c252fa94dc6290cd9d4c3aff095688eb703f59dcf0cff3899d3ddf84736149ba

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28013b1ecf2ef59d3be2652dc9350ec8_JaffaCakes118.html
Size

159KB
MD5

28013b1ecf2ef59d3be2652dc9350ec8
SHA1

ffe774ec059189944e4197b8fcef9f37942226ce
SHA256

c252fa94dc6290cd9d4c3aff095688eb703f59dcf0cff3899d3ddf84736149ba
SHA512

d594ca24ad845556eeb0f587c04d3ce98b29f23cae57c79ad9b13efc78dea6617cfa4cd86be72f0a9ce09fae054ae4bd8e3ff95b4252e24789af6f7c539a9e08
SSDEEP

3072:YmjEijZeqLTEijZeqLROrQyNAPDR6ZkmTZ873vJ/J670UJPN5TKHt+HNcRyRls5v:zEijZeqLTEijZeqLwrCWIr3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1256	msedge.exe
1256	msedge.exe
5116	identity_helper.exe
5116	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 3736	1256	msedge.exe	81
PID 1256 wrote to memory of 3736	1256	msedge.exe	81
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 3956	1256	msedge.exe	82
PID 1256 wrote to memory of 1752	1256	msedge.exe	83
PID 1256 wrote to memory of 1752	1256	msedge.exe	83
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84
PID 1256 wrote to memory of 4696	1256	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\28013b1ecf2ef59d3be2652dc9350ec8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc4c46f8,0x7ff9cc4c4708,0x7ff9cc4c4718
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1360 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2473728374454003051,13485344106523215494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41670de3-bd1e-49c4-aaf5-6985851924a2.tmp

Filesize
7KB

MD5
ad44c40ff1771e88ad0429ca76bf42fb

SHA1
a3e9a6bb74f8c2e74d2b7cb38da1fe0893d6d204

SHA256
cd667f0d9dac0825fb13f02d80548490cf7dd6f6aba5d448feddeca76c795c5c

SHA512
ea35bd93ae8aa570093587a29af72e476d004160e5267fc556eedb070bb919969c20e458a00f672654b3d00ad5c27e78ba22046eced8dd18ca1841a357639dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9a14888932c6f8fcbda3d4ae0c6f8f4f

SHA1
4242574cddd57a4c7333f76a2fda6fd4e6751d6b

SHA256
5de49f9f049a1d2771c1864763bceee1f65aa75e7d3bd11f416825fbfb4a3574

SHA512
f9931a1ccff3cf7646ba06a108ad8070b64afb825a68d89b347f80d3fd180de79ab8dda222ccf13e37a5e94b8ac4b5f8086801af1acc7e431cc68627c9b3a29c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
031a7f30ec6566b5ea8227ac5dda7f78

SHA1
4573cf2dd18b51c892ea3e0e29b9b375a3cc2c44

SHA256
5d87dc5e66daa2fca18ce399675f1b12ef6ded68383ec5fe9421806732d8a2c5

SHA512
3d1cadba23557e3c653215b29f79c0530d8232ec049f915ceeca98ace3776f57ababc4f9f4ff6fa3c7971a5f7d6e670ae659e92bca0cec39e08142167b740105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
04dcad3f345038012ad4001621b97e27

SHA1
60148723320ec6123ea948864bc51735f2fa2a83

SHA256
8adc8f74a916661aca6afac2a9f2b347d65d7d5c3435b953dd4f70d921834e76

SHA512
c3e2bb312b4261a4fadfe3bc1d2b2cfe955d436dab4a0b07aa3a19e9446e6ec2913fd29512676eaa96b2e6397559f22a9fb3b62f7ffb376e637e2b77cfafd973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7379cd03fe16ebd9d75aea548554fb40

SHA1
1e3fcdd951ec964cc3e39bcce4d88d3dca1717bc

SHA256
7731844967659d9c6ed1b05f3010fedc50440ac00a546b5629de86b832677547

SHA512
5581eb9ddd3e17177a40bafa8078057c1ca5f0cfcf5c195dda7db9cd88cb54da60c5b00382a52befa34a9eb0ffe7b487231415887ea1e10ec5c413cb168f9626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb72c98748ddf75df147c8a428baf674

SHA1
844d01f63e5747def20ed3f2efa1684830aa2a5e

SHA256
ed2a5c3dc76ac10edd85da70406d3172ee6d6bf4b0ce03d9a285473fdf962bd0

SHA512
f5a7396a0e526d5fb3374d894c1b9eb1a749c3f662eb2f608ae77dfb2d390c9d3f0c365f9a354c31097c39de36d4403a8b98392049fbcc58876418e8640782dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
53902ce1e3c905ca782fb84e41a0c766

SHA1
8a35aa02b1afde17a63beaccd9b47cff07f6221d

SHA256
1a4e899fdc27fe1c4d014fe89d51722388ac353892ce78a441794e3ee44b9340

SHA512
81b8e9e32a1e6ba0d817e60a0416d27b18c999f1c2fa706d6e809469f0e4d91c5b851b992125b6aa1a506ba3eb39b1822d7052da498a13ecc29e98b9358d7b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29023ea2fe709dead663deb172e948fc

SHA1
df24a25ad832173d6be908b5dc67a860adb7de28

SHA256
9ae7f4f717a2c2b8d24da26a20e48d065e4a9180584e6e3cc188e14392f6995f

SHA512
c7e6feeced2ec6e962f93bbf41b45b1ecba4f8ba2a76871abad2fb127e8c67554fd52d11eaf2ad1b008c93ac43f841593303559d594d2e2ab65ef37f907059f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6ac59f43137f3371edaacf2afca7c23

SHA1
be8ac67b874f0b9fc9d20ec61eca094133bb5e00

SHA256
ff2078183a79480f571a80ffbd29c13947f0bb7c87cb09f2b51ba6118fdf7a6c

SHA512
cae42df3f5c95247b987362b046b16c5f64d9e12fb94564461cba0517cf2ca8b1b5b29874fb1f4773cf8f213db640d6a4fe95fe9cfc4c669b9614f752ca534ce

Download Submit