fe2986f55525ed6e22c0dc9469cdc95948d6363edc834311fb39c0f21774a2ab

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b48aaab94e3135db7bf548444e68de17_JaffaCakes118.html
Size

29KB
MD5

b48aaab94e3135db7bf548444e68de17
SHA1

6f0fdfcb93fbfeba59bc860e94a8c98cd427759e
SHA256

fe2986f55525ed6e22c0dc9469cdc95948d6363edc834311fb39c0f21774a2ab
SHA512

6d2a09c63f1f190ab8b01955e876f60b791a0d8585760a3dc4fad6da6c5ab31b1fd37da79dbb2d2a6a03142ab176c52fbd675d27ab0c0d7beb24e79feee6750c
SSDEEP

768:C7NQapTBacM1UomqJyCT4eK0tS0+vONgVzyNROtqI02Sjb6iXpryts:hapTBacqvyIsyROtqI02Sjb6iXpryts

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
4596	msedge.exe
4596	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3632	4596	msedge.exe	81
PID 4596 wrote to memory of 3632	4596	msedge.exe	81
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 2472	4596	msedge.exe	83
PID 4596 wrote to memory of 3252	4596	msedge.exe	84
PID 4596 wrote to memory of 3252	4596	msedge.exe	84
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85
PID 4596 wrote to memory of 4060	4596	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b48aaab94e3135db7bf548444e68de17_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb41c546f8,0x7ffb41c54708,0x7ffb41c54718
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4338601566791964417,4792144799071253652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c1cca0d38aca97dbdf968d967875ead2

SHA1
c275b753d95346aacac5aa17b59991b25dbc6abb

SHA256
80098a75481941c84c1d21447cda2bc017cb77179060b631e876938fbed1de02

SHA512
73a8645f86cd71840a603520b531d1f2a91f5d9c695089451fcce58c328352ea5904f3afa8d077278ab636ff1dfb408648ca0c8d7c8f54ab02d4f21ca4241f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
a5a006a8252569dbe7aa90ac50b83f3b

SHA1
38c6eda0e7e5fb5b0c3de45c43d78e7764894db4

SHA256
249f609e203c8d9e9fb5a90868158e16e51ab2192642c29aa05d9a64f6bc3786

SHA512
2e977b4589d9b43f7a20b5c53a1903599a1f8f29ebf81398a22ed16fb8dc527889c551285966e9180277e7b94c1d69e9baeb802f57ce690818efb340bf9ff566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
c67f8c4171eeb2a6909988f1473e4f0d

SHA1
bd13e2ace5a21f01e25f3a60648e8a7225820fa7

SHA256
271655671c26d3a0b94ee0237ff5d7db7784a3b2872882c04634ab742bc78bee

SHA512
9305a27c09beeee15b8fb776c8e34c3411deae2a6681b8d19066b13a99a951d181b638d08452427fcf015a64b04dd78a5a4aa7d8ef668d5404edeb2d3c55e621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c7326dd844604a1e6b694ef0b9194a99

SHA1
6a06c3d2665bf17f80e80ec58e6cbb205e909cbc

SHA256
8b360196c70e1f6257c6a4a763aa9750949564c876130548943370fb0d74e8af

SHA512
aa2b9bf613363e477f7f00c7029a4fde0fa7a27b8b6eeefe856e6d6ee428d10ad8ac42066f9e8dd607bbe1c46bd7ce9242b4fab2ccdd74073066f5d71cbce72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
320d7b81ce32842374e2b3f20559bebf

SHA1
294f75d0c12a13e221674116382944353ff57666

SHA256
acd26abc407121b7221f57e2f5d3c69cb27f73d549d8a5a042e722c6bf733222

SHA512
fab80e590b3873a7a2ba88310d43647fb2a5887cc9fb3d031696031351d37cdde28a99083d359822a7800230b266214b4f856e4c1b4fe79d572e3d2aa532881c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5b4a0f0e0cb47403493621438400934

SHA1
555d35a58afd525aa23694f386115047e2f5d4cf

SHA256
8dc33b8e8fa256ba33af76db8d6b4d020a5872e3eff9e5d130ce131848845f46

SHA512
0e47c3b515d8be53bb0aa99b3b08fe84f52c94b33d9254c7d3efdb249d9dbe18059590d4858c78d1f283246c7212950e52ac5adfe32016fc574027a422374146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0bd624c79caa758d9d1073ea77f7c7cf

SHA1
efcc44b73a9d85d36f4b2d691108f2234337dbfe

SHA256
084ced639ee23bf3ece2d9c68142d1b04ae99f80626813482ef91fe8de1f23a8

SHA512
fe5a4c19508ebb8d5178411eec072281d7d536cb309e65b0d81069dbf1e36b25f663e1ad71bdc1a23b6fd968e5875d0c5ca2e3c21f02bcda11291ce831fb626e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
02ae0a540c502b30fdd600db2e38188e

SHA1
005267ce4d3e646c41f78c203ca9d141410aa8b8

SHA256
2aefb06f913607ab0ec02259469faa47a94da9308c38f65e508499cc0dc6a69a

SHA512
4c982891552941c46c81437555152017f007cc8a8aa363ca36a0dd66e73938461c803e99162955d3c4055f13495d029219cb850513b66cc8d919149448f5e042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d78467fcd204f7686a048a5f13436b61

SHA1
a1dab5eb15952ac3c12f788a16aff254d396f24a

SHA256
6410bba1e84e53c7e7ad84688878a7ce5b5c12a56eb19873a0f2a528a4751ee7

SHA512
9c2ed92acaa4c6095dcbabce9bff0000e2eb32914b57126c375413c2c0170e7f187f2d6ae113990942e52c4bce82e373857a43eb3c3102f0da0b0bdc3998ad0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce1d.TMP

Filesize
872B

MD5
06e763acb045ca7466286c4be925743a

SHA1
5696122afd87751bd6ed9d3a181d2d6dc6859b0b

SHA256
bbc3eb8068c077d80b366422cf13b77b7515e500e6484ca1d05bb378b2c8e01c

SHA512
261b9e398d500740cb9e84766a9959070aaeeb91a1548930565b4cf933ed8edbf560ff6aa2e1dd8dca6b20fc32e86b535aadd4df2ed89987a82a281e114e74d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2840babbb779d9547c2b825d75f5982a

SHA1
060226ff02d46e8b138ad0f25e34d2d165dae6d4

SHA256
94b13b4e97f62ca3f656168ff8061fafff99b4e0376371661dea9e846a076600

SHA512
d653858eb2b8f4ab48e9d9e0a5222d0dbc3bab8d2aacd65107fcab3b25bb455317421da7f89860b467c451b9dcefbd73a22043815c13d580be801131b5db336b

Download Submit