44625f019c7e557c7f940adfe4d1435ad0249eb8c78a24e898194d521b27049e

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7478553f2903cfda94bdd14f0d31c4d_JaffaCakes118.html
Size

159KB
MD5

f7478553f2903cfda94bdd14f0d31c4d
SHA1

9fb7bc4dc7984d137b6c8b336e27fb7d6312976c
SHA256

44625f019c7e557c7f940adfe4d1435ad0249eb8c78a24e898194d521b27049e
SHA512

1d003dee9abbcbd8948e4275be3dfa341dbf6d4629517b43b4e04378a95587dda1bfe43bb300dea1636ceb73e213d4effb855efde73601d348cd06b2549f4f3e
SSDEEP

1536:/K7tl1ukruImnSlpBolMzcA2HBtl4vn4mm40MzQuaTsLnza8FMctJ:y7tqkqImWpBYHBtl4/Gw0sLpFMctJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1524	msedge.exe
1524	msedge.exe
692	identity_helper.exe
692	identity_helper.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 456	1524	msedge.exe	83
PID 1524 wrote to memory of 456	1524	msedge.exe	83
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 4604	1524	msedge.exe	84
PID 1524 wrote to memory of 1672	1524	msedge.exe	85
PID 1524 wrote to memory of 1672	1524	msedge.exe	85
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86
PID 1524 wrote to memory of 3676	1524	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f7478553f2903cfda94bdd14f0d31c4d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87e2246f8,0x7ff87e224708,0x7ff87e224718
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9486705339775624214,10299340959905833264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
0c537a82da568b1528a5b4c5db95f169

SHA1
cbce4bdcd79433b66466b9fe3c0fec730b1a5bb4

SHA256
73279553e1043b5a1f12766aadf552ffdaeb0a22bff842e68a299dbb7af01ec8

SHA512
76ed9ad0826f246c6a3b1b00215625e38437d477e1df4c57c2a56071a4c2d80465a62062b44e33de2ba58f90e664f0c9bdedc2b274ab54706209b812c0d95485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
44KB

MD5
57ae46a87a9955c7c61ce5cfebde0bf6

SHA1
2a9297a0e2ee5f4e0a9b1de88ffd2121d5d2ca77

SHA256
891dc8b9999ba1b2d25c1a044b49330b66b86f986478282f4e5950b726e9878f

SHA512
34e51215e347df35ae4cf8420e2148420780f78123a37450682ed92841c6e1dd1635317cae1ef925a001bda733228db0f5de87faa0a10c36cb967e9b70691689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
80ac060e6387f72eb433c1c77cedadf3

SHA1
4df742b25a17225697bb6ed198c42ccb78df9743

SHA256
651817ac5c8214fde6fed0e909d40959429d8e5a75c7a77eaa8043e3c925858c

SHA512
609b89271af43f0f55b072d89960ca52618ea9bc9cc7dbaf45e8b748c66f28e16c9346e052b7d258caa0793c1d31882b46d862cdda8459ff78385254274cd9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
4db0a5a2616a63598b14e3e3e5a39615

SHA1
e48d9d4ee1914172344b072a73ab679170a70de1

SHA256
5e7b0c87969ec541514a4540caaf970d729a426df00783ad45e45348750e8a56

SHA512
d037bdfd2548e0474e31db2298ee87c47d16b66c4dbf2c4eaa9db4525e23e6f8a6a215ed2fb992322c88b7c37a6e573c223c5fae12c51db83475c2e6b1a59228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
54e2a6d18fd635e850b719b39b77d951

SHA1
9dfb186386a4d8ae90b9bc09f1fd65c3a5bb523b

SHA256
bd6922dd373ad81c2e842fdf7f7e78deb4c7932a9749a7421931b88c2928040a

SHA512
2321170c5bb1f910babd79434c785be338a1083993c44650dbdad953d5177bb924c8beb7920be7cbf73d7b3419572c78f2163a15d567b3c297e70a028e7138fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
90e5bc03d54b36865f2e41e131710593

SHA1
12953a93bc8b6806359c292961bf0fe223b76d22

SHA256
cb921750a2e0a24808f024460614b3b6ab5e3188aebb9ffaf85b84789e3e7e2c

SHA512
02bba6e7c9b9b1ebdf1b0accca67d503d93fd56b880336b960d1b3538c4f769a6c9cc8eb5d06571b8e6d81435683bb23f8a4c66f804147f9150966119a6be048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
774a68565a70e478fec221f5f1d5a356

SHA1
058b33486bd2322dbd4f7027b7f3d8d5dcad8425

SHA256
eb23188de13eefa92b61442ea8311d65d09bf3df9b0095d1e437d2a92cb155c7

SHA512
cbc31a6069ea39415167a74df81bf8cc0585c42a2bb94b8fe39f32b0856fda46731eac31a93a50956549a195d11fe4375811718f8b6b26760374de967b19ff07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
70d57bd4a26faad963c13a6273fc8c33

SHA1
9025e1655a7ef53a694810bc26857970a549fd5f

SHA256
32ce2c2d92ec5697086874b955f1fce92e50412b92904f3a8ecc3002c93f6ca0

SHA512
14641c0c1baa8eb18f3a516a4b141c12ce92159ec61ff5eba954c5f26d5f50ac812d9ebbd58b4ff68bf538337a288dccdd270c57be13b9e5bc942f23c490edda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33b0a5c0601f1fc92d82b381c5ce6b98

SHA1
25f2ac24b746781484672199275d5e52568902d4

SHA256
4a72fa7726c09ae9c4bb810a6ea8b15f9afd911940ae7b9cb93f24bf4f6d0a7d

SHA512
2f6075a007f31f8b3c1331434601dad3b7985041496276c1b6e164d89ed85ed1783fa616cc4bf2516b801cabeffe98edbda6ae778f77b1e20a7ccc0c02972710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
82a1e78cc0f409c8644edc9c14a8e10a

SHA1
563866680e84970cb0856384f454a5656cfe391a

SHA256
d1dac517bd4b2367b4d5cd561b23215bc8a92a371a254dc600fde86bfb608cd6

SHA512
54015d69ae951f2f2ff4946775c2ec8a74260575dc38a68bc2999805999814717f8c23e02f1009e50d07c0ce92f0fd635f77cd3140c4d1a63b754ec1181d2fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588894.TMP

Filesize
364B

MD5
a3e9df0e20ff4cac0bd41b6212a48b32

SHA1
96fe4c9c74f82ebe7de84c6da65d17144ca56bfc

SHA256
cb6d6eec3387b402dc4c7d3f264c8d45e46e07382cfc700fa24c7d0c808c63ff

SHA512
08e9c9a39af6420dea1ad0194bf1ec3f14efbf4f86d2f4cf802acc4d089ea422030908a55ab41dc744eb40aa0aa9dcd567f2ea05c1403e15a923564eeaaa757b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39a5a9863d90de6481f3bbe130e24aee

SHA1
783fd666f06118fc87b75e08a4149ff0ca5b33b0

SHA256
31f3e9f25974188a0a76e95045dec14653a5b40b03ea396e5dbc0c43ec0aca4e

SHA512
45b3f5f1edd25e4874cc1252fa763ca9989cebc3d4b118a3c3e8dddc78baa0118ae376312ab47cac22c1b8387d7ad7ecb5b7b0ced78a8544e712c89a30bbdb6d

Download Submit