6085d133cff0cc53b46f97ebed97d57f49342a804573c7564db69bc28fa0bec8

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40471cf95099d8491362d169210406af_JaffaCakes118.html
Size

64KB
MD5

40471cf95099d8491362d169210406af
SHA1

167ba0d5738d058b9909e0ae6265c298c7d6c718
SHA256

6085d133cff0cc53b46f97ebed97d57f49342a804573c7564db69bc28fa0bec8
SHA512

16f35c8def8aecc69c0a4e6206ba00d723614caa408d3b68cb82f52facde99d05617f3955a116fdc67f95bc0e6aea8b02464d099ecf9fd0b3df11c286e04536d
SSDEEP

1536:J+yMa867458BiAxPJxUSQltsDAEWWEj0MeFu:8yBvA8BiAxPJxwltsDAE0PeFu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
324	msedge.exe
324	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1560	324	msedge.exe	83
PID 324 wrote to memory of 1560	324	msedge.exe	83
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 2988	324	msedge.exe	84
PID 324 wrote to memory of 3916	324	msedge.exe	85
PID 324 wrote to memory of 3916	324	msedge.exe	85
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86
PID 324 wrote to memory of 1720	324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40471cf95099d8491362d169210406af_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce17046f8,0x7ffce1704708,0x7ffce1704718
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3745325948609729523,15384069546786468391,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
21KB

MD5
0996c07b025d035a26dc5d5b133f61aa

SHA1
076176f7ca2a5f76999af34f31ec6ed08a575b36

SHA256
0ddf5e48a9bb82c6b8269e3fb9bc90da898c4c10ecfdea657bcc3c1d53471ab9

SHA512
4da1395299514673c002d360739eee02e10f5bb2bc71b99239dda204634861a81faaee202faaf96f67f6ddc33faed8990c812fad9af09df39682631d1c8f7bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
df14665f460474a948ef6f3ca958f319

SHA1
78acca6b4ca9499ba20a2341060e9e62d1365a0c

SHA256
e1351a972cfc2b3cee94b36da7a2d25d94e86166685a084a7f8fc1f3e578270e

SHA512
8a6bbf19d0a305b4617604e34491fea97b0d5d88b6bc7ed635daa1fd7c580fe5aaa799eaa298c949bf4cb69d8d415c0e823b6128476008e527c130a26cf59cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
50f22d88aee520fe074c0818b82a2d6b

SHA1
1fcb4db9fae31b113d6a9b96ada705ed8ab58d5e

SHA256
2d4901876942ada33cc36aa11cc4f265ccd562a397fa1f069325931ce6778025

SHA512
ec5aa4aebe0cdde6bf1ab81dbe638081a8831d77085d03cd21280848ad0f0256678b1766ffd5317beee9521bdab2a6084d7fe675bfbdc5d22c343ba1eaca9f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
1013c1d4ea96a1a45f6e9081a70c1fad

SHA1
8bb2e62862d5ed148fe26e19a0815c72bf932bda

SHA256
016cc16c4334e265c32f727269339afd9524167c28900c8fcf34ee9822f8107a

SHA512
512ffa354e84676655df73a22822d4a5cda606219ea759d9680ad74ef045d89bbf1129d931499d71cb98547202c9e39e1a82bd36d6b0141beefd6cb211567808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eb7a17e326ef8ce018504d8f641bc3c6

SHA1
c66edaedeeb2b923a7c223ea820bb7fa474948e5

SHA256
dc1759f235446f3663ecb345c0143e7e3cf93032dc7639da65269915a1918106

SHA512
51b608d71859e65311a6da69a2b20bdbb46194b932c5bea42761532564076cea2c3584807c402a94dc7cdc61a5de9d79673683839bed60e531b5f9b050f493ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7e29805979976f207b2ae07f24cc3f86

SHA1
099865f4344e38c60297f6b1893b3e2b5db69b81

SHA256
7bd644b85f293587002b67844483cbd298bcb1ce745b8fde66210ccd6b536e12

SHA512
37c21e3ddd32f9ad430b9b0f766357f0f30224c05dc1cb39e0cd3d9b24980cd6eea7482dd25b7292302bcf98be752704c8b37f90e8251f9e19a71e5146b9cd09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da08b2a8c9f667d20e5bb6ee2157f226

SHA1
3b13e1a0e951122904daead4f9cd8ccd8c5796b7

SHA256
6d772c423d01080b8e9529bb652fc57a98879073eb70fb020f43a0ffdae21b79

SHA512
d8431962b1020a208e25afee6e93787244926c17e6046ea959f0d98eaba10d7d393613dbf649a2442dd3401e18ff73423ba9a303582f506fcdcedbfa0ca2e7fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d7e5625613fd3dc2bd01c213f597f228

SHA1
e4f1da111fc76833e6d585784ff4325a276b9458

SHA256
95501f3f7355c924e728e3f36d5419e71bfb476149bcf1aa1b0e418ee2b69853

SHA512
d548f31117d8e6cd4606acc427985b58cb4b00c04813e82994a98dc48d1e7d37c9004608f094b08e1b953bf58341adacf5de718ebf938f6eca3a48e2b2fcbdf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e320815f40a6887bd46953410021b5a8

SHA1
b86ab09093a8707300e40a78385d15f8066a8a52

SHA256
585baac1c15486498c6e7604e76f7a7f6cbe278fbded180324512f816819c382

SHA512
2dfa3a808dbc037124446ac8aeab0dfa6a50b91e303e11a7bcf5038fee9d73bd64db90912f52a6505460ccb8e6c7833178cbec6d6d637bb419ce70e339cde73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fd8f83d52fac9e39716a2a9d07be111f

SHA1
4765334f5d3fe01727a94b040b9e77d51c150fa6

SHA256
0cea748cdf25e74bc8ba2c9f74c6a9c5d0c099ec69a33d0a17f0f1a22fee7cdb

SHA512
91c8c51b1876f0189054e1bcf55d7883a2a2c6bcde897aadfec6a3253d145afa9d6ccb3a010a68be3966464f3a52f06cff45fa1133ab06926aabd2c9c8bef444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bde92d883b269a6044eba60dbdb5565c

SHA1
37ad68aa7fc5983a34010d8dd42b503e1892c6f9

SHA256
7c7bda3839cb1a36075934ea7f2659843b8d8f2f77cc5c05f64a48642879f35d

SHA512
5adc2e65fd139ebbbba4a61dbc9fb6c3de2815336d6d24aec970f338854ee6a7be5c8f998190d6eda64b8f807282c35b100b3e05868eb4550a7e527b51cbf34e

Download Submit