1c01d6ac072a2ed7ff5100d97ced85a4b1d1d6080450ef14a6b07c42de01dd18

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78501e225bb5f991d7c1ad3b74d556a5_JaffaCakes118.html
Size

64KB
MD5

78501e225bb5f991d7c1ad3b74d556a5
SHA1

60f3903d7a242187c28bf729a58d235fb5e53664
SHA256

1c01d6ac072a2ed7ff5100d97ced85a4b1d1d6080450ef14a6b07c42de01dd18
SHA512

7eb88c3a08fe1c52d1c4c0d6aa4e16a8e1f0129253979a0d19df1f91c4b15c101a16f28631d60fad8abcd58cbb6de5c55f3ea0c724925e83f4a2e8ece730a499
SSDEEP

1536:ZjzGwhEGtlNJQL1s2SwKjcsb4Hsj4gJwf1dttqx9:ZjzGwhEGtlNz2Szjcsb4Hsj4gJOdttqn

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
93	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
336	identity_helper.exe
336	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4976	552	msedge.exe	84
PID 552 wrote to memory of 4976	552	msedge.exe	84
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 1148	552	msedge.exe	85
PID 552 wrote to memory of 4164	552	msedge.exe	86
PID 552 wrote to memory of 4164	552	msedge.exe	86
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87
PID 552 wrote to memory of 1004	552	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\78501e225bb5f991d7c1ad3b74d556a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0c6c46f8,0x7ffd0c6c4708,0x7ffd0c6c4718
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6536067914752286224,16062580986008801490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3d19b803473a9c51b5228640cada2e6c

SHA1
87ab60a58e4db199ae12e72071f34fba17792c40

SHA256
88ec070472de243a87df030a3d3f74a062ca4be7e7171778ff84f0a037b58b0d

SHA512
f125d8d66a274b83cf34da9c2eff8abd354578a747500e969e95d73cf698157417d1312904a9a162d9643e8ce6552bc68ed8ad1b63c5020c2aab70fda4d6c727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6c8738dcc7521ff7409d550a64aedb8b

SHA1
b75e799a5b169324b0aa1ba936fd1afd6196f6b9

SHA256
95d6a5eec70c4a31645443bb6359da31d2333cc3796806a110f5ef8236cdec82

SHA512
0e3693b5e1724024ef90d0c425b45391de06be27596dc61363e1eb49f026bb82c881c758be60300b86dd68391c0bd87a8544e9f5fda16847cbc785c17eadc992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
329c6ac1d3cdb54b0b18e819937c5753

SHA1
71e711b4957bc12d32f5f3e4cc6225733b1c7999

SHA256
45ac836c272413f27655cfdd68846c0111f07d81c782b190e8414b1b479445b4

SHA512
4e6a9348574a0f7581994e27af43d3239a3c52a3b3d493dfb466660098cb200989f7b0eef0dfb536c04f1859d61e598e8b3716e18bd4eef4cf9a9150c0d05152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c76389332a2a9829ab3e250d5c10906e

SHA1
5b48552ce9b48ef12a02daae9c0915d571afaa58

SHA256
15ad6dfba4603cb239d65f3c0c148a7025c377ce2b1ec72468f4c74a3f3e4602

SHA512
6fc32956c1dbb47933a8f4cbf519d23014f7a892d76ea1710e8e2583581201f38bdc84ef1a10fde4085c6178a58eed148b7166e43a99854ef7634667cb87d8ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5dcacb22b02ef52a0ced11290525c40c

SHA1
4189f753e378156f0c6458d15f6f6c7a390e1811

SHA256
f1a9f77b8d2c4a69618bc64c32712b880e6eef86aad25ede1f97ed6250eedc17

SHA512
74e634bce2a85934c69c11d3d7c6e8d769d7e13a00fd4c1720bb4426d9ceedab36f6cf2c6ece91d129f12c6351cd395c17467ecea7cc6ce4615a275976b0afe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0f5215260eae1e96541927a4e56d2ce9

