0d01a0253ce732938ebeb83d5e47319886b4cb0f777911f04758c2a2165705c2

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa625fcff93170bf3e0ffdbc62e17584_JaffaCakes118.html
Size

175KB
MD5

fa625fcff93170bf3e0ffdbc62e17584
SHA1

3ff61e85f9ac112af22fc0c7da763a9905912862
SHA256

0d01a0253ce732938ebeb83d5e47319886b4cb0f777911f04758c2a2165705c2
SHA512

6a6a3172b6ec0f2bbac854828035eded1016b441da4ced977bdd891796ec74f194ef819b64c53b148ebb648f3d9c2ccdebca29e40549d16ee1a88ec1b09fc847
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3iGNkF5YfBCJisk+aeTH+WK/Lf1/hmnVSV:SOoT3i/FcBCJium

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
448	msedge.exe
448	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3860	448	msedge.exe	82
PID 448 wrote to memory of 3860	448	msedge.exe	82
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 4640	448	msedge.exe	83
PID 448 wrote to memory of 264	448	msedge.exe	84
PID 448 wrote to memory of 264	448	msedge.exe	84
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85
PID 448 wrote to memory of 1900	448	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa625fcff93170bf3e0ffdbc62e17584_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd50e46f8,0x7fffd50e4708,0x7fffd50e4718
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3389360265105307673,5414692943995785423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bc4b83d-d7c1-415a-8a41-da5dea8e27d9.tmp

Filesize
5KB

MD5
8f5accba3a6afdba93fd1b587915c1c5

SHA1
18c0a29582fb85bed46bb7074eab12ed2e9fd47d

SHA256
b0c189c625fef44c310e828630ee3371430dd7f3608c5c6b957c025dd4203257

SHA512
67ddba56a98583955cf593c63718d6ef36a754829175d67ce0f543d86fca89d1ee4ed654c2ebb429e1ae22ec1fdb9c6510769f646fc944016aca5c202e3e3fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
02bac54636d00b4059602a7d04ee6d41

SHA1
181ea605fbf32bd2895a9170873b6356dc37748f

SHA256
28ba0b7e3fa6070799b7d8a5a166a1c05751948059604b835c7a9e53e5668fd6

SHA512
be83074f59ae14751cdca5ef08b5e4422754dd013a13f1071e4a58981d0accb17449f9764a0fc33577980b4f7ad67a8e6514162f761d91eafa5d17f22b27edfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
17e99a39a759be8ce3553fbb3eea504f

SHA1
ee2ba8053f87d5eca8dc517369e236eda5a737c1

SHA256
a198784a84746248afc1a9499843cb43a6c4da9b22bccce509fc08c97ab04aec

SHA512
2d2ccaa9bc9b8c2495da1cb4d41f2eade44d6d146ba9c8c937ba8e9220489c79cae184b36eeb5794d4ca40b79b434e065aafed6a62d1184bdffdaa2bb24f7fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
98KB

MD5
245da6be96a705907877798d791ef657

SHA1
a60ce9a7453d1eed5a9ad1a46a57028614bc7514

SHA256
0554ec3e224b8e9567d27b90f26bad29e1b8b0d9ddaba614534385bec993790f

SHA512
35c076faf888413b89221ad29d5efe57b0629e67040dea26deb8da6ba1c7548a43d232b84497982ad63b3e05a64043b4463129bd072cfa2cb51d42f86203e5fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
3ba22e3acd4e95b5750b7a9e85a02a56

SHA1
b464fa890e4b1bac85903f84dd28ddfaa12bd249

SHA256
2e1bc644abb3a4074978c25bbee057d9484e986b4ce48673cdf3f17fc76b3fc3

SHA512
767e500c71b9bb3c126ad544aa578c343a9eed2125cfb6c39bedd759e2f538a20afb2021f1097cf1dbbf0b25f658d3a6d20c6f9dab9bb526559ea6819d8a2f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e870466c6937de6b983692bef5eba5f0

SHA1
228eec448c81933fbf0a8d40d676b46b9c47b542

SHA256
ddc5952d0fa6e44c5c948b5a4caf4d38a2bf2fd04f6e0f39059660bb9a7b4af0

SHA512
dfc3239182aa343bc39ba3c722011b19a3c722793fb154bcbf32f07f2a1f793a101bd346614dbcfc0299978d222e4f0df6ff6be014e665452ebd189bc352d225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f6a643c85330ddf683c600b2c4b29f83

SHA1
06a0714efe88f4eab108ab0c4ddd9f61299b72ee

SHA256
3349f4da3b6efd8e6c422c495490f2b065d6ebf04733bf46569ce29720e8d597

SHA512
3514119e1dcc1b7e377bbceef0fcccada318b385efcffb00aa3c3096b81eaab2e1a3e7179c81d4496357aed34c7ae372ccb2a05112d916eefa221214bc79ff5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a6693e1fe2780e5fd38f3e487af369b

SHA1
0db446dd06c4ac4c726076f317732f69a5363b39

SHA256
21911d046c8cf29ee905e37cfb989d7ab06d3a1d3930239519c844920fb4a6eb

SHA512
e5391f2da6932ffa5bc33f1ab4840e5acad01832f50cbb914bf5f68161f5004149d437cfc0586f465dd6ad7d69afa9a51f361b1481bb1828212739c170e0c313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
09de90afd58fa17a2037fb2eda912e24

SHA1
409c789efd327655aeb5d605d22372f84381a3c2

SHA256
f281217d92df59cc14bc030d7f1f698d311c15a732a59bd3305148d49d223f98

SHA512
1b46a7d14d790953090c071693d78ea98bbd37278f0403972f18b3f53998e72d60b63082f3347d7ce0a7f000882eb27772d37a1ac5cad591680dc1e9a260a1d9

Download Submit