a75f8615cb2a5b54207bd63bdb410ed1f571809a5cac3eac7f481cb9702d7f91

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29dab0ecf8ebaade014c2fcec2ba4a16_JaffaCakes118.html
Size

256KB
MD5

29dab0ecf8ebaade014c2fcec2ba4a16
SHA1

c6cff6789a09d1398caff1eb1a3b47507f76a78d
SHA256

a75f8615cb2a5b54207bd63bdb410ed1f571809a5cac3eac7f481cb9702d7f91
SHA512

85b77f16e3d12dec60bd8e6cb9b0c9f64e4dbfc1d4f8aa9dabfb60ac9d34118622981c4db60e428d22f004725378eeaa4faf6f1b157db883777acb1482384b03
SSDEEP

3072:10IhC3UghtBgmSsdvJRRTw1QQMHalGhi8Yt5mmI0viE4CHXLz+dfMu2lAOoBPgKQ:uJBgmX9ym6EhjufGBPy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
3992	msedge.exe
3992	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3952	3992	msedge.exe	81
PID 3992 wrote to memory of 3952	3992	msedge.exe	81
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 2304	3992	msedge.exe	83
PID 3992 wrote to memory of 5088	3992	msedge.exe	84
PID 3992 wrote to memory of 5088	3992	msedge.exe	84
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85
PID 3992 wrote to memory of 4940	3992	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29dab0ecf8ebaade014c2fcec2ba4a16_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8103546f8,0x7ff810354708,0x7ff810354718
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6472876075098079577,9407459513004492646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
66e810efc987bfb9e27011b085174eed

SHA1
0cd37776453dff474c6b1d1dae6e873ecd6b528f

SHA256
d5c1f5045a4f2a4df239be89e346b3fcd3b2bb32d4b33d492a5f6a54ea44400b

SHA512
c28624ae5d56c2b87dbec70503e3b81cff498facbee660da3554b959a0f2cb00081a1b90462fecca5ae5f5fae949bb25e3abbb2fe266ed6c665cb4bcabe8c695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d376d55dbd1f4094baa528353a5f06a2

SHA1
68ea423d5ff1e24ec1916ed60a1c679f68ba39b1

SHA256
702af4d3cbb935acde33792fb30014446af853b895f51a54f45418d6a15caca5

SHA512
9a87a572079a6c5a2da8b9e24c4b92641c7968b2e634a259eedb83a306ddaa9a54a618bbb2fed70544784f24979e82a0bdf2653ee53df7e3e272833a460a2339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d82cd63fade5ba6fabdeda79bb10e10d

SHA1
d2b56a8b9d374da04b9a3fec499c2d87475c7035

SHA256
11e5d1241a9e42dc33c7f1de261b2f3b2cf62d59ceae33542f8e530dbe35cbdf

SHA512
fa439ebc7b19a02942db922d9680fe75463ca389bcb1715787f59a38fc8eb1bd9a248f59319802fbdcfa14faddaa747239517bfbb39876f078503789945efcf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
648b198327bd61bccf4984b5cfc444de

SHA1
4cbee12bd55bce015a78b33ad4c0f5c4c1fcf9ec

SHA256
80575efd054105e599d63d9ccf75525861579e3b7314e7e8bc9745c58a94793e

SHA512
b8b29f53888d5105b6ec88f0ecf74f7a1d189c48172232c24ebf75ec4e4d52c74afe400126a62a086f10d9c47daeb777eb37f8af9796986866fd5d28ce1b0316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
191d80e3f90c4603c6ed0a06705e5500

SHA1
288f78f625bc6c0b98108cc572d68da39b11c604

SHA256
35181bfeeb3ec8e339357a4b0e74343a9d7ff53e9d4750cb18d2d2f81fd91cbd

SHA512
bb23131a62998dad561c24190a1ba7af0fcd9cd87bc8d178bbf48f4d98b80547f875c540ca2be52782d6ae8d857c89c27743a35687c563075f28ec8c5693ab9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f41177e8dbab02791bf7b945aaded32

