830544746c675e5e20ed14d746e73544960cc7b929142ad6cfc42f57e5886156

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a331916d3b80a115b0747ac6cb987685_JaffaCakes118.html
Size

86KB
MD5

a331916d3b80a115b0747ac6cb987685
SHA1

4e21eba1407eaae2531807aa77a06294cf1e4b60
SHA256

830544746c675e5e20ed14d746e73544960cc7b929142ad6cfc42f57e5886156
SHA512

ecb22d7562675a4ed20dfdfffd03bc81d6ba6df127936d2f8e71bda51bcbc2021679d180d1af0abf1e9ba26c507d1f13751d5dd655b17cab15679f84d96a9959
SSDEEP

768:O4LXigroa1DTC257T4BegKeO/29Dm4xP0AuX+ic2xkONqBC314kd1wHqusVjRPd:O4uWR1DTCa4BeDeO/K1W314knwpsb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
2704	msedge.exe
2704	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2804	2704	msedge.exe	85
PID 2704 wrote to memory of 2804	2704	msedge.exe	85
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 2760	2704	msedge.exe	86
PID 2704 wrote to memory of 4920	2704	msedge.exe	87
PID 2704 wrote to memory of 4920	2704	msedge.exe	87
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88
PID 2704 wrote to memory of 3324	2704	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a331916d3b80a115b0747ac6cb987685_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf3dc46f8,0x7ffaf3dc4708,0x7ffaf3dc4718
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7294187763391692602,13799280968530128770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a351a07-80cc-4d07-83ef-88cdbde241b5.tmp

Filesize
6KB

MD5
050207c82265157920dd576c38d48fad

SHA1
ed79f194c4e470481c144c5add8d0c520fd9b80f

SHA256
e47a1880c712af24925a2135e152e61097f432a898aa742fda5b370d0faf3393

SHA512
370ae83bab0a0d6927051d77be4f73ff055cad300e3a440ef6037629beaab3f55bde11bc50c7a61aef977373d76870dc604a140fc9981f46935c66c0bdee2b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d5bb35b8cf5bc6dc054321e0b6699475

SHA1
c9fd591c2c5baa8f0aa18dc2ae2a4a23b9606545

SHA256
2738d1cd912246d906dbfba1ea52ea2cbd0a9eca668a3dfebeaccc1d7e51b11c

SHA512
1e0e453ef90e2b95d74c091272176562a319906de514207b39c00e6fbe0c32119cc52dafc601c1a52958e960f042e1790a610de9c7a169171bbd97b650e7c43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
40b231c8198c47876ccb9a12af7f4c94

SHA1
0a77af03c3c41d43d70173574be8d1e4d56c762d

SHA256
1e1d6dfc3f3263a6f37249d182cf01da8311bab99d493483d064a3483069e540

SHA512
75c9d93fb526b225f285fb4abf85de8cf15871c266a72bef2356e81c680b106144b65d8f33910b194a277463723c7ac9c62d45d865e84f510ba9ccbf3449ab76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
435bcd40c6cad56cfa233de9f3549c52

SHA1
74cc03b8bc2d108afe34cb33d097bfa7d2c53c4a

SHA256
8cf2b677b29ab773a777c6cb2692d3dc706f75a05b3e713d4782c9f2f448697f

SHA512
9de842baf3bf6b26c89dc51f5939b767909047f4b2c4e743952fae07389842ff7aaaeab02407e89f0d9dd4b188a1175fa0ed509a7be819fa67682a62ab67540c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ea0ae577f7ff98b62e7a424fdb93c3f6

SHA1
1bb86100a97b7884807f3fcb80270b55208cab71

SHA256
89ca75c8d9a4ff1314b44ce2256bc60c82904a8d975c5fb930eecef6226d1f89

SHA512
3310ba5fd9e25116a80a4bf500e2f2b3adb1e7807e32bd1bff0dc299f445bd44ca5f2ab9c32f9b38821de07a819983516f22a546773a99b62a46a81e0d4994a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
12b5de3204add13d98cfcfd11917f192

SHA1
0a5de8fc2d6d1699d23ab8074bee67c4d5b15c12

SHA256
0b2ba5bdea0af5208f80f4a0b0a81d46e694711dc647e5a32ed24a0600b55db5

SHA512
34c4eb3a9ba2c48a575c1d54b7f10c4e344271a463001effba17865025462c436514e4eabfaab14a6dd11bd80412696af2f7abf1506cf5f014e46ecda1d5f2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bbaaeef5891edf19dde89e53ad6fb023

SHA1
db89ac5bcfd93283815a70363c2fd0f6e0c04998

SHA256
a9c91756812e5b8b572caf6896fde8a51b23aafba0233d56407f852061b364d7

SHA512
8be37bc9c583016f01ecee78faaf79696eed0028153284ac90fb4a7bc9ca51702503bfe9b7bd385a02662605fa1e6034d76a6ba3a186b52b9286eef5f0c028ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c17eb08dab20df9aed4fceac70553ddf

SHA1
e1c7d006d71555aadf5d5976421d3778835e818f

SHA256
8afb6507fa36bdbc6bc24c9eb2a552d252f711339bbc5be7cc90cd4d2645738c

SHA512
99975a2f50e01358101f79c49292887f5bfc262b51b007b6b83bd495477ca1390855def502d409e2163021a851b7e1f4542c545b5c3672ae62a8772e0ff2b573

Download Submit