69732b1b4def6d7843e04da0be3d818523b46e45716d18eda0a46f8a52b87b23

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a970608dc7090bfb10dc9a43bfe47eb4_JaffaCakes118.html
Size

49KB
MD5

a970608dc7090bfb10dc9a43bfe47eb4
SHA1

f8614ecb82143d803840746fc735323ad58758db
SHA256

69732b1b4def6d7843e04da0be3d818523b46e45716d18eda0a46f8a52b87b23
SHA512

1acad56ef5f579ac7ffd742ebdc94777019a995569e79f6b3fc2a6b3859ee48a77cb2c272868714fdca6bd7bbd2e951d3415508c3db8a4ee9fa80b566adf9c1d
SSDEEP

1536:buhrtx2542E1O2o4yUah6HLw6iGvD/gRsASH4DYzak:4n001OjUaUHiGvrgkH8I

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	sites.google.com
16	sites.google.com
17	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
1756	msedge.exe
1756	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 372	1756	msedge.exe	81
PID 1756 wrote to memory of 372	1756	msedge.exe	81
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 1496	1756	msedge.exe	83
PID 1756 wrote to memory of 2276	1756	msedge.exe	84
PID 1756 wrote to memory of 2276	1756	msedge.exe	84
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85
PID 1756 wrote to memory of 816	1756	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a970608dc7090bfb10dc9a43bfe47eb4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaab146f8,0x7fffaab14708,0x7fffaab14718
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6772573504045813131,3151680675366014102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d5be36c2d954a09eb5508ce619a53dad

SHA1
5861d08a3ce722f85f9111cebb23a21f8f67dfd7

SHA256
bb83e4b5dd7e2a23e663ae7cc9275cefed95f85a5bc0d4a5aa57d357e9406efc

SHA512
e57f1f17f5ccac4f92e9ac9c0244e61332931bf377930a6496d165420d4fd44ad3bb5062accd3e0c08ab3017f09e4e5d86aa1e80a3baf2ded24e26a357b40bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
37f87f744751239b687f2da218a6fb08

SHA1
dd1d83f05fdd1b5b83f02ce85d28928e5180f65a

SHA256
90cbadd0b736107fa8ad4956195e532889fb6212c8f7a4abff467802f6462bd0

SHA512
8352614dbe8aace7ddac524200d565be1d6fb430b7cbbd91e868e44584448a4a5fcf4a4f2295e2f187804b2f59d63812b1d0d656a3d333def2c568f917fb50df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6c9a895a0ce999c7f05b7cf3a8daa453

SHA1
7156619e5a07471966c20ee198c80bc61881d908

SHA256
f1dfc2c81293a712addf1c000daf8f79dd6094b6e4fe7dd7f16bb2936caa30ac

SHA512
88c82d4992f2650c1d8b25d6cc4e55a63974b4f8471842b6c5403b3374071f7ad1afc820f0df94c5555c4a268d22f5939ace918667ff8d850674a42d30e0de59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9df940f511c97a0d82b112c56e605935

SHA1
a6d83bf8c718e2ad903b3902d5cd3379f1cd937f

SHA256
650bb5350eaf7946feaae9004aedd71b2ebb5ae3d3b09e24409733e665845d8f

SHA512
da5e1757cd4d934f763403f04f1a7e61d6377ac2ad93217b931fe79b58f00a13a70429acfe5f4e79d1ce74b427f7ef44cf9138c504d09234a5f5efe8efee7253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3fb448af6a71025fffe10ea283215159

SHA1
31409433e04db1e809d31320b8810252de60e4c2

SHA256
89ace92672e7d9da03b79c19b79a13ebb0d509f666d3b930bc7c817fb85a7be0

SHA512
9d6111ee11866f5a83a51bae1d0c0ed31231e2ba9f79e3cc63c79c0e1c7d80414fcc5f4511a7d0427eaf0ef16164c852962e352a35a6038e20ef32f1cd038421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0849c13d2fadef0b7825557e94becf37

SHA1
cafbc202375142448403ef8c667d26ab4fd941b8

SHA256
0f51f387b8b66ec436f779d8fa82b3bf7189538b06e594ce76edf1aaf9947ce2

SHA512
13b089b0362e235388b26de4f04536fb357f23dadb07c6a05a95de17c7c207dc284470dad8722723dfd679ba725dbf6e30f5c0894c7f6e45003bee37bd6b707b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
7f77571240a5c1428c965b4421551f4d

SHA1
94d175a261ff9677b6a962dbd3d677ecc0428e4d

SHA256
dec4490013c91192e29e24d08ca6445604aef174f9f625c5e1e9f565444874a3

SHA512
ee1db9b9209b55ea93c4c22277ef4a6fc99d98b113c75c8c566bc3600b702e9bf2c60262f79ea215d95331f87abb224c0d7fba9578d409a654b4adaab275c1f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cc39.TMP

Filesize
371B

MD5
30bb31f634395293cb94fe836aedee77

SHA1
7ef9068fe19f1493aa40a5d5fbc0e3ff42a30470

SHA256
c2bb86475287e299124e2ae7c7cc83c6cbdb93a7b68afa211fd81cfe81a1117d

SHA512
6340ad1246e9873d5a64e039946ab4cc338b0f319fdd6e874202a12d4454e994666a8cb6bda1f4ec5ddab293056a3166a46429194f5e6e7bcac1ba5b33998ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0281f83d2c15fb63d0d97729e560ca55

SHA1
cf61dac67e2e5bf6862e367c1f6c3d996ca95e23

SHA256
6580b3c9ce11592c9b42e57837b71bfa5a3d05c91753df1e7a2c83fb08f85ae3

SHA512
951e14f3ba5683db919177b0027cbd5975f2f60559823974d1c1d0c7a56e1058334dad45951bb28a99514f663ff0642db309a543406ebf40043e78335d4dde43

Download Submit