b5fbee57a87ccb50f37af8de8a2a518d3882f031cc851421121f957b8bd4d828

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78aea23eb02f618f8fb08d183e28112f_JaffaCakes118.html
Size

145KB
MD5

78aea23eb02f618f8fb08d183e28112f
SHA1

48fc399920bfa4a6792861e71fb36822f2d1eb0f
SHA256

b5fbee57a87ccb50f37af8de8a2a518d3882f031cc851421121f957b8bd4d828
SHA512

2694e1390f669be1fdee7b25c696c95e2679b5c357bd1fd43e5d02506b0207a5028d8e02c970766407e2213fc3efd9f6a3aa0d6e229459256476458ce18c63be
SSDEEP

3072:lcITclgtyf3iwa/xI05AwhIiZPhCrxY9+8BzzNVV7g:lZTcmJI05ASJhr8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
4708	msedge.exe
4708	msedge.exe
1568	identity_helper.exe
1568	identity_helper.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 1588	4708	msedge.exe	83
PID 4708 wrote to memory of 1588	4708	msedge.exe	83
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 3108	4708	msedge.exe	84
PID 4708 wrote to memory of 2208	4708	msedge.exe	85
PID 4708 wrote to memory of 2208	4708	msedge.exe	85
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86
PID 4708 wrote to memory of 4440	4708	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\78aea23eb02f618f8fb08d183e28112f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,599098745155614317,510790152224646363,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
ba9209fe4dd50eafdd320eaf095bac1e

SHA1
02e6490d4475ab337f97c3a750e4746844e651fb

SHA256
48b54ff414ebf44ff34c500fb6ddfc305690b3c7bce4b1f90f2168c819275d2f

SHA512
99ca9a60e182f06a04498610ddc522a757a611fca456fa13b2815bbdec00015529db3cbfba7d0e21a033c7e5f8a923a2b7be4028c8f58842ee4b2c6a677d576d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
6e252bf3155f0d274eac71c381d542d2

SHA1
1bdcbb4ce5d570feb28bacf7dc31a2164d57ccfa

SHA256
ca9d18fcaaa28ce01588e69b7fc91bf3ed97776dd646ae92241a904ca4c1bc44

SHA512
eaf764cfae84931c22d2869b21326159d1a7b8b91b5d918432fa376b647644a94fbec2a85daa11c8d2bb0640c67dfe98081dfaec48894b41ff9fe5f5322d2580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0d1d88e074f1d3e81f470cc4097c64cf

SHA1
a928ed7b5dbd2ecf54d54046743838c8b275b38a

SHA256
dbcdc7da88eac025d1e600a68d5b5a3e3fe6ce85baec4b90bc367c169c54197b

SHA512
1003a9c094c559b07bce74a120a93e6e1d7573656f9f9371e87e410cea8ab93f906a9ab79ac3c0278d823ed1d6ddb64ff7ae159b53b9180fce815c8b6ac6f62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
498c65536e943fa0177f4ea8fe4870fc

SHA1
9ba0f1d8c7056a0494d043bf01e36dd660527551

SHA256
b67b8ec14147058314db86c6eac90cbd9bc1e8db5094d0d53ec22f8b699929ed

SHA512
1a2200ec786353bfe4a40a2e2a770f97068e5ff0346f54d0689b022fa27879b0e1217a1ccd2caaab4d88356f4dd794e477a892039fe0fa0786979bf5bdc2e59e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99b28c10dd75f18638f420ee42624ed3

SHA1
671a5c8323250b998a1523c720cfc8237f33d2be

SHA256
92724d078acb0d8d4518a2a131fff8ac73391865970e14912331dd45b5cadcad

SHA512
c493aebc3579eb6c618b0d6a39cf3b2da4bcc6f784ea6a2eac7d67c20adf5eb914c95c681c3481a23177e649699341779bc8bd28a376c7481c16f299677dd9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b093022290a328b842223f1b9c70fd7

SHA1
e08af15fb2db88a3ae5de5ea7d83dd7c75b81e5e

SHA256
e496ba071be97ae55aa57b0f17b722a6121ba3ff539b105b4ba650075278d6dd

SHA512
f1192d3006a78eb5b6d36e360b88a03661ae0014665139348b3d2b0d0ea7d30c1052b8fab93982d5f76b8df0cf8c43b8f3113f9f3f96736230cafeebbe020f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
395679f2824387223d46ae03f40197fa

SHA1
819c93e6b496020583f92bf1aefcffe230dff1cd

SHA256
b6c7e09fbf3dd3c490d992aa2d05d73ec0f021dabee50586cf193e26dbc102f7

SHA512
30ba2d979290ba796d4f445f53336825f4dde1d2b738b4ed38226ffa4da567e0a1e89ef176ca8ad71d45ecfec4e9858f3c1e1f94e07f91791da9220e7537cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
55914e78cb162fcab578e53671d70ed1

SHA1
d42cffbe7864d95dc414130e719a68996b12775a

SHA256
002f60cd94d5d1f19ba4e5055ebbefad09f4d4fd4172156e74eb3dfb095eec32

SHA512
ccd7860c3d2dc770170d195a97ebd2641c16e0c5df575614657feea598f2cc22faf9c014173111668ac8c383f748906a97ac184c0d9f8ca51debb7ab290a22ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5da7058923b2fef5abaa56858131ddbe

SHA1
07aa82d6a5b8599cf8840e87e8c7ff80530fe51d

SHA256
9ac9556f0fee925b8a210d6494c5959038a0a5c69c2c060eda8fb620f44793e1

SHA512
41756b16af879dea0269ddaea88943d2b536e8d5bd71058a14a080d58d3d2627e4e32f27ff42f66cc7f55c790aadaddd37df531cabfeeebafe81cd1cc35a12d6

Download Submit