ac9c2ddb0d26ae6b44dced45cc5a3854707ec1faca12eb26257a1fb4b5df4f50

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47ba939df4bae2911de050867c96b4f3_JaffaCakes118.html
Size

149KB
MD5

47ba939df4bae2911de050867c96b4f3
SHA1

9af6795115796b7f594318c8af753cc54ec1e633
SHA256

ac9c2ddb0d26ae6b44dced45cc5a3854707ec1faca12eb26257a1fb4b5df4f50
SHA512

9ea1ee722ea8682c95ef9c824e9a83de20ca6bc9793097fd5a5adc21051e81a020d90b490cc7a795c11251dd67654954ec3f7af0fd3dd2c1c6531fa8576e0668
SSDEEP

3072:wUcjvG8rMdcXmNRS7fLJVLlzp9tqnbx6ShEodPhN9rCX7CeYsW3Htfd:orXmNRLZ3T

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
1456	msedge.exe
1456	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4428	1456	msedge.exe	82
PID 1456 wrote to memory of 4428	1456	msedge.exe	82
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 2420	1456	msedge.exe	83
PID 1456 wrote to memory of 668	1456	msedge.exe	84
PID 1456 wrote to memory of 668	1456	msedge.exe	84
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85
PID 1456 wrote to memory of 1152	1456	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\47ba939df4bae2911de050867c96b4f3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff201c46f8,0x7fff201c4708,0x7fff201c4718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9760976828495170390,13072794512221616416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d99b2dd037dd0ba874618f2f99394f87

SHA1
d22502201cfa0b97c8a5c967fc38a12d10abb3c5

SHA256
404bee00bff6271895cfc67fd75c685b467140b877729125fc46f0f37d1c3b7e

SHA512
2bb83eecc4cef99abd5aae35fb513f0ff38ca473c5a653d4af24ed47099a5bb7999428cbc518c074f7bf70c551fc87f34434c3e103c61206a3a79864210f1a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
62d6e62e6e2adab2acc059001e405bbf

SHA1
fdb0415de38b6c43921a13df62eda081a6303046

SHA256
d744b6a3100b72b181674411df5bb8d06e182e0e03b2e1924862f150d016c9de

SHA512
1b202c5d95badbb5b05f561bac112c7102557e789f3c9a8d52bbaafe9d0d9e689904e8c36f7984f69a7ba47dfed988f9f122e20c94dc6d5d60eb41398d0b82ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e35eca56f47faf7cb278eea6ee4c8322

SHA1
25fe3ae509cee7dfe603d41eb7abeea30fc14c91

SHA256
497b057506a3b6f28671ce2f90e8f099019d0401be07639132ea11c08fee267b

SHA512
0ef2c728af667787bdd667db90f1c83f6812a52a6dcfa6db09a632884bc6772aec79927514b39f080a4baaecd8a2b32d274b2a3c28171aa63f5c962eb1a6945a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
69839253370bbcf66ebaa1e35cc83ce9

SHA1
41d48ddaf165fc34c2fa2929b0f988863d2e09fc

SHA256
34d24d40e528338c10a9722fb548a2a4904d524ff0b19e713d623b65c53fd4d6

SHA512
b9641ce64c42f8e043288255b52dcc132b2c5991a43a8a2ca9d3581d601e95a5c445225dc84e083357fc3dd9cdc1f706e58964c81503c97802be729459d92a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb9449a8aa81aeedb79472969a0b7469

SHA1
20882aeb979776e7519ce646a3172a77260b0efa

SHA256
0b5ee6a18878a54c7a2d9eb0d8e8b0f2f1621edbd21fd6f3acc02198f55e098a

SHA512
07cd5bf00120fa4e44f8f25a54a8bea40bb9d57eec4b2b936565b247c2d7ac372ddbf73167c2f32043962220c9e44bbfaecfe9512f37ebe69d9f12d2b68f105f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
374c35c31391006cd9f26163cf624c79

SHA1
b7e052d69beb7ccbba2cb5ed10638bba93c74f04

SHA256
79adc12308b1ee48e61963209a94afd405a348ed37b3b715d56e781b5549b504

SHA512
9708aaa6225f39a3f6baf8b09d48081cd28c3ec0ca00f472a90248898d6a76923c2352e80b5ffbbd70733352db61421b5c6bcb73b6a8727ab3a59a12ac6e4da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66817253e80161420ad9fc8c2ecb9c20

SHA1
0fd656d35235beb7eaf142798483810ab8d9cc91

SHA256
fe3f27c4ca3cc5024dc336731c77608c1b8484aa269b16f2ec21ece84a7b18e7

SHA512
468d9bab2c7338ae2376edc356fed6b077cbbc388cd688c265123ddf4b3f395cf755177bbcfa28867760cb0a82c2251438c60820699edc49db420961a1f59258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4e07c8d8e70efb7832c1ea0a9d83167

SHA1
7cc40d43faed8558301c3cf225633a5670c44250

SHA256
d455940f6ec87dd0f461464652b520cf05b225fdb30423fcd455b0e86f477d62

SHA512
2335ee6c6737349f527313b0d1bc00d6b7bc5354f666a4dc8502fe7b48ace9d0088de198696de698271f18bea74a6ab3dd265205eef5b51710bb5d5966985074

Download Submit