89ec0d432064594192b58fead6840d506fbfda5b010aca181c0bbf6640897436

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32892c32df78beabefb514f405532d77_JaffaCakes118.html
Size

140KB
MD5

32892c32df78beabefb514f405532d77
SHA1

7cee893c7675bf79ec94ba558b6a18571dc27e0e
SHA256

89ec0d432064594192b58fead6840d506fbfda5b010aca181c0bbf6640897436
SHA512

e1f0010f19a74287b6892095c1c2822da04dc1b2c43d8e5d681ddde016ecbebbcbd08d4f89c6afa7c4e4e541abcc5fd3e65f53a2d5bece7beca8d7a289147018
SSDEEP

3072:LQUUcjvG8rMUcXmNRS7tLF8PdNWrcx7uO6hmPc+:3GXmNRTR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
4744	msedge.exe
4744	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
2904	identity_helper.exe
2904	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1276	4744	msedge.exe	83
PID 4744 wrote to memory of 1276	4744	msedge.exe	83
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 1932	4744	msedge.exe	84
PID 4744 wrote to memory of 864	4744	msedge.exe	85
PID 4744 wrote to memory of 864	4744	msedge.exe	85
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86
PID 4744 wrote to memory of 3056	4744	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32892c32df78beabefb514f405532d77_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8791346f8,0x7ff879134708,0x7ff879134718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13221905780866806649,11010792953553737291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4df462e4-7446-418c-954e-fc2531752982.tmp

Filesize
5KB

MD5
32fc7388d95c492b282019accbae7205

SHA1
42dc854ee5b093f1c73ddf8762aca84368c8f04d

SHA256
e1231302f86d0316ea82f46809fd812ccfb0cc3b497e81dc233c101ad00cb882

SHA512
be8a80d0d6349ebe93e66c857ad5656cf8937c90f528ec1b0f549ad5bcce8af8ddec8cf8473fd838ad933987e97012d8064f9f28286ca081c1631a214ad26b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
4a4149dc43c1a85c92fc5747059caf7f

SHA1
a33a42f4d58b42632108e9007dfd784c173b9543

SHA256
11eb43bfa2c90cf3009526de065f43aacf6d4c9311e639e51512831cae892ba7

SHA512
da838d5db4b4ae59a7e04986b599527eda9dc4adc3c08a94bd2aa59378b1d2feafbef85f4ce285d11b70f4beb3d25ad1c33db862bdbcf61392229695a03f3e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d100c8173ff09eced2819d23ca1bea54

SHA1
de706155d6f68e6deb92a1367359bf6e05a2fe98

SHA256
b2794eab5490244c27c277a68133bdf387ba298e24ecfcb0c74d30613c7a2f02

SHA512
878c702ca6798edf8f22ac1070eba918c6af3dea69651d17ecf69d68be53e00e000eefc0191ef323af9dd458735802c69451ee10675996cfcb998473227f1d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b6fac8cbbff3faada4d74683ae07d131

SHA1
a9f864aace977aed0a446249d195f2dbeba7bd94

SHA256
c9aa4af5ddb8d960a384289b74fadc48051266297c277300262c964a31407667

SHA512
9154bddeab3431d2a02070212c58b469b4db586ae77cf344aa1626bd0601b2c0441793d4004b37ffc4df6b3ce7f71e932bec195b5d28dcaa6b7dcac90c0842aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2e04eed4dc4cd4b4759bd45a71ac5b40

SHA1
82eef8cad0a216905c233baede34e93c7d9f3bd6

SHA256
c6841838bb2e341cddbac88a8a2d81a827e2a3b93a876b082c33f62bb3a5118b

SHA512
ac590ac82e18ed107419951fefa6f7ebbdc8f6da9f07048d4780f7919615dfc8e5a261567fe6d2e1c503f0b429cd2a380624f1f28a77e96cccec052e64e2924d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
120585412a14c280c2d44760d44d355d

SHA1
23b31792643646dbf38066f086065c53268f2865

SHA256
de8945a81d3229f23fd570f973ec08ce98a04a3c8e423b2375f11edcd4f5708d

SHA512
8d16b5af42d6787ab951b9f6d269b5fcc720a4cc4286cebde6a59a0fa432529288d13d0e3a3f9b930584913d4fd2065ce872d8ecd6b5e268355654f3f794d074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80f4029b13730459eec37cf84bcc21bf

SHA1
73faa0f5a33fb0415b0bd7060029ed28334e4594

SHA256
a3c4c63e72bfea399f475522fad5db28ea00597ee1ae2065ec6dc8c36636b7aa

SHA512
9576b2a2973221c6c9f847d27eccf02a092df24f990ee615eb21b4028f685e665f9e857ee583f6fec0eb932c16986ea3c3a43946fbabb6db676fd54fc45fccfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
a4c6b2cda50098a90adbd3a51c442651

SHA1
978314084fc9204c9db5d7482e4a067258bc5e02

SHA256
3936800444159833781b2f7626f05b957aabdc4702826a5691878a908ba87797

SHA512
d572bad9a9616d30011d4ea7d7620c9fb12cc91c8ad414677a5b399ed0f41f023dde0a45c6e967876e18e6e07de867c1fc98df30d96006a3491ca58baf1af112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
fcf98e8bdde34e4af174d17349c3a1ed

SHA1
fd58bf092337657de7f67e156107bf47fc5705e4

SHA256
4b2bdb1c419f11987564f0fda776c6f9fe96dfcf036592d1c326e3cbee29debe

SHA512
4e3fb2724e3fce08bad9600c284b25e1f06dd1e2672ca6e40ade56b9d4b6a37e3c1faeeba24cb08fbaad49ce0b62dce788f002178c308da1037cd374f67b033a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580f0e.TMP

Filesize
203B

MD5
faf450f1d647986bb18b8108d5c8a9dd

SHA1
2065bc3ba6a30d70bafb1debbd270c3c21381f2f

SHA256
59ad87fb90f3fbbf47593474dfc6732632f2100a726e1fd126b673dd144babfe

SHA512
0e9afba5fdeea559420b25af6198261c5c69c95f6d711c0293c50f2723c3c90efad856243d8eec40946f51fadfe6ca748e94e1833ea1a9586ae10c8c261b116f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f5aacfdc45d1637b2a40a7617bf62e3

SHA1
7ed9b35131e5d5a5925a89b0ce7d5294e2984b45

SHA256
cba29e84d7c95abffe42a0123390664fcf69acf3660a911a214a20df233f084e

SHA512
e82af0bcbd80e167daf5d01af0fd6e8943360106ca235a48f030ae446b57c95f0ac7bb45f5e2c90a1ab6fedb4cf1ad6f656ebfc91f9686f87d2e3a102247662d

Download Submit