563abf353c7a6930e80202449cec80824ed8fcaf6fc9c1071e8302c6ac0fa70f

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0758470c6ba60a6919db560cd2978e2_JaffaCakes118.html
Size

83KB
MD5

b0758470c6ba60a6919db560cd2978e2
SHA1

f4507a4ea1a265157b648a3a1b111e7d5073dcb9
SHA256

563abf353c7a6930e80202449cec80824ed8fcaf6fc9c1071e8302c6ac0fa70f
SHA512

298394cfadd59b563a6a78cab09ae5247029c25a4ac13d550873a8baf9217dac8695ff4dade760b4db740b28190f7142b8253ace17f118255125ef43b967dc06
SSDEEP

1536:L4zWR1rbC2eo8IhITIhI5IhIxHOg0t1V4kv36cwuLRzL4:L4EXC6g0/V4kv36cwuLRzM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
3532	msedge.exe
3532	msedge.exe
1924	identity_helper.exe
1924	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 720	3532	msedge.exe	87
PID 3532 wrote to memory of 720	3532	msedge.exe	87
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 8	3532	msedge.exe	89
PID 3532 wrote to memory of 1400	3532	msedge.exe	90
PID 3532 wrote to memory of 1400	3532	msedge.exe	90
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91
PID 3532 wrote to memory of 4112	3532	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b0758470c6ba60a6919db560cd2978e2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba59746f8,0x7ffba5974708,0x7ffba5974718
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13730415348527737208,13700119381976893249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d9e0303fb7875e3d8e852e9def4e7cfc

SHA1
24db089ec79428068d83a5228fd27df7d2555e68

SHA256
e463f1a12e51657b328ccc9c413fa4d6c8cdca18d5ef0c695908bb326497ae3e

SHA512
2e7246592b1e2bfb41702ceb64ad9b54da3f0b5eb27f1de280e035b353a8c09a0bdd84e44458e098b97420c79dee1a7b64e937f1b427017a101f4a975d610e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
07d9a1d529783b0618f12b9f5aa79bbd

SHA1
52d6682e14c8428c830d7f4eb4858e167b43b66e

SHA256
164f2010096d8f9cd3b5075c3e415ca421184ee816db084995bc84c97ac21043

SHA512
46e772c1dbfa8d909482110cb6d87eb0ea611a34f7c6ce3434a58ffc0eb3d96e1c1e72ae1fe5d013ae3a094ce24dedae48b2b3e9c930006dca94caa5d0bfc256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d503d0dc6f16af13dc4545cc357f5dbb

SHA1
7159e2b62654d0de20b1bef88bd92f2cd17cc478

SHA256
2b6190ecfa7bb8ad11462c7ecdb669f90273d3479b5c6d219781518527047fd3

SHA512
1608d036fd37be4b70ebf18ea62d551010e4d16ce1bbe84d58a16508bf6b40528a33659598ccd7f3cd3b6713908923b84d99001b2467a7e78afa40f72baf9f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ba1c2a5ffae66319dc89c95308d15885

SHA1
a941b66437a96205ec493c8b25cc5f59a6955fa2

SHA256
1d538614274f4d7c7f6f6bab6767b68c8c2450198a6c7af76ed1820bba71e304

SHA512
08852e603ef7d43309b0982b87c53fbaba45213bba24ca8458b294634c828ca88523dc2cefd6190ec1315e273e757e1480caceacb971da856a054bad0aea22e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ef3b91a35d1956827fef87d5e700907e

SHA1
93059e39a6c52e2078b9feeeb8a2c9474bd24e10

SHA256
e538661e8b0e874389dc2b7633f52e46eab2c5fe14b8d37be6535d310ef6dd0e

SHA512
aac58a5ef2299bd8dc1120889f9a30d8710e3acdac796b6a2743530eabd72523e9a3f0456255aada6061bc1769407ed592eb6419656cf7b4f896ec19ee8722bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
afd754f5302b96a5bdef9a1fb6ee3aed

SHA1
9ca830ccaf722c5bb2d4e73a2698f268c30c44a8

SHA256
891ac446ca6e368dfdf8afd37f29fdf2e9f75c4f9c7aaf91936da815bd3c6118

SHA512
762fa001cac1c276f031d0d8f0fd11426e0d36ae6aaa4ddc62b5e93851bb940231cf371b97bf833463a4932c35ba9f54e4a177a906c2dd0fc2136cf963b070c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6be9deb2d69a54e56069329f03c42545

SHA1
40eb3c61e1a9269f618ce6a40ba3d773053bf862

SHA256
626831f01a73134fb1298c9dc4667b0b98ae85b9edb8a33e18b8e895a01b3381

SHA512
6891a0309bc4bd3979458a68a2c3935c377f77dadfa94efae152b1971bf70976ed30f3ea0a120db6985b9465f3dc5ff5a3dcfd212bcd2237513497eba029e604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bbedde7930a3c89a3e740eb707e1d0d5

SHA1
561a416e2ffd653bd9797030d570bc45b6ff07c7

SHA256
01bcada313d075652c9db7d63d3af636acba2abfc1525910bf7e7252e5ded9bc

SHA512
3f41a9c38f92eedd157cf237d6fe741b7c6b2bf03e7c7f31c896c07e4f379bf32a02d8f829fff371beaf6e014740b2215dd6fb86840aa882337d6eaa1ebadb89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4b599fb5545dce28a0f1715078e2f19

SHA1
c4f44fb64ab6f0dbc11ede21ffa8742cca6b93c7

SHA256
509cfb83c60bd700bd6ab6644803fd3be109858e70e61bf167361d0f9e75ed93

SHA512
2f746a41613e68738c1a75dd0802e2e528353570ec37697d3023e9704c50be8b2697ba22213696441fe4f11eeec1d3bcfa6a30b75e1229c88d3e5f8d4b3c51ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
02c722104d518b519917ea2e4d0883f1

SHA1
0ce1fd4ed3e462092318be4011cd566d43c967fb

SHA256
46025424acd5d824ee9d86116ba96a304c579f7628f2dca7f615c9016ec365f1

SHA512
5aedd2628c2db7e0160fe130c0ca4d2fdc16f0a1f8598791d0da7b7b6904cead199234e7a784aab687220f82dba6436b1477b0b4517726ef99c96e1a4f67b15a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585e09.TMP

Filesize
371B

MD5
8396010c737f20b3374ae3557b9c7e9b

SHA1
68be3c806d8a21c3f3532d79ef1ae9df2b6c89fa

SHA256
d575ccd1363ece223e6352d6314fbf7415e7b7503fb6f9045b85fe8106361e63

SHA512
64333b28d7c9b1384780af5c5cbbde6e6281d68e278c82cd93f346d9f436d02312f354e285431b39427c1b3c9feb251d64b4da06b32ccc579fc21ced0115e463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c6ffe0e8a39c6cd9f162d2302f6d9e4

SHA1
bb859b7bdbc2ea25a4671c95242ad3811868b571

SHA256
93bae35f2a33c929fb01b62acee6aecc86dacc6f8371d90073e41d9ececf37b5

SHA512
76150c89f40af8af708c35aa0be6442d0878fa8d58f3f11da56b4db6637a63429c2ef392e7c4c2a32b81ac4d599b98472d39ebd171d4696d068b189485ee56f4

Download Submit