99807898bf646f3f503b6da7cf8ec29e24853eaa5ea02a0c4463aa7459ab8c40

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b3b02a61892fc56f6890384d1768fcaa_JaffaCakes118.html
Size

503KB
MD5

b3b02a61892fc56f6890384d1768fcaa
SHA1

b3977c065efbf3a5b7576905e75e863ac7024990
SHA256

99807898bf646f3f503b6da7cf8ec29e24853eaa5ea02a0c4463aa7459ab8c40
SHA512

ffb7d8d334bfb01917c6a5441300f5e9d16803aa027ddb284e43b05da5a028243e42137ef41407d8f5a7cd43b8f11d8c4f400781a89d2661fa4468a28fb27d3a
SSDEEP

6144:V/lWAcBVh933VkS8/5xyP2UtHyUtCufq5o7+ruwA5j7DY9jCmcYDBUr3tvK4o9I:V8AcBVk5keELio7VGmmdUrJK4p

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
2564	msedge.exe
2564	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4112	2564	msedge.exe	86
PID 2564 wrote to memory of 4112	2564	msedge.exe	86
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 2068	2564	msedge.exe	87
PID 2564 wrote to memory of 4472	2564	msedge.exe	88
PID 2564 wrote to memory of 4472	2564	msedge.exe	88
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89
PID 2564 wrote to memory of 4416	2564	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b3b02a61892fc56f6890384d1768fcaa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe66c646f8,0x7ffe66c64708,0x7ffe66c64718
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2379310035083834242,16634012926366724867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
cc42375fbcfa094bafbdfca770e5ce8d

SHA1
3000298c50b6e8ce54704b8bf30e9e93e32b97b0

SHA256
e2bd5e3c04d43acceada18ced11930da8028d0a7fa28ede691e8cc357d8393ab

SHA512
06724fd91ad7690196662985f45d738f66819d769925b0092fa16c7f12353d4e45bf72d31e8b2a6a29ff359cf56a0d11b56d601bffc3569eb4338bd141117fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0172761a22f9609befd27b0c8ab45383

SHA1
0a1524af3a070599d02968ed8720b34af026c35e

SHA256
1ca07f89857e369febd95cadc0ffdfedfb999f48a0bf73080b754d4b13904267

SHA512
e66d0d6a21cb2fa2612ccb1e502e2b6b6bd5bbb543707d836ace2848bcef2425a109f5b6df429baa8eae89002d2fe86a35974072ad9e545a128a540c336e99d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
a1345070bf7421554a7cfa5e9b4a408c

SHA1
121c6cfb94d5c48365d014597ccf7483054e4ee7

SHA256
bcb9f2e4b8d759293e923b526f53468928c3311abd1ef6d071f9226ef75f631a

SHA512
521b7935cd054dde5828675e8b905727d394a80424a9c150a32d4ec0e1925bb375c52daf9f066c45510b69869cbb91b0d872e6078a79b22605a0e9cf9ef3ba0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bc7e3fa8ee20778d04db9065724fb36c

SHA1
2e69e76e62e48ffe326b6a3c6af8147d73970f1f

SHA256
70c1eaf94f70cc5d3efae1830f76313d67ba46a5ccab5e8ffac415ca81c62b9f

SHA512
e54687a81e5ca045ec12c8bdf21436e8bffa0799b5c653a858c8adae7a3388e5c5cf97a597d724ab395b24cdf1dbcd7b7675216b11fa2697afec6fb25b152dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84427d92bfd92657072c12e319e727dd

SHA1
9fb78d151f7f556e66df66bfdce022c9eff3476a

SHA256
bae12e2023cdb9e57e82d4ae87b307cb0217dae2d27658270449ca3fc6ffa208

SHA512
b7e790a666ae1413fbc158d96145a3100a82843b6582bedb4197ec58f6c028bdb027694a9e6a668a2dc2b3877fd6f77e932683ae10253cbc9e018a95dd520d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d20eb82507d7155a71e8ee774d8231a

SHA1
2eff3a93fd2689db5200483460ed78ad3f11de7b

SHA256
6c2c37e50aec9aecc1ecee30f75b4e4d6b036c3188b1d82c9abdef8257dd823a

SHA512
7dbdbf81573fead0e9c80d772ca66274e0f0380c3375c136dc9b72e0adb417d98e200493ea63e9758e2a42e7297f19a269549ebff49e99bd3f784b6d51754836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca9987f7e956c70ce961c1818c7c6ccb

SHA1
9bda4fe025c943c1c9ad7fff2c9ff3477e70cb99

SHA256
93451b4441fd8d304600f2b1c7810d4e062f7e28bd9dab3a1a2ac3e26f281662

SHA512
58a1164e277fca8de8f819ee544e132ea42b1a7954f57acdf5991e7f53003c399c94b2d41ec3a612a679d9b122be6df8d438ab5ea66119ea38094d42a20f3d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4bc10ab9cf07c9db4bbe1c87135a62c8

SHA1
1702de6181269735d364e8e99a1d187b0facbf28

SHA256
8f17bed5fea684c85eb8f921a41aaeabc5ae9f4f3fce5beddac388fc5706fe60

SHA512
3664147ce20c5166ad2af0ce053365666043dc8a3c4775d6de7eec5a1a509632dad8571064f1b96efb1ae1aecbdb66371f268686d48a389c38d1a0f1cd96de48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42946539915b8c3d5fbfa32515f32eb3

SHA1
e1d075250bf2b075cea0865099858a696b0c5f53

SHA256
5d4d71cf9568126bfbb55dab57d38a36be0f7e1d5865b2faa7198b21b0bf7b3e

SHA512
b2e58e4985ceda6ccbbf288e0daa46d849f41892dd47a1d898ca66d62c15b44b33f8aec544e5d0da2acd8bb429be296f5157716952487d4cece548403c83b6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
08415f2bb1cb1c5dba75c591ce314773

SHA1
66f85ac292dd5086202a3e7b28209daf93dd7ebc

SHA256
1040c2af1dae5743151ecf64ff94ada992cef5fe1ea06c38bb7bea735491d773

SHA512
64fe7acabc6139dea0d84796f450bbe565b7f1227fd33d5dba06748628e70d8d4dad1096562bf213b2d88a5ce0a93280798fd95a9544346044b78875d9013772

Download Submit