c881dbafc0a8697531ad86d3bc0d5b57307c38336311ead3c50a2d024070effe

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f131079811dd04e32520a12a94c0ba8_JaffaCakes118.html
Size

51KB
MD5

5f131079811dd04e32520a12a94c0ba8
SHA1

5416cc0ee28ea6f4f76b3752a7ee404a2285e549
SHA256

c881dbafc0a8697531ad86d3bc0d5b57307c38336311ead3c50a2d024070effe
SHA512

8e2c882ca5867f44d25878e7bffee0750dd43a3d9f6cd78182b7878c9262432399a60e4f3d0a0000fc6893a003611ca781a3252f84231613b4d2ed4a1dad34b0
SSDEEP

768:OHcgO6dv4hocgL1L2KshAUoiClUZ80rIVNPf8oKCGccZdIfQRXUVAZEnN29HqeyC:OH142JL2rPEUIP8oGzZdzXUyZEnQyC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
2280	msedge.exe
2280	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4072	2280	msedge.exe	87
PID 2280 wrote to memory of 4072	2280	msedge.exe	87
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1116	2280	msedge.exe	88
PID 2280 wrote to memory of 1000	2280	msedge.exe	89
PID 2280 wrote to memory of 1000	2280	msedge.exe	89
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90
PID 2280 wrote to memory of 1644	2280	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5f131079811dd04e32520a12a94c0ba8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1492 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11229208057570771491,8932688162074998973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0f337079cb972a4ebedb7200fe99a604

SHA1
699d4bafb451d8462c61afb0f3beb9da12cdf17a

SHA256
e00b32c812922859ab99715c57dc22bf75e9a76cd0bd7877dc8e5ac797556307

SHA512
ba0707d9dd6b3772e7631f12a659da78787625b76b97b8d608f1718b43bc9dee1e06606621928dfc41ca0f1b4a7fe831adf3a0cd7179e35960db10432a15f890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
414f736b3afde7149d76a4682799e1a7

SHA1
f76c82fd67537f1ca4b28261a82ec963640d3594

SHA256
6197103828e605315dc38e7090b125b701797d487696ac344be704e081d76d1d

SHA512
3c92681348b6bd08900d53d27400eeededacbed96f7971a779b0755949b4e199c854077c6624af98d769a51bfbced590ab1efb4a7e782d3773cacb103005ac65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
ee281c078fa1811a3ba7d1eec154f8c0

SHA1
e7a81494d99fbdf65ca04884ae9e72f3f3f394a2

SHA256
3b8ec02aa7806b005c32b9147de8c7a57e97c99d2036b24fee0160a470ff5597

SHA512
89771dcbd04dbdde6fab2cf276641dee646b62e45b12697233ad640abe6a95d8b1b88b7075f03890d32381f642affd293d77c54601d5858fde6c68c82745735f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
121b48449d2c4887274105ee2c850efd

SHA1
d490cf17d36e4550868f138cc8631257e7ef21e8

SHA256
f31b073b8ec18213297cd1b5793fe1a7720d4e7c0623d9f0fb7a9d54c65b64ee

SHA512
54376f8e4d9056ad8815741769a20d498005b9677fff69fccd9fa24da835a963bdcd4004e58cebf62ed00db801542f05315721ff615b132883b4fc6ed2b58769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c59866a995a48a288bad2765c531d78

SHA1
19592859f3418f8d6d30cac03e8c4bdb32eb756f

SHA256
4edbb9bbf2d9229f4bc3844b2fc4de760863546e478882d2097a881a9282e6b8

SHA512
9d7a0184bea01bda06e9dca9ce7fd749f31ebda30b8db7329d4a6a276d938c2a67a2798b601f69c6cdf38fd5c26cf4f26bf77c933afda48418ebb6fc81a74779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76713c96b18ec0da944c20f164aaffe3

SHA1
aaf02aa4dea2733ff808e40bbbf496934f3897d4

SHA256
4f5adb09aa78137cf54b5a0bc28655b252a32642488881e7d27b5bb77ff3bc39

SHA512
5d0aae078fb71ff87db66598e3fb37d88c2652e00595fadd6fe9bfd702efa0a53702842b0d5fb1dc3ddc0183796b34f3bb4fc00822cc7c9a26927c8d864d83a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
40e22e25b2872c7ee4d619f138b2ca55

SHA1
2ba7e723eeb619db1050558f2b6340df05615781

SHA256
e60aaeb3cb5ea3eb59747a8ba3874035930e937537f17c146ba26c00df3f6a0c

SHA512
cda0e18f1eac11b42708db99ddc2a11f87b701d69d37f97458c7003cd4c938bb0b1c04d11bd30a5a7aebfce637096be23502aa3b02cfebe5f928c506fe40c3ad

Download Submit