af2816e164f39ac7b4174cbdd8de09ae247a6461bdc669f25f1b02de29945a27

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabb6cf0d116db20ecbb56fc183bdf97_JaffaCakes118.html
Size

141KB
MD5

eabb6cf0d116db20ecbb56fc183bdf97
SHA1

9c432bcf63f4fa9bffab801fffb7e2ad05193257
SHA256

af2816e164f39ac7b4174cbdd8de09ae247a6461bdc669f25f1b02de29945a27
SHA512

46a016bc0d250a0b7632676c18fdf5f1f513a40fed10be3e842609f379b221726410b88486ed5dd74fffcb213377e329251dc8803f05a6b488d5eaf797406ac6
SSDEEP

3072:xwW3tCTmjdN7/WivJziFdZ7QJ6raFI4OvP+oiNSwDas:xw4XpSA

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	sites.google.com
21	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
3736	msedge.exe
3736	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3724	3736	msedge.exe	82
PID 3736 wrote to memory of 3724	3736	msedge.exe	82
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4736	3736	msedge.exe	83
PID 3736 wrote to memory of 4112	3736	msedge.exe	84
PID 3736 wrote to memory of 4112	3736	msedge.exe	84
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85
PID 3736 wrote to memory of 4076	3736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eabb6cf0d116db20ecbb56fc183bdf97_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffff79846f8,0x7ffff7984708,0x7ffff7984718
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1808215322304576863,8835889098448512790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
32806601fe8c7030ff491731d3d0db56

SHA1
5f3dd7553e7c08954746ec8903334be9452cf70c

SHA256
c94bc16be4fb253e224935ff1fbeac9f990844c6e63aa060edb0292e66d465d9

SHA512
66729fd9a99edff16f6877d8be89eb3f54035e04ab2c4d98cc3998a0f41aef9cc8c8de66406290abb09aba13a4f8245a7c1e85d94ed92c6582b78e015b3f132b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6c9dbf159dea7ac3e84c47a2a4ca110f

SHA1
b2232f1bfdcafeb4881a2c997b60c03d6d231545

SHA256
6af0f0fdd532eb4e2fb3902d78925050f5a8fe383358c55e41bd1c260a24f7a2

SHA512
d8a66275dea225a431bd3e5cbec112f9e4737c93ed1f82a0870fd151cf9336a05c860d3fa1f1075c69c542478031ed2eb14ad6ac8b5fe3d44eb9e654be1182f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0876cf03b248d12de7f9a13eb71446c6

SHA1
66ab06b2708409faa23cb2ce3e2f9fd1eae5e702

SHA256
373cbc7e497047cceaa7832e8914e7ffa4650c2a8b78f3131c9618b231abb4f3

SHA512
62533d83a1010f36f6e09f07a0a5f7bfd451d6c9c67b8f4fbbf90906e8bf1f49b633a95ef24471bee400b314dfe206ba4dd26eb8fd37df0dc4a511abb87668c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f9f6dcd2f541259b593ab5e2563df8fc

SHA1
7507c4ddb1a5264a135a4532632b056f44dd0d8b

SHA256
d74731f1f1089cdb06c6f64e2641d0525e55210e283092527ddcb67202296e6e

SHA512
d98cb826caeda0a5ac5565fabb8fcf3973ef207c3160c77ca9d7681e710c9de2470a1fe71d133656b3e40e5df49cd990cb236afd0f424993c06f417a0baf5240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3f2394cf275fe08d3de6742023323ee3

SHA1
b363680bcd6a4d7766e618c4e602c2bfd1e460ea

SHA256
04e9fd60abf808994154613ea7b44a6568c4d4b14270648092f925e9900981ec

SHA512
7f95d0d965a86c0c0ba35ae6ad5353f8ce94207db6bdeedea5bab36f8287390aefd42362bb2a055c92296bcaeade23dd70c6f5f87e9e9fdc4c9f0ba6db52685b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc577785257b4cfdde3205072af9eb2c