SHA1
31b5d590393f3544f0dc987cde618333698dc1bf

SHA256
507d569b968109e69cfc4fd466a1ed79b121afa620bc5e393f547f32fc36b679

SHA512
81d4d2aa96dcad27477b76c5697e29aea20fdc678f5e2290a8d464f0c0362f4dbe3af1b7e452a343b2a7a57d42777a77be0bfa2841103d8f6f0ddf76f36b6340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
103aaaf07b6b35728cb22c8b61baac03

SHA1
dccc5326a6f3b4487f4057abb6edc1722edf9d01

SHA256
420581bc836876ab89a4be73eef010e3f3650d6729e98597bd200090e9a096df

SHA512
b07c370a0fc707f1731e55feeb34ef92e4e15c250a09199800d85b39bcc309906291a8cb6c60db8ebd487ad0a99d4277c4715a8c06baff444f350af7ffc22e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
09c8753b008e6658ec3482ff08844233

SHA1
0f6514cf4b8de9f2412ae81910151d64e598eb3f

SHA256
2d45b3daf87064402324327f200775f838327d94256686d714ef1724c26e023c

SHA512
9b896b1d869c2a094101eb4351a4ec126d77fc0f709a8e5f9afc2d6c6e4dc3e63b5e12b16262a827f2ed6b988bc72081c646c046a918c42895bfa195c64ba93d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
771437a24250ca644757310ecd2ac85e

SHA1
50b6070ddf640b6d716c3e1a7105c411679201d3

SHA256
7fbfa377ce5abcfef64094ef46ffa871e9a9d14be86c801bdd318b37487a6a4d

SHA512
8daf62431efbb5892f3806f955a3da7fe8cc91173ea8d5f0cf30f74df6468011dbacc087c97710b29965788531a7e88e8ea41ffec56c84c373778206c73e767e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7794dfeb0d434f47e8ec135bf7108623

SHA1
d40781d50fd2c3d587c6aac4fd55aff197c2e704

SHA256
45af0b9576637ba85c51d39bbd0e35a55b8950962bf6b67b837d59ee4165964c

SHA512
59d8edc1531f67be6d6c6151415ecf268100e54166a37d2c16ee53811bd86e1a24996cae43a1b03a1f98188c8420113fc6d897f8952cf766b230bc774c12f835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ca556356d2f0f611320392cbdd9e5fad

SHA1
fbe4201723ce9abe71ed0d9fa8c048670fcda34b

SHA256
a330a410e21f5654a420cbe0a3408d91cef6105ce9b00c3c294824ae1293abc8

SHA512
6d9834b1a005bf1e7f40f697c031e4b4a8505d7e2feba8355993378986dfe527f03f41693486e98e24ef0149216ff6ca130800d55cfaf638a57fcc5c6c8e91c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58606b.TMP

Filesize
706B

MD5
e437864d50a336a1de27e2b50571500d

SHA1
27963482415996c5c09f3326e7be7e11fc2539ad

SHA256
abcae34d1aa56cf867840ebe0062aa4af6a46a7838cf4cc5116c5eaa9006dd8c

SHA512
673ca8ba9f34edb2a4ed408811d9b88e038467687f3a756b0927d5677bcefb7f256dc806aaca19bfb8f43ddfbac0f4dcb4c5637d9969ee79df31c5733ac5ec68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd63c144c0db7c3666f7c1cb20fafb81

SHA1
ca663ce01d20212079f9eec2fa7e1333bf8d7171

SHA256
1327962ea356e138049e49351e280e818d1e24bb26cc2635fcccb03a49235e56

SHA512
908cad66e793f8ddc5c7d01f128b375ec10a2992b00889f06b8363740a955f06e9aae81dcd70412701017f7322831f72d902dcef9b21f5fbd04608a3f750bfd0

Download Submit