71cb615eadba4239c8c4db0c512fc7c32f81ce0a36791264a500cc8bb35f7b5e

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1e721456ffc8f34dcd3639287675554_JaffaCakes118.html
Size

93KB
MD5

a1e721456ffc8f34dcd3639287675554
SHA1

e4700443d0844662013cc32c7bafff9b7bade439
SHA256

71cb615eadba4239c8c4db0c512fc7c32f81ce0a36791264a500cc8bb35f7b5e
SHA512

d48bdd2eb0e63f955be1bfb10303bdecf7ff880aead931431a091bec803fc7fc3794c296ba9dc2a249965dfaef4af393f1d153276ac895c3e1178a1a18715175
SSDEEP

1536:vqtMP3zTCNnRJSwDob/SGXZbmQGgmnpjdWZFaTe+vsMYekJiWxczXSn6KxcIBq/D:vqteTYJSMk/PXZbmDgypjdWZFaTe+vFv

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: QמN@ײr
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	sites.google.com
73	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
4852	msedge.exe
4852	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 484	4852	msedge.exe	82
PID 4852 wrote to memory of 484	4852	msedge.exe	82
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 3920	4852	msedge.exe	83
PID 4852 wrote to memory of 1144	4852	msedge.exe	84
PID 4852 wrote to memory of 1144	4852	msedge.exe	84
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85
PID 4852 wrote to memory of 4088	4852	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a1e721456ffc8f34dcd3639287675554_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1172 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,993827151089491015,14421355453071655305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
3015bbcaa67fcbf9c19aa26b2ef6e5d0

SHA1
a54a4c28de5a93ea73e079ca31121574ac1ca5ca

SHA256
69eed5bd7f3f664cd9c2e68ef93fe47255ca3ce7ada4af43fac7a182ee9b08a9

SHA512
c6014ca4246e26aafcf5cbb8b26bb89fadddbcf78baba5e5ca951f1925bdeaa6a46be7206186a248f9bf84f0c34e2c3754296bc9e60b99d07e6392b84e1d47c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2887c4b456acf089266f835d2a50db01

SHA1
602d2de332c1e675fc78c126edd4da7a21c5d967

SHA256
d103acd4ec980e37903f1623f44e2fcbd856c694bb4335d2e6637c2ecda79e62

SHA512
06b4b87c370d05c37e63ea7266197df9cb6c9fc8874cffa99bc9b3ccb39df99049e74c3f5c3316e194677853e96da7d8f4340bbddbb39205081f83de2f20b8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b1cbfa7eb64c5d454c389cd0194e814d

SHA1
36b1aee1b048866ff7cae21d50cf195d15979dcc

SHA256
b06e273d5c9a1db12f159feaed12e967edf8bcb0672aef60a141cc4a7273c2d3

SHA512
c8a6b723629f0d3f087b20ef7e3eaefa6902270bf9fea8603e1454b28c37d1d8de63362f70cab0362378503b55e8df1a6e193ca3e71a34a9c442bec830046902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
43446f27affa222576f1b8e94ef14702

SHA1
03047d236bb8d5d093c476f5adbde2ae2ee60bff

SHA256
6feb3a98c0d75c8d907137f008fbbf33bfa6ab2e9d5ff4473f87227fd0a70df1

SHA512
0777bc30e7279953af0815c817fb9219b162430cf039f9029b650723db566d2517215ffed225b7e4c38fb6c9965232f996aa4619e9fc157817acdf5e2fb320d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6bb7adb90dbe4e097e67ea98984b4d1

SHA1
df36d05adf0bd647c8f0f5b46cea520125f8ab04

SHA256
9e3d1921279bce1d78c9b5ac5d44d7d1a02378d451bc2f87481cc162466007f6

SHA512
fccdeced4f509930b4dc2708e651216fda423e0a153e08c1cdbeaaf9bd8e6ee7cc3030b4d850a61f2b0da57fe0a344281a2abb5d455b5eceb6135d5afe241ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea442dbb5a2111f692027d94b8cfbdcd

SHA1
f91833da45df0ecf54f95246595d40606cd8ba44

SHA256
efe395527b068c7168001c1cff231f717a5340d14ec322046c21685f5d131e12

SHA512
63f52d9b2d9754b91c97a2e87cec574287510dee6bca045c01759849d6cd4122259e0befd6d0e5e5be43f700df6d8a833337039d2d26d93a3a50b8106969d192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5ec7b8e63b73f64b6a3d0b402b475d71

SHA1
3def46b64e6ad9129253fe256b5696705a69f9a0

SHA256
2aaa71296373e9543fdc4da4edb27a1918597c1d8a2811f0ebf39b983473f94c

SHA512
37e4b4ad70ea02961e6b03aa32909594cba8efe8e0f2ae9c138371a5579f740e0702dd74ac0a40478c24bc5eadc0837df58204f12895968f498eff988216ed09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0ba076cf88a82d8ed24c158d86dc5e3a

SHA1
830557f346ca0e0fb034990611886b7c24a05aa6

SHA256
b671640c2938199ecc2cda26bef414787c114ccb91fce5fc43fb17d73dc7c770

SHA512
b203b94f6b5aacec4b09bfb6b757de6636fa29bfc8d66195ad09b38653cea7023175f549068ad63a92b5d0a54dea5ee72ddf4e02bb63d69481497fd1b7f9f454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5885b5.TMP

Filesize
204B

MD5
796114993460f2e8f39d8165cf88acb1

SHA1
52f28ad0eb2e34e7d3db1eb5ba9ce36eb2f2eee1

SHA256
4f7413ebf3fcfc13fffdec7ff995d34cd20b7006f6d7c933934ab04ab4d212c4

SHA512
7c0d4696db787ba0d97ccc78c8c5bc71aecd4184162a5ea47cd783ccf5072765ba3de82f0e40da52a0ee98db29235ce1e71d190bd9e68ac739ae9a7c4cd373c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2e524b5a6453d24a8d2e1dce857da5fe

SHA1
585ec81e9c0493c61892c1f98b4d2ead7a4502ca

SHA256
5580352fe8753fd1d8159dbe31bc5cdec34e954d5fffb948e6e844184fe856be

SHA512
22288d8be775999dea75a952d3356cc7881faea21b2968435490b14e6d748bc7f683ea1a546c26a6c383e67ad8c6e8858777477f7e48ea9c09a9ec111a8c5088

Download Submit