c59db8fbd92a40769fb693011749cbafc37fd52e3f2a02f877730388e9400d9b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

515c872414529825e080cb0538aa22dd_JaffaCakes118.html
Size

115KB
MD5

515c872414529825e080cb0538aa22dd
SHA1

d19c3330e830b1249276fe4a210189f23c6b2a08
SHA256

c59db8fbd92a40769fb693011749cbafc37fd52e3f2a02f877730388e9400d9b
SHA512

01f7e869468df6bb5f177b0d3ebf554c12be86beda1d2eec0d7b4eac1989777fe2b52c420bec0f400890fba86afe291ce7211773beb216297a13b03eb39c810d
SSDEEP

768:dj6zqL3sAzeW7svDLe1JOZU1Wsw+109PRtcAl3twpkma3d8pdmXwCCbrGcdlY29s:x6OL3sAzexfaOZGNTEt8pElcdlu5ff

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
1380	msedge.exe
1380	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 3576	1380	msedge.exe	82
PID 1380 wrote to memory of 3576	1380	msedge.exe	82
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 2352	1380	msedge.exe	83
PID 1380 wrote to memory of 4212	1380	msedge.exe	84
PID 1380 wrote to memory of 4212	1380	msedge.exe	84
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85
PID 1380 wrote to memory of 4584	1380	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\515c872414529825e080cb0538aa22dd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ff746f8,0x7ffe1ff74708,0x7ffe1ff74718
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12940611440041135429,9488584980843128793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
050ff718de0ec1cc428192bd5da1092e

SHA1
7c73e30db9939fdacd190b9e66ecec23e3fb0468

SHA256
93d0c993854cb23e439a5a09d9e84489419e66a77b4105a606351b30f5ac59b8

SHA512
b89404927ac30079b4c925d3dfca0c76182e027b05dc4627963912d3c776efb7cc368ed1f23104c74b894b88251d12e8270f25aba108ad4974188780e56c6c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
aadf302d23e385aaefda454369f78bef

SHA1
a61fa9f541980ab95e6c467d62c589de59102899

SHA256
89560e5db13db2ff61415004cb884f8b2414c962318fc020bdd0c1d58e083262

SHA512
72e5e122145a1ca5d71eb1514186b219460193b2838652e21efb024d96b85c4c762f7fa13f1f10a0de923e5653f45f183db34c3a17526080979e0a38ebbc815c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
abc1b04c3422050c782a42d6ffda4dce

SHA1
ed1c01911fc03a1c9404df21e657ee8f6a9ecc82

SHA256
46d34f22cfb01d16845bc609a250baa80727111cbb6afbe4eff4df9d3f7bad79

SHA512
639f2f591b5256a9982c67b77e0709993286ae9e6adc455196480a8ba8ab73ce451da10f601fe240a5acbdf44cdc03faecad38bdee7b3959ed7ea8a13aec8c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
26ea8d156b19e3d6a493d8eeabde4766

SHA1
8106330d3f9ad3fe0317451cb4f54a847583fb67

SHA256
c1fe5ea8096719e9262974c896730734ce89a3d278e54caecb87f37c39874a27

SHA512
2db7e6c52ea276c9ea04e10c09d71a86f490989586df251eaf08020522b454c2138b0f73678f7cddca7475e26f4c7fc11f5f071201cd79df74cc7331b2fbc5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b54190ad535e4d31d68888b345bfc508

SHA1
bac379945e8c96f36dc69cd5c60d30a7cd33a860

SHA256
1bdf412223232943a392587a1c0c0037c9480a78f657b6c4e26eb81c3fdacf26

SHA512
0adcd0e1f4a861deeb7b9967d45f880bc478a05dd1ba49da10b6d878c7c5a29c97d590cec7ab72a4203b1c041d760be40ae2a28d180f8749f4f1a9e5580a8de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66b2398e9ddc020ddc2a4f478b307645

SHA1
2db5bcc3aced627ebc26d87b8f112b41a4c9e522

SHA256
1978ed63828c8b2c82eee686cd1b7301dab968530a9b018270bf63147f1a6b24

SHA512
c3692d8236d3066feadf86b91437b47463773a34f7ff6a7746ec7f140c272a316bf1512ed00a619faa0cff78f5a805fdd91ef5ba39dcc25082e5f023004b3a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
06a24fc91d489c6e1ff85aee99f7927f

SHA1
300ba24ef72ed7e67899f273a921b961b7c37486

SHA256
ebe82c165ba752663bd2f815d2430d6c96b16fa244c1e0d91cf75f9fbfbd154f

SHA512
9fbfc06e4489bd5cc062af48021c1ebbf63e73260b7013bbb0fb24778956559574cfb739b4f9b8db63b7991716d3e4cd6b17a763341439a1b42d1af35d15a797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
08791c18a5ea8b8546ab2fedc7048ef6

SHA1
e6dd48be7a433d81da7ddad7923594779b1850be

SHA256
7461bf4c87358312bf345c74bbbe3a5508e6347c0ec0a6e3c0b4ae2e2e79ceca

SHA512
1465b2b7301a936d26c1d59bfb70f4801829e0dbf75b04beadfc6c71345057ccf1d8ee7d8ecd7a9e802c3eb06e9d50789e0e771d4a4552402e1f0f6d632b1200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c0313bb1a8b8ff5e7718476c51031ef

SHA1
a5da7e73c1a6ee8dd51a890a6d9786f944f71f79

SHA256
8d942002732be039ffc67f3a885a3fc0249e25e0b49027d67776583793c16357

SHA512
94e2322a75c6408a52cdb4ec9399f788ac972891cbe66828dd5f4f5472830dc16e4e14512e5357da8cd523f7c668d3aa62b09cf4aae5f1800357a3ba648b848b

Download Submit