74463efef72e867a611c0a8e6bf88c13fa7c1dadd9d1e62d8c30f706854e74ad

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b9ffc8855743fd95c809bcf91f66cee_JaffaCakes118.html
Size

219KB
MD5

7b9ffc8855743fd95c809bcf91f66cee
SHA1

77079702eed738d2713f045321722d5e5c8b956e
SHA256

74463efef72e867a611c0a8e6bf88c13fa7c1dadd9d1e62d8c30f706854e74ad
SHA512

c935cca600108517b57bbfda162b22c79cce1fcd14749b89b3893e3170db86a379414126856bda42fb64d80dff0c3291a31f6866305ca11e494b1ded2fde030e
SSDEEP

1536:WuztRWw2ykG/Twm3aY8a1uYqE2fJ6O1T0ome5ZQ5yaeELuKdBY:WuzrxhwmqY31uYqE2fJ6MtkPuKbY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
3480	msedge.exe
3480	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
3472	identity_helper.exe
3472	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2504	3480	msedge.exe	84
PID 3480 wrote to memory of 2504	3480	msedge.exe	84
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 2632	3480	msedge.exe	85
PID 3480 wrote to memory of 4492	3480	msedge.exe	86
PID 3480 wrote to memory of 4492	3480	msedge.exe	86
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87
PID 3480 wrote to memory of 2420	3480	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7b9ffc8855743fd95c809bcf91f66cee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd446646f8,0x7ffd44664708,0x7ffd44664718
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5311669490648569014,12257785398202676691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
c1b9f6f0718064c10b439e7d3148af65

SHA1
a6a0d0b1e39e352419a2ba53e319350a0b3bf09a

SHA256
9fd19ca23aa4f666817c2474020e229920d5a8352247cda0157a4c145cb52692

SHA512
12d74e27078f397f30d340514431b47540ca601c3de85d09d87f324ad2d2180e5c79efaee7bafe5f8807da0674e605707a65353d14020f446293428454e6c98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
508908f296efb90b300bae042a11c071

SHA1
f5253ca84b6ed0d6cfb05877dc1c57e177b5cee5

SHA256
dc7f8915a3c6915a4a81401d70ca6ebb0d38665da9e2c977977bced9ae4dd66e

SHA512
c636b204f1a662757947d3dc13df50227a5ec6dce38fff9dc14efb8b1eb4e64767677385297c4f7318fc3c6059c61cb6551120346fd73e6b5cb5a2d1778675dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3ccf9771f56b3d6bb44783d19ffe0f7f

SHA1
d51f1513824f6eb14a7293081649c0e3fb16a35d

SHA256
2ae65a3eb60c8d25853bce2a1d6451d13a585116f68d9efda79bf16226e29c7e

SHA512
1ee86cf61b28c31168a780aefab7b4650609d7f1f61965cde58395f748ed9f36c0bc0e074d82c2aa10310d3a1cb814b12f6966f3f454ac571583dfc0e2934be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3b15138b421ddf8d4fbe5b60c8a564a5

SHA1
460483cb3cecace432c76162c210c514f6a377cd

SHA256
1a622b10866e456a300b63603abf76e2459cae12f7ab83e3d663147fe879b3dc

SHA512
5c5b106493489800617ed243def44754e2eb6d6dbf2244d51b4e4ccdf3189ee414db3c867d208394441091fada86d7d46c8ee98ca7ab5646c69119969388f938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76875e241bab8651705c2da3c4d08649

SHA1
473888718d4768b5f8fca8062fe79f1a7bfe608c

SHA256
4de2f2cf9d7e587f0cdfbaffb1fbb01834c1f690fc80223edc5a73fb9120da1c

SHA512
89b388959d4b816689170cf93a2f015e167dc5332fc8b99ab8d77aaa8697065b8849ea5d9c0fdbc81e3b52141cba9d88d5384e610c94ddc00d5109684cbc4e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
601a21cf0bcbd91882dff74cfd50a57d

SHA1
b9ea42f1844c6d2ef578dcb4af6baa0c34b77685

SHA256
3fc355ce40a1b38195b56f3f93f67e0c09ab73cf3839fc9090d29f386d68b61f

SHA512
164c480f2d30dde151f8ae5b85a8cb09adc8ab40a5c23f7ebe6437295e51379fc0af2d6840374e26d4d37f7e1ca219d9cf8bc9337f56819f65394dc336c974b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d6c9a3bfc2ae985f2b27ecd133b2d13

SHA1
1db684df055f80ad749609e243a9e6c599218374

SHA256
7c68b35059dde363fa604c5e1c1bef81fc862d25149de60061574da9d1d34300

SHA512
e5d3054bc3b6f4044461972b80571b0588faeb91874ea2dd86e8ce8f141d31066f5a295321923bb669700089505062aa5987cdb260dc22aa073eb8b06964d015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
069c510c63790a311ef0727a3d055480

SHA1
c82d1f0d85652aaca4d70eb63b494235774455f6

SHA256
7af469f2781bd82d38011e7eed1c7420c6c0d7599a2249af6c20f9ef9cc2b5fa

SHA512
dd5e61775aec89025af2a769e59dd93de68db2ebb6692638236dda0176a5bad8cba5fda24cb70290e4b44cfb0a94d58cf07d48e59e894ad5560369791878df68

Download Submit