1593bc75036cadc8d9b02aeb9deee16fa3800c2010ab3a77eedcda45f2e7f067

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aada0f34564d36ecb25e7b7694d00c1f_JaffaCakes118.html
Size

124KB
MD5

aada0f34564d36ecb25e7b7694d00c1f
SHA1

4f2fdea724f075aacca29dd2af2fe1df5566772c
SHA256

1593bc75036cadc8d9b02aeb9deee16fa3800c2010ab3a77eedcda45f2e7f067
SHA512

c8ee38579d72d30fe0aa757ff5d6c17b182469cc86cd4520b2a35804e6781ac9e8b4d682146a14b9adea10047175861c83c116c0ed2498be180970a0cac3eaf9
SSDEEP

1536:m50IA6vkY48p8QjQ3dCxMLVIatSJ+qE5AsWQwjVU:0XA/8p8QO8xMLVIatw+fAsJwjVU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
1960	msedge.exe
1960	msedge.exe
1424	identity_helper.exe
1424	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4048	1960	msedge.exe	81
PID 1960 wrote to memory of 4048	1960	msedge.exe	81
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 636	1960	msedge.exe	82
PID 1960 wrote to memory of 4428	1960	msedge.exe	83
PID 1960 wrote to memory of 4428	1960	msedge.exe	83
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84
PID 1960 wrote to memory of 4280	1960	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aada0f34564d36ecb25e7b7694d00c1f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93d6e46f8,0x7ff93d6e4708,0x7ff93d6e4718
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10121151384481828788,10472341306587379444,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
107KB

MD5
59e1e89f17e419228979af14ca0967ba

SHA1
815f0de18a98dd4fdf6c6c54c1ae57e847bb425b

SHA256
165dfbdfdf24c3e0a2fc3a85ed762a2830f0f4a07b62a3770cc8098c6cd616a4

SHA512
e4e7f271c7b2aa69d624e4d2e21c5be65fbca0ff8ceea7ede8d5ee58fdf08c90b2e6eb8cfe47eaef00a544bb6dcfd4a8a6debe21dc8a5ffbef7fa98fcc6e830b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5d6fab47467c1307d9b0941d78c5d56c

SHA1
19e765b465ed4914737513032724eb1ef22e3e62

SHA256
4631b3e18a315cd42e2890608e12330a6458040b882fb2e546014e973a233dd2

SHA512
9b60465b7859370245d42ceaeefbce5e76384c384a747bbbf6121cea4a783552c3f037134ee3639a4a7240da1cc21ceab139ce4b98072a49fc16948b77705f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
69e9d8cbd05ad379827adadac41ae983

SHA1
aa75c0d11e14ab7f158446ce41c68528f532e05c

SHA256
9ab65051d00b22d317de90cc07572dc32fea8acb9cdf69ad3bfbec952c874e51

SHA512
23f217dc4306e6eb94ec4771cb233001a2bb6112bbd55a8dcaaa6cf04505e0f0abe9c133a2b32c1b6b27f456aa84fdebb68ec78f2b8e025f96ee21993530a5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f0fe3078134a08a12e488bba5297b750

SHA1
ef9ec17eba6ad9875abd01d19e16dd370430cabe

SHA256
b3df6237df39a9bae6098748756f9917cf18bb42b92929b2430fe88adf1eb4cf

SHA512
4287efd5249a739bafb4f4b64287e5d6c5b8cd536183e3ad197706004e510907ba2b98a24b2c502608fb2e7bd7a3b5396ee5382e6e0cb37a661e9ec1217f16dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1d14f56362cd14e824dc233c4b7e5f2a

SHA1
07cbc617c628e5ec608b9667346b21a948fa7f3b

SHA256
cd5231cf19c60d0229efe22142de667be9d81592b9d32617cb19ac8d3b658f32

SHA512
8ade38214d8b0783d3d53ac2f76c643a127d11d66acd3bfe372ca5923fb0e3a3647aec617a6de2dd37c27853ed5a512e78a79d6e047275a820c15fe764b3fcb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31f85626e5f7ed5be9ef23cd4387bcf9

SHA1
88de2e15c7f5b7ec125a8453bdbdf10f6bbf459e

SHA256
85d931152b55349a3a6b1c7186e1e9bf1ff559d9888c5fec92c7968baec627da

SHA512
57927df27d1bae3a26526beabf2e27e1ae6844f580517fe79fad289ff06ec02748b3f12a18e9b63139dc0ba5498eb168c349e004cccd26e3ceb16fc213dbf97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8816000d70f8a0ff8390b2a13c72d2f7

SHA1
b13f9569b31dfe522b4bc34d87f4c9e0558e7a83

SHA256
92dd041e1e3bd2c2eb88f9ce0c50eb9d90f3fc7717c3308acfbe0fa63aac8de5

SHA512
bfeaed8a99c2b15f6e8939632d00302cbd19c4d21e6148cb9f7331dcf8f0545c5d4a9a6d7637bbfffe1baf77b340fd7d766a7a536505dbcb00277c826b870e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19c9597a1f29e9cb2e7837b372a90268

SHA1
08e756be0888c325058b21e45b5f0ae4e7ad0663

SHA256
6f4827200e7de6af0b9e9486df70dddd52cbfda36d20bd2be89465efbcc4397b

SHA512
d967fbbec164f8b845204c02961d0a81f6755b7bc755541c51449c9056b26978955c144e63f6dee9ef2c683de57e34d87a2ec9e41dc1dae07412e58cf78d4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1230f3b0a65a594a50bb4da94cdffd5a

SHA1
ccb13c68bdcc3f54225ae0083b77fd8288304845

SHA256
7f2d023d497fd5db9c531a833e10bb2f587d9f40ddf01774ee4617e5ece84963

SHA512
9ce0a5022fb66513c2d7a750ab25beaab97cde8b4f5936f0a182c28412c18b794464f51709950526dee1be96b778151cb1e8be0d8aab3968802fe05d7bcdee0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
e4c5ee924c903705c5a2d09f8fa6baaf

SHA1
fee7021922eedf7d8f030c9ac32dc7e7acd8b9dd

SHA256
fb89f92e31fa85236ab809643b85cfb3eaf112a181b5c9602e87ab9f5ee1ea1f

SHA512
02dda35f5a8adf49dbdd129f7b73d9018f5fbcba85753fc0bcf1e0fec8f2f79333501f34adc20b9100aa007624adce279066fd798e0c4a0169d4be28b9a529a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a1b.TMP

Filesize
203B

MD5
ccb4ed91486c592e691d1905cdbddf3c

SHA1
07e9d252ae9b51f9e9a275f5bdd8b6a7fd4e148e

SHA256
585a870c1da747b15d35f6ff53d8157944b71ae4e9fa5a5c336b833b92672ecf

SHA512
34541d041ef78391e77779c2b579bbbbbd6fa2298e2601899072b1627e079f089af6b5f8aead1c861bb00fd2e404b859d36436e6bef716eec5ea9de344070c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c7bece8e19ec8806f4dfda4db21b0413

SHA1
99ac30f7e3a5f37051d8e3a6f7d068f7344446cb

SHA256
717e945d7240a0a5d66a4641b1eab3bd14c1e038c4f57e6df685e014bd07497d

SHA512
229495a7db2b04659f9830ce48a08a05eac34295ad553a26c4025bb0c91583373e072e54f0c70cb92cf02b3331a5b7a24f68363a6a01e20d7636deb6c9f1ef6a

Download Submit