SHA1
6a176f4958e1f6befa7af12e097dcf5f69641dab

SHA256
8a496a963b70ca1976b576ba6c3e6e3287a47af646c4e0aa74bc02709ccc1ce9

SHA512
9d370c56fd3bf2275e0ebc7997a3fb940faec2a1ee7aa08b464d01544880ca6a5022fa109c79b0b4dc6045c79f3fb74987749483fa674c9c0d18a212381675a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c8eab5419f6414cea51ac243708702e7

SHA1
9497f3569da9c24846796eaebe191b92f03fca4c

SHA256
3fc432e828d58da1392269cd57ffc95fa3d021b4b299f93781d7ed464d1124db

SHA512
91e4ae39406e48d0b4481f5360811c27454aada859597a817e7a6979523161d24e6bdb4780bf37f816c5717dd80d146896fc7599caf663560d29eec803ffb9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a692954f65abfde6b09517ed0b9afbeb

SHA1
3d7525ed899b45a921999b83c6aab50a37459583

SHA256
6152077997de9ee594c69276f35796c38ae4f627f8818a4ab0b5ab27182d4e71

SHA512
0a95eb582958f328efe5ddd61fce316266f17445ff88c232d84f7a07452676d21d4d8f4a3848abccb0907bd5f47568254e5eb385bd796561059895baaabc74ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82327c8ee20b9107750d6e409846a5ff

SHA1
e29ccdcc3c44b275b81eb53ec12086d3079c9d41

SHA256
402ec8a8dcffc6b9ab4001b982e960edb1244776c92615f21633f903f9de1417

SHA512
3ccc18f89ed212a5b0537ef82b0977f47bf6073568026bf46420c8343dd05bfd9ee8862d71b1165852069b204784d4c87c53927fd2c17d1be882789917b7e9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
90e7680e12b4bd16a36ce616d3200b82

SHA1
4e766313c881415d32e60f6d29bc83cca48f8cca

SHA256
98396e3b00d912ca54c3ea2ab05f295d36f84d9980da4f5fe7a4fae1365097d8

SHA512
27aaf5c97290cc5c885cb3b8ebf7541412a19926c47307ff362f4d9f768c3f4846cb31d2fea15c1e5135868f32d438ac473bbf52d09694da915498d9bf074f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
fb23a0cbbc0cbbba3db073ff73f8186e

SHA1
f74196e886951d4d238fbd6ad89085d67763085e

SHA256
7bb3a71ea069e6ac0b3d1345f5a98446988d80cffc72f00040063204bd1ebe49

SHA512
64af21e991b4d6423de5878cdc0b26c8b300801314cac0ef3392c6b0bd85cba19972143ae148600ce9cb3b28d5ba60568ea64b567eb9902f34b11b1d2e65fcfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
64d263a742e0743a8abd6436fff9de76

SHA1
88fbdb457f48962bb5e6cab2702c55c8ac085b36

SHA256
47c69f49dd33f37fbd4700bbcd098d0ecf799277381f722f731fe86158ab1e13

SHA512
724167afae24a641807032051b55a543b3ae03dbf0dd1437d00ea740fbc310f4fe10244d276496131e20ded369234890fef4584a1ea0746ab29e159c201c06df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fbb5.TMP

Filesize
372B

MD5
acb67d835e1098428ba9af2c44768c22

SHA1
7a8b074353c4e42e6b45b7552841af444d207efd

SHA256
c6dbe477accf21c4adfae1b5ea6a310dc28b93eb3c49f68ca7084a1d7f3a4a1b

SHA512
9529308b6e0bc3671e8e30d94b953b8d4614f2ea0f95a135e8da8ffb32bad7c2c8b529c5e03fa639995e098d1e3221c9d8af9fad2f9dde4ed026ccbba4c7a17f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d4e1e40a71538fcf127a8a4bd7d36306

SHA1
d5c09d409e4108c46f6e8d3780610a58e3033a78

SHA256
87f10608c7e758b17079c2ef72ff369a51da132b4f5bc8aa867e4451b6edd1d2

SHA512
7e39d191f8f41d70db71ee3e3d8deb424897351875ddbb50af89b583cd0d4bb5f1ed7d8d1c969768870ea7d0743051674e4c90600ad0d77517f579570b90ee6b

Download Submit