77da860cd56ac35ea77e4768745a0c36a3662ad08fca31aa6a5ab1cec5c3d4e0

Resubmissions

20-09-2024 14:56

240920-sbcqxasfrq 4

20-09-2024 14:52

03-09-2024 13:17

30-08-2024 12:26

05-06-2024 15:48

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

873d16767e0895ff109b2a2ae61335f5_JaffaCakes118.html
Size

175KB
MD5

873d16767e0895ff109b2a2ae61335f5
SHA1

15ce4fd25f2709f3a3379a41e51337ddfa6c773c
SHA256

77da860cd56ac35ea77e4768745a0c36a3662ad08fca31aa6a5ab1cec5c3d4e0
SHA512

280efb73feb2b569444212a708be2e1d9432752ececc7302f4841235c6d76f3d50f2732f12d867b289f9c881a282abf5709918435344d91948ee7570a2d436f5
SSDEEP

1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS34GNkFjYfBCJisl+aeTH+WK/Lf1/hmnVSV:SBoT34/F6BCJiZm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
3256	msedge.exe
3256	msedge.exe
348	identity_helper.exe
348	identity_helper.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3032	3256	msedge.exe	86
PID 3256 wrote to memory of 3032	3256	msedge.exe	86
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 4552	3256	msedge.exe	87
PID 3256 wrote to memory of 1352	3256	msedge.exe	88
PID 3256 wrote to memory of 1352	3256	msedge.exe	88
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89
PID 3256 wrote to memory of 1004	3256	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\873d16767e0895ff109b2a2ae61335f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c1846f8,0x7ff80c184708,0x7ff80c184718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12562117417973001597,2258770114981329927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ef88fda-7f0f-4343-b9d5-c3d60801f6a0.tmp

Filesize
5KB

MD5
e17274c24925db1c9923baf3e4997bb8

SHA1
b64791db97985f24711fde5a5afe9c0a869a70e2

SHA256
8a5ef0c02fb54256cdcc91cc40bfa5d8a9dcc01c75feaaea3d37a5dd3d314f14

SHA512
afbfd9952a30473be4decf79b419b88334885a52d8eaecdedfcbd38f22a732cfb6348c5498203e7f87f2370af3b95d2a7da0387274ffd04a66cd99db4c7c5c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
49a1b5166c2327f4f3e1747ed7719b0c

SHA1
4e9fa2ac787719ba1a5cfaf50e35b101e23bc856

SHA256
4a52f5899b8d634e8bd55c4077629b454de57588c91595f158a2e095f498968d

SHA512
c498a9fb5c49e88b07454562032035fffacb4da204d64d4adbec2662d1a50ce23677a60306900fcc963bfcf90df2b368907403c814187a600137723299e254dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ba8b07b900505306438450dfe0fd9d20

SHA1
2e2dfac71524d2285310292c1ba73dfaca840d77

SHA256
a28380d5750d37d0719767be62f77ee87d78082b404606530034e2cc0b8d11e5

SHA512
d0449b47d4b2f8b289d59d21ed04b157ed6d19f7b7351e6486c570f2819f94ee8fbd7ac7915b26f31f983aafb86c80aeedaa6adb5cd20e6752a7f7cb206c8fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
be1b7c98bde33d420b706c8353e63f92

SHA1
ac6630d463e18b6810284c24b558987df1343fa9

SHA256
35c8b9a738809efded7df5f51fe2b2656bbbf7ceb07e973743f1471b46ff450b

SHA512
6a334447908d83165271bc388d91d0de940db8f97caccfb4e4ec9a8c7abbb97a31435a4de6813734b6b2048c4830c2986cef9d2e268817c506c96d11cb5e9500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
681bdd5e213ecef9ddea1a34b9de4045

SHA1
1113f8afed3a230987804ee0e5ff94bf6d876ad3

SHA256
a855728f9cd4ade9170e14e369057c0fa0f92eef9626481ef17c9506a5420dec

SHA512
f0653cbc2ff63945f692d225f699d2e074a30d01b100ac8a4200c4f85310a9f94224fa719407a659c4908cd0ee254535561f7db952ae0f5758a3949867e091e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
322b8e7d2b462b0b3c7e099b0b67530a

SHA1
8f667f9391b0ff1d1efd9cfbbd2c892cfc5d2ded

SHA256
7c0237fc48173edc5e719fe68dda3fe08c5fa6ab996abdb9cd3b6eda9018df22

SHA512
a7999c760db1dc6ebf26f7bfa6fa08f86fd798cba32003988effaa8ff3647aac6a79850e7e06979bc31f40a7169a8a1cb1c9059b6fa91b251d218b3099b68310

Download Submit