80568aac69efe8e77f9cabecc52f963cf5ab351771104cbcd282b552ba3614ac

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ec13ae34c4bd16295af8e6ebbae5bb1_JaffaCakes118.html
Size

55KB
MD5

2ec13ae34c4bd16295af8e6ebbae5bb1
SHA1

35720e876cfdc9259ca341fec63e3276982168f0
SHA256

80568aac69efe8e77f9cabecc52f963cf5ab351771104cbcd282b552ba3614ac
SHA512

c0b00b83e1624e6954efba7a524a6a7256fde904567d73094c08f4e0776d20168620d77060f97f4f249d905cbeee39ae1e2f46513a9980d0076da329e43823cc
SSDEEP

768:5QT0EipBfsZ2YYlbPWHOGGBNsbMx+kwWA2rGI+76hQWK229I9l:STupBfU2YYlbP2OGERBNAm66hsQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
868	msedge.exe
868	msedge.exe
3172	identity_helper.exe
3172	identity_helper.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4192	868	msedge.exe	83
PID 868 wrote to memory of 4192	868	msedge.exe	83
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1388	868	msedge.exe	84
PID 868 wrote to memory of 1984	868	msedge.exe	85
PID 868 wrote to memory of 1984	868	msedge.exe	85
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86
PID 868 wrote to memory of 4488	868	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2ec13ae34c4bd16295af8e6ebbae5bb1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6a6b46f8,0x7ffb6a6b4708,0x7ffb6a6b4718
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2374896328306634928,10242149428483534545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
82a5d7d9c8bdb9a3e50961215ae5c7c1

SHA1
d0cf441c7efa59228ad35da575b66cc3cac67da8

SHA256
e7603d86ff8b79d03aa1964a3858ec3a627520e1fe4b51a4918aa5293480934e

SHA512
2b07b753c368c6f370c560d5f07a2d233d306581339a8fee20b18ab641d893c3cb45b0640dfc58bc97cbda84cc1048b92215af4dd4f46331018864b94e19ea3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
bbe3991ae50110ddfe4cbcfa504067f6

SHA1
10fd13d274d275e6cf8558e5d77fe3f1f9c115d9

SHA256
6fdaa7148273679081f14ebb04d2849ee961985a8ed33fcac178b35c835cbeaf

SHA512
45ab519a2ec602cbed235acca19cde3979b3c557127271a3e8a2b70c855f00d71d9ec295dbe5ee2052d1321383aaf648de815e46ac7cdd27230ad9691e30df68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
92a83126e5a22b37cd91ea7ca83eb4e8

SHA1
66769993435f3f4f133614bd47b49c77c2acc87b

SHA256
3e37a69e3cda645fda68e808c4e9ca92d2ba801b9d32b50c60a78c020500aef9

SHA512
5674440ee4879b89ea27c4ecb5c7639922bc28db907464eaff34de6d0a580d9e7b9bcc0469cbca1b7410def73580ce0ff418f33ffe875b8336690ad59b7beeb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5231f0fd658be3df8e9a8fd1e6661b88

SHA1
c93ea086ba7d1ca94d9c862c6549e6232fcaf86d

SHA256
47d37163514bada97364c8d4cc6985fd2acbf630d2af1ef095b391559e5179dd

SHA512
73fe670d48dfc42c0844be492e3169c50eec6d83dda98399704903f1a5581b9c9efd67f41ef74f8806a9de921d8d6001b0f324d40027d4c64c359e31d1073fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6fd4b59b810662181ee4f7e7905b5a3a

SHA1
6b729690e05eb6fb9cce2fcb19324e8a35a3a8fc

SHA256
1148c213f7651a7758e9dcfcdd4057ded2539e7838e32238c150cc87df21054e

SHA512
b72389bf0e3502b45ad967ffba16887a9ea46f5d29bec2d4532cea71caed6538b60439c3b34068247d4e2cbf79900b12c7b0074f0f2dd23c5404d793e4ef5f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1667ec6ad210fe728d83d5f7d6ad40eb

SHA1
2b1ab4cf00dbd1ecb224921004b011f1bf39f122

SHA256
886f23fd7f3e2402b7ddb66914467eb77747c5b50cdb99181b3785ca63830d59

SHA512
dd1dd1ada2fe00a82234e3dec33bc19902fc741c180522c642f9fc0f6f34bac4c9ff1557a3d63f5ebb4c67d81fcd77bdd9e3ebb6abb8aaed0c5f44071a8c122e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
932227d9fae04f581d3db5f2badabbca

SHA1
dd5a7c30802efd2c20f7eaac8eb71baee17053f1

SHA256
59bdfe587b8c92a69e6890bc3494e381a5b2e8888406957c32217ed9ad8be7ab

SHA512
8dde90df4ef54437b561d5d47378636bb7bb4e7603e85cfeca2fbe09ef797651081547e444d522eb63e42a86b27384a57aadcc565f10ad8a0b3cca0dd4c10739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc683766d56bc594c996aa3ccb930cd0

SHA1
ad7abc992a1a2c06896af36b84541a4e403d09d1

SHA256
23a0a27e7cc6c8a1888b3b378cae0ddb9d5eb827b2d06b31d7d1b2dcad5d5efd

SHA512
acf359fd61885285201ac5126ea0ddd5705ae62df2a40468b81dcdc037194e988a93a8d82493fd4731a17ee123120a243275935c6e8b761c4bd95b029b585339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bae2a283e6b62b119c5551f361cb4790

SHA1
6e0692c8cb18fd09436cbfc3e80892fdb9bf4876

SHA256
509d7fabfb06aedc6ffc224521d1df7a84e12caab7dacf63776b240e7b3989e9

SHA512
4037b214b02fe8af0d56565b252e107f7f7163228a0c7d36f52480eab46981325ee20cf99e156541f5b7cece17d53235c0431fd0ec63b8f54ef63d4ae3bb7f64

Download Submit