b40f1e3ddcda1f93adf42d5e6e0efb342fc7ce23dacda74839d6477927514122

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d54899d5c007dd0fa47d74f067db514_JaffaCakes118.html
Size

175KB
MD5

5d54899d5c007dd0fa47d74f067db514
SHA1

b1435b17ed6b9d4889c503a973bb10c86cf3973e
SHA256

b40f1e3ddcda1f93adf42d5e6e0efb342fc7ce23dacda74839d6477927514122
SHA512

7cadc71d8fcf563dc61d1c63b2aab2ee1bfe537b7a70c09bbfdb090828467f71a3194a3ea9f22b5e87a5955eb77d73e90e4d100a22a6b1a506c73d2350710829
SSDEEP

1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS3RGNkFDYfBCJisy+aeTH+WK/Lf1/hmnVSV:SBoT3R/FaBCJiIm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4984	msedge.exe
4984	msedge.exe
3524	identity_helper.exe
3524	identity_helper.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3924	4984	msedge.exe	83
PID 4984 wrote to memory of 3924	4984	msedge.exe	83
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 3940	4984	msedge.exe	84
PID 4984 wrote to memory of 4416	4984	msedge.exe	85
PID 4984 wrote to memory of 4416	4984	msedge.exe	85
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86
PID 4984 wrote to memory of 3808	4984	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d54899d5c007dd0fa47d74f067db514_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba4718
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6951179612994047399,1534635578830433505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7dfc17a5-bf99-4da2-94aa-74d9508d19d3.tmp

Filesize
7KB

MD5
0c33252c606d26f673135e1520d77cbc

SHA1
05038aa0f33589902cf9b6c29b018beb51ece8a6

SHA256
de4caa0b1e4753b29c051aaa156d01970c9c775bb672d495fabc64c8d51b8571

SHA512
aad1fcf232aeb4d5cebc03ca065220d588e2b87e15dba1beb421cc4b9b203c0dfa9f509d6ed006e3e05149525a7852123a4337914d949ae8319b338712fff62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
46KB

MD5
f0d81b309d4441d6dc22bdcb9e9e7d01

SHA1
77e7510fd01735991f8eb242a8a20acf5c7326d6

SHA256
90b890766ed0dfc173b119f625e4bde7785d509a76d27354148bf0a80a09889c

SHA512
79d3758017eb11ff478e0c258405aeb66eeef77b6041689708667948c85c1ff27688491eb8fd7efba3e5d392e299c055b3ae54fd212a0f5caaca3d91c425829e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
19KB

MD5
aaace359b85b7b4a2c7327dfb7beaa97

SHA1
582d8a59ced081f5fcda3e35721f8a3464927a74

SHA256
ed67895dc54bd5d6b94b889380288aa1bd1efbe14dd06ce4fa63794002994ee1

SHA512
68b908c77fb16a195cccfe531060ff7d5e0fa97bdb58ac860ea5d8c0f04e49ab3bf906839a971c4208360688153c9362e81054124f88d2dffb4101a065de1f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
e3c5e5f9f0c4b98c2f4ecb41738ab2ee

SHA1
3138830b51b3a9f94cbf9ac1c29dc215bf1d49ea

SHA256
762e198ba7861303afcf973252495b7de094ae9e51cbfb643eba0d5aa9ca8c31

SHA512
e3dd343848c6663a754c3d840cdddc28fadd01991e3fddf0e5198f7dbf8f85c5b702fda456b38d2eb5202377270f795e40e4499d7e1dc71d1461cae7708b97dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
90a12406e80b7a00bcd71ba933f3320b

SHA1
035b7394c98494b48a2a3d22be7648b0ad3b79cd

SHA256
b17540f2ea3c5d9fabf88c7bb9add8167f84b4614a041c4d5f32c8a38beb73c7

SHA512
67f907095fd07021288c2f68a31b01bd9db7b00cacf8ae2ebfae4236fd0d81ca180e6a59997fc5d3f8adc1c382c3dcea67082e807f393e3bf62142f01e26df68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3647cfe13d7cbfc2f75b669d374ba6e1

SHA1
8a648dcba0a562c1e22ae4b078aba8fe3da0c383

SHA256
efa045d87e1d1158a9ddf4f312e9d2854e5f3794f7e69cf3e60d5070cd8d728c

SHA512
260a45b8fbfc0db6464592262a6342a0c519bbb96de9e2ee45a5e4aabd729c5fa7f3271e32496b520181d1eef0ebaf2cdda0d984c6563c1a45b0b059319344ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
336fd858e262bcdbc3aee1bc4d8e3a61

SHA1
0be9605fc41edb2ebffaf33462bf4ebc5818282e

SHA256
00e31705894c2f1db4a9fe1a4c3554ea1dd24f53eed0835f3b23888abc940d85

SHA512
cfd4fa7015b6d2c8c9bc7d223b968f6f2dac4587688c5cb1f550b0fab6ad000f49452ea48b75ae63e14e21b747b7b5131f906da619fe2dc6af2fa42c406e5862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
231c3b3a80eb3a61af6cc2abdea97f77

SHA1
7093727b5752937d80783e293baf5ebe1abd929b

SHA256
d64153aa1751c3d269d01208e658055015d1a3e143666894e891d81be8b51429

SHA512
80416a96a6131224b36cd825da02a6fef3eb60be76e00da913dfe28c1421da1b9ed4d033e28d4277063b253ebb6e858bd0510eba6980eaef97b0afc9683ef56f

Download Submit