SHA1
531ea984f9106237e5dbff937588402ed5c56e61

SHA256
25cc7ebfed594ca1370ab28d4cb89ecc12017619b940d52a55473de80e19e0fd

SHA512
3a3a07ef87e1d07ac2835c617b58a8b6a5f096940bad230e37fe18512d7be184a33581b036d8428035c307b447070471773ed58fe56e587f25c5db9e487d723b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
92ef0f9db01cb2aac3e4e0c5aae57510

SHA1
c7e6131faada84e12f1acec4147b5a7885d003f9

SHA256
7c94bbfd771f2903fafa5dff2aa95a0056b8d3846a3f7064f6e7a1bffef71c9b

SHA512
cd21c39bed047ca362c0ee2e32acec13cf2c86549378e6f910c814092644bff5037b67381d373bca6cd610d75409301ded27f3cfcccbd1645ac6a72223066354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a09adfc3c6fb478da408ed1bfa37f895

SHA1
5f5819e909aa48a633722f002274729edbf37fe4

SHA256
bcbaa00d2b2a8f197f9ed9e95082bae550feffdbbdb5931405e32e912a5cbf0e

SHA512
622ebe00aa993c153a16041a5432d90ee8551f2450df4fa16fe31dd26dd738cd750810ea1936456cdc80b53b15691d501d9696ae57e28a5a97cf4089b55c2b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47ca7aca4463d9a89b962be1d65a0a1e

SHA1
45ae1e8b431de5d661b360ebd47b457fb1891d98

SHA256
fb4f3e95e30f8740f28981407155184f947340202cb04571268540d7d3fff83f

SHA512
f203e95593e8b978926f10e03be89be13bf209cdbb0155a25ac9c7084226204002ecdbf9ada407c3ac172c7edacaa2ecb8bb130921d59c0eef7be4621ae0e7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
68932412bdbc808a95ba7cf126e3f8a8

SHA1
ed6f27d83cc658d33a5db415b3c110e0dcb1cb77

SHA256
84dfe7c96f30ff0685958ae0a67f9665703925a368ed174b12f1639c27f85915

SHA512
6d359397eb977ae038414850c28638c22800063d626118ab65d941702150d3a66e66ab19a405c97f95c47d3e6880ed203fbe49991d9d536d714920aa8df8eda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6412db744a73d775f67fc758e6830f51

SHA1
471ee318d276b26d3b91b1c7c4229e1c5bf5fcea

SHA256
3ad6bb09ff5d9797029e0c396e879f24c5bfd4a1784ad967fa43dce5eb062382

SHA512
963a15149604c653a4361e3d1961f3e1521ace1ff77e988f2b60ed83d53a5249ef6032ad617c81331fa58e39828a311eb3841afa51f17257a01a9c4de0e12076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5819ec.TMP

Filesize
203B

MD5
6a80968a93d8f8d21a05e06ff4558d05

SHA1
26bd5de385c2a3d01e3fc4183f3478fb0dc1ad06

SHA256
c47247b0b38140c1e332f1f1a61a9735c52bd87ae1a4ecc63677925a1113d85e

SHA512
0674f53b1cdb598a58623e515d1c72e1f4169f1626369727847dcdd825e0b6352a05534932d743ae4308ae3dc4814abf45fbf41bf14c52a3657b67de2ec4fe38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fee388e71f4513fe330f12bec3f06241

SHA1
7cfcdf86a75ce7c648bc5494262560519660c326

SHA256
47ecc17f0cf231c4c2026ac6f603c6c756370f6ffaa702cbd01c213422312ac8

SHA512
3a422cd52e4518ce256cfb27a3344cd653c3ea80109e313ef355c201d25b2ff9f7a89a5b0bc2b3e5a0295e8e90a3eb31cfc0b3cb0012d7a9f6ee19c8a6542585

Download Submit