164	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3812	4164	msedge.exe	83
PID 4164 wrote to memory of 3812	4164	msedge.exe	83
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4316	4164	msedge.exe	84
PID 4164 wrote to memory of 4652	4164	msedge.exe	85
PID 4164 wrote to memory of 4652	4164	msedge.exe	85
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86
PID 4164 wrote to memory of 2984	4164	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3aec63641a5bac42861e21b5d5d51e04_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92e0746f8,0x7ff92e074708,0x7ff92e074718
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2284434168906193716,7275029081842240651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
03803fc1c5d6d22744694891d1ce51ca

SHA1
c7dc7890d0d3d8846cfdd55d5aff97d99cc7e45f

SHA256
d943cbb9de2005f8bea571de819f6862747b8d3e7ca92d5c9b0540e403845087

SHA512
c23383b55eb1f9891e0f6b37aed8b6ca6b3e07597a69e1174cd97992b85ccf2fd7a8d10a337d2532de36760bab009173ced2a836247e2669609ed42376a589dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
195a67ac767633bcbcff3991a86e3fd5

SHA1
59b689cdd9dce9a1646ca77ba023219b94126a91

SHA256
09e921d5f68ac6766c08d2362ca2705189e3c6f23633522de7f73034e877958b

SHA512
fc8c4b4d2aa87afca4bb32f66574a1d9b7b0ba0d213be64d55d5e3e2e10b963c4f537514af4abb2ec8b2de31e70f71db7e8752103a1dfa421a866b0e802c98b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1d7637fd44b9541053ebdbe065ab361a

SHA1
49126c450c0fa4e70d8d0e9653560ecdcffad320

SHA256
42d2b1ea20863a671f4a12c57a57f37893e5f054ebec5ea514c9334d3c363e34

SHA512
d366ec21c5cf2369ae8ccef1800ec52a1635aea80a7387cbcb51d567d865363163e47d65ce5eb289d73b5d06db73bccbc0b125133e51c3bbd98a8654db69b300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52ac4c24e6b723a4f0ce5482010817c9

SHA1
be25d2caff3c11e358247ef09414a968fbdfddc8

SHA256
dfdea52695fe7c07592aa67d9e21843ce2e7b2cb4338557e85ff832b59e0ed93

SHA512
0eced794f305f63e65d7cb57e48c5c60a237d4c4da50ed498fc824dd20f866fe5c8105f507720e6fe5c4962285c69a3f577bec713c6a014864e310b42aa03805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1d0d2425b9c42963c625f5b0bced2f69

SHA1
440cde20e416d445f10ef9b9f0d0e82139be2ef2

SHA256
ab11fa6fba42a60c62c3ddf24e75ff2376db2ff0ff6483c064aa4e55bd3bccc8

SHA512
b5cf4bbcc9a5ac18c12f3492779cd34fc8bf48956148368d348986d1e06c448b12b978e2164f2a1793053e112be3bdec059d7cbcbf876095e4e0a3be0a176a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76fafd8385535571253780552bd1efca

SHA1
fb52c127e38d7cd0f88a4a245f0dc14d330e2f9b

SHA256
b3201fa99431c20068af85ea3cf71d2e3d2ff8c949e820825d52f784e49e4293

SHA512
bcc9913c6131fdc73d0a567e2f8004700f8414d83cac9b6b3da00fa2db942bb8e6d65e1bdd6b78a3e4e80fb5f98bd042faef34d5e06c26ac7b09d73309c38770

Download Submit