7252a3a9bbe114cdfe549abe2a39ce08a3a45b4ce0696f91afeb16a4f01076c2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab3acae3431588e05d8168004e5e95b7_JaffaCakes118.html
Size

227KB
MD5

ab3acae3431588e05d8168004e5e95b7
SHA1

e6b1f9f1483996bb1e86e927c8420767052bc2ee
SHA256

7252a3a9bbe114cdfe549abe2a39ce08a3a45b4ce0696f91afeb16a4f01076c2
SHA512

e4cd65d099a86af9cbc75fda594031ae854800263fee5b56662afed30574df2a80f20c1041aeae9c6c7aaae3bd96169aad48993ba48f241e068651f98c3bc4f6
SSDEEP

6144:irXmNR0hvKt3fr1vFpnW0yImB66aPDZ1MmP3mjso:wXmNiQXFRj44o

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
2068	msedge.exe
2068	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3312	2068	msedge.exe	82
PID 2068 wrote to memory of 3312	2068	msedge.exe	82
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 1420	2068	msedge.exe	83
PID 2068 wrote to memory of 4168	2068	msedge.exe	84
PID 2068 wrote to memory of 4168	2068	msedge.exe	84
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85
PID 2068 wrote to memory of 3780	2068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ab3acae3431588e05d8168004e5e95b7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91b646f8,0x7ffb91b64708,0x7ffb91b64718
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,15117781208540022700,16152031562284147180,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
abc48fd7cd6c006eb9f9c5719748c9ec

SHA1
1bfee875209e5a39e65213bd25322becf223d1c3

SHA256
862e5db88bc456d003eeb9ecef6021b12a7313427596ba87eb4771020c658f93

SHA512
62d9cd90cef344841d5f5acde94583c36d8541bfb6a61e72b6152d2054770ca3e056d702dc01fe7889a136972a12ce92057d84b9e9082903504cce730ef64594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
33212b6459c6eb57f405c11027aac928

SHA1
072b246643b31ca2c02525403097441c15c7d1da

SHA256
0f961b3bb2a42b48a76d456bcfdf79139e6cde73ea827e6fe695364f800871a8

SHA512
f6e150f6aa59038862ed653a70732805de856a7546af2b7955958b9df821014929c8c578ee1ace209873b40c82eef16c2593047ccfabbfe0761420219bc79632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
cb196f6ecf7062257fa562db9588d64f

SHA1
6e0324e4fab80d7d120f413eb95fab2df9963201

SHA256
d3ef3e10994dba637c78e50a52f84a811bf76bf66908ce5a5048b175a5a4694b

SHA512
95e89bb6011b579779f911e58198c9876ba7d399a1355619274fc07b2e4e45619609b7a2801fdce6b424bd5a63f871195f0712cdd196eb0c51e2851a55e22402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1eef4d19892801d7907dbd2872cb01e5

SHA1
1c870013d369d79f2d13313a5b9950b2015c44a6

SHA256
2f04a0a46af6c4b067e8d45f78e54792c1c82b64f83147529b2200442ece1699

SHA512
fd24cc7105ffa2b785b7116802cf06f00bbff37129ef77a599971787a4eaa8abfea05d054abd49b48bb074a68319d93a337e420c08eef20b8e062c4db7b6d79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4bcc5124dc5832375aec30ca42de7e60

SHA1
4025935dcef28d065672210d695490c5ff972505

SHA256
3e136352c1d995ed4628a4f07c5b20a07a6781fda67c5234ce274e9f3d74de00

SHA512
438c609b7e83947685e3581c14b7e469445d0c1e76529a677645a00845179f2e3a8d9214f36d3e9529da73383eb2e4fde003e65e6997217e7b30c6990756ce18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9894f24ad35b149349c78526f254fb0c

SHA1
29dd19dcf99ee3d54967188c655a46bb00273826

SHA256
212c75bfe36faf70e32a3d70676e3422983c0cccc74674ef38eea432b40b19a9

SHA512
72fc22b5310810f75d5a746de4e8b5b2ef936f36a388350369e897064d0c1b14cd5bf2ba1af15779819c0f0a95d3d8959006708abeb62d5f29ffd7eb0c0bd3d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d2ca62bc1aa4de17565233b461e531da

SHA1
842df1c51effdff8250a9995c4d23966292e2a61

SHA256
85714ebb7355901131f7e59fa08edc3ab4ea44d6ccbd5a2b4e5f1d19adf4044f

SHA512
80c2e658ac3bcf0f44145e106e73ab03966c9acbe8c814e3aaa2dcdde583c91aed20a145ca782362bd20e095da4313a109dba5b4bd91fba82b6bebcf34e6f745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2724b9ea63670cb57091725dfe8e8559

SHA1
d074aa86c3944847aa4f80f1a663b69f01822e9f

SHA256
acf01bb1b7e9290a78f830e622f54e4dbf9deb55f3bdbcedf9f061028927376c

SHA512
49356ff04d5c1d0258f601f5816d4adefc87d8fd6613eee4606e9c23caa50e3cfe66bcff7536ab56c0d076d3e02f9ce16cc8c8511da408e8a74c51e0b3758230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4708d99b5e910142f311fe7fb0d7ff9d

SHA1
41c9d3a64e1cd83c5cde0f740d2e9823ea0e6770

SHA256
12d08d0d547268efdeec4c34405537f62186fcdad03e913ba3000d6d0d45ab31

SHA512
50698677515085bfd2ddecec2453f072f3f89466d104213489da6928a628ef9d234e22ee7adfec9c389060355c19e7b74c1ec4cbaf1e4e4d0de2d99b96c9ea18

Download Submit