a704a958140ddbd4ddd0c7f0ea89d7aa8dd7af9868e4c6a948787b63fdbeeaea

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31cb7eb674878405576baa449a35d6e9_JaffaCakes118.html
Size

52KB
MD5

31cb7eb674878405576baa449a35d6e9
SHA1

1d1b538c9134305318e21e6ac6fadcac55ab33fd
SHA256

a704a958140ddbd4ddd0c7f0ea89d7aa8dd7af9868e4c6a948787b63fdbeeaea
SHA512

247dd82680a478542532a289ec555b378fd616f83c407fd7b2d3eada8113b16da6034c4664fb5b67f23d43692573acba0fcc66111ed768081f8cc681abc880a0
SSDEEP

768:DuuYzFnhsmZ6v4j/LkuQ/+Hlthfk17s5GZjBt0N929ZW:ahsmZ66Lkgvhfkdt0N9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
3596	msedge.exe
3596	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2068	3596	msedge.exe	81
PID 3596 wrote to memory of 2068	3596	msedge.exe	81
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2396	3596	msedge.exe	82
PID 3596 wrote to memory of 2228	3596	msedge.exe	83
PID 3596 wrote to memory of 2228	3596	msedge.exe	83
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84
PID 3596 wrote to memory of 4648	3596	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\31cb7eb674878405576baa449a35d6e9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,18334126615505940217,4508175234504060392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
10378a9247440d64fb9734d932a06107

SHA1
13b1fc0ea8eacb7294a19bf8ecc1053697eb1f70

SHA256
b4bc57549dcfe6d184abf96349f096b0aa4f7247ef584633be36aac4d3ccd23a

SHA512
73cd8ce9008c4687cdda8db3960fb885e4ccb85dde4be47117124194586ea153bc1d26991c7bb7d597b23b3a5b5bae14874c6c78c43f3fce7cadafb63218eec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
1b299f43ee4252afce6fb2a363148b56

SHA1
f83680297275d5f099d6259ccea0824a00967b93

SHA256
e235cb3a996ea60dedb911891d69e1250a4a152c7b59849f87919b7674bd49a3

SHA512
451e58c67a9ececcb85d524f137d6964b23637552d381320abc0b8d9ae8626099c3cbad9d6cd7eb91d2e67121efcd8ae1a16cdd52dddae54c88cef1de6630a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6badef6d6279cdbeb994f09e4c704edc

SHA1
4771d925286a8f853f3b34690564c045d8e5c216

SHA256
ca462500be6211e51b94caff634363048e99bb3eb608cdccfd65ddb6b8793145

SHA512
755fd0938ee1589cb0ba14fad1bd0b5db9888386901e290709ed3a27648238452a0bac99b71397a4e939203557658418efd527345d0e89f63fbb04e9570863a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
39c4e7a969edc0f552f0bdf25bcb3678

SHA1
17b4b7cec29fcc505089a4c38f9c85e6e00b395f

SHA256
f4bee14612d6bf6b91a5e00be6bc82ee7446810644c9167c122e00e985301e91

SHA512
8bda9b2e7a2339bf640f4506d978aa7f3f65018149a3d8ff049411262a668248de32f1f74b82bd2b1052689e73b2c7ca63f92f2656f0f9c88f2cf1485061b75e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaf4cb7a27af87f182fdd892710b2891

SHA1
0ea5853c862c6e181e422f9456be8a7f7a2e3035

SHA256
adbd4c4d44a34e2ab48760e3704fbea36adbd70507830d5689ea43ce8bbb1e7d

SHA512
849a69016d5e84f0afabebe8297155d9b4527035fcd31ffb387fb55d0be68386bf30a8243fbbaae4199a70815ee5bf25f0f38a9580e256551a74ec3eb71a10e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7a4d99c9c7a37a2774dcde92c5444ea

SHA1
7b48242edbb79560d89d004d246ee7a363a471eb

SHA256
062e9c5308fb1d8cacf21b7e9a33c5d1fbe5ac8ede4138518c5e28ec37ccaa1c

SHA512
138046a7517b6abbba727d8e440c7368f404f710e13257f27320682bc2603a393740f3961c065b64e2d7f195680a4561985c64906d2b226ec51b952eb1b918c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a44647bd9675bc18bd132df21fe42f2

SHA1
f6e51952352e8970135c9420fa489dc2ffdd6144

SHA256
89c0cbff644d514a9b2c3c38d2a15e0423e333b39d967e1e01ee6afb7b68971c

SHA512
8a122127b175521d4652e82d1c8f1e3560e5b674cf3494e1c26deb34c2c6a773ddf13c69c200608885709f2a4bc8975f4f04b84d0a25dce9d2eab9c20ea015d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
2302495aad8a7b202dca6b64b85a43d1

SHA1
8cdd4a389f0fa799c6c85db2581a3ce565b12242

SHA256
2219a10aee42b5e19cd919c4abc581d312b02d10116afda9e73e9615bd64c457

SHA512
ef0e4f2833594c623a77f640befbcbff25356afc1a7fb4929e5e9eea12ebab466923f4a72ece7dec262ec18b8dfe23dc813ab982f3de499571244476afb668e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d968.TMP

Filesize
372B

MD5
22f5dd5a7919102812d2e23aada2f52f

SHA1
4d0c441bf6f970886a9f4aa3a75cdd9efe481f6c

SHA256
62492efa1fdc93b2df82e5eb5684d552d224e6b8b126cf7a80ac146c13c65d60

SHA512
80e26cf2c1dd17d4903e4c102704afa3b69dec56e6a356e7ce8757260fe4d888b964f95fa41dc6e0f2f45306a869a78366b0aa62c992d535c48121e1df39e5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c9a1aa51aae0db89be3e94081d2d436

SHA1
969b4daefee407cfaabdfe51a2ab81009ba835f5

SHA256
3c11bc0f0760a28d269d5533597b9eaf9948b758a29aac5c7260f4be452fe5f5

SHA512
cd6012759023b053e631985f668bf8043cbbe8587064b4652d36be436ef4bd1255932e7c9c343bd89a966aa8dd46d2dacdd97b2c3817d9e185d3fe6baee61b0f

Download Submit