e544729af41ffbd4ad735fcc73fd8b2097e86f7bd845d2be226e0f4554471297

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd85088dc2deb7bd5b58c92943cfb150_JaffaCakes118.html
Size

151KB
MD5

dd85088dc2deb7bd5b58c92943cfb150
SHA1

0aa2eef02c726e8a49b5d9368e837e39b23f686c
SHA256

e544729af41ffbd4ad735fcc73fd8b2097e86f7bd845d2be226e0f4554471297
SHA512

5bd0ce7e0ae32d19d18f7527d85a41fd8b71459e0031cae533db843cd1820e037a6992b1322681f1bdfec313a2eeacfdf0167fff46d6af6c99d752578646688f
SSDEEP

3072:ZglSDn8E+CoJqx3aUslHdGlDCv5C+zMzV2W5s47Mj4yUCn7bk:ZglSDn8Ez1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
35	sites.google.com
56	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
868	msedge.exe
868	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
4252	identity_helper.exe
4252	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2836	868	msedge.exe	82
PID 868 wrote to memory of 2836	868	msedge.exe	82
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 1260	868	msedge.exe	83
PID 868 wrote to memory of 4052	868	msedge.exe	84
PID 868 wrote to memory of 4052	868	msedge.exe	84
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85
PID 868 wrote to memory of 1992	868	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\dd85088dc2deb7bd5b58c92943cfb150_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9264246f8,0x7ff926424708,0x7ff926424718
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11154575564306303035,1718326814350951529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c333cff-4033-48a4-b43c-e2ced78e6ade.tmp

Filesize
10KB

MD5
ce5c866434ca7c034ceff1028bed9fdd

SHA1
64a8c57935eb7d163e505e0a99ae07c68c9d3ff7

SHA256
941d730d1a62048136bf249f5c492d78a4a5552a51a0c97a41992a8ce5972c7d

SHA512
6cf989d26efc93805985cdee85d7d334231b3f8f6e5b0a5012ee6b1267e772c60392b2db79cee76af69ba94c5ba4477feebd688ab51b75620cb0964f513a95e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
0e39950c5941abb22f27e456c0324f85

SHA1
d9c36eecf4739452e579d35f094cf64684d596a5

SHA256
59315dd63b6b38d064f5ca641611145a5bbb1bef0aa2aa6b6bde700c44c32943

SHA512
df6cafda82d9897857e8671500c309a5e1cc8ce2d7a5af11bb7398932ef4f05c70ae11b5c6e86d6a6299d5e5f0dc04a38d13a5735494c856fcaf3d9dbc27f7bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5721f966d3c80791e94daf43725320d0

SHA1
20a77232099de7a4f75a0ba6e3b023ca81197b8e

SHA256
29789360a34ef879f3ce8414a3b5440d17095dc6b45f00a344d99b318a29a8ec

SHA512
87f341ad9b06a5906a48a4c34f91c605f678ad90bdca3158884bb91dc9dfeebdaa9b8c00e1447e63bc8c179fad162ac8f41fcb0dd0f6308aa9962f5a87df805c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b4f2d5d12eeb6895c960d4bebad059ac

SHA1
fcb2dd926ed0ae0788845e433028075bf49db897

SHA256
20bdeaba0251db1f45a018730a7983aeb86e5c793bc56a4f32d465cec92d390f

SHA512
17d294fa646d8a1141b1878420e42a152467584f5d3823c5a7393b65a2ddbc5eddcadef3f8df3e657cf557337bbcde4941e3567b85f5cc7681837d060c538d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
640fdcf56554df43d9e3b0233542e473

SHA1
30bbf9f38db9be4e30e1323f9c61e6e46af411b4

SHA256
6d9d954bbf7dd1af7ea43a3c9b8728cc0c1b8b3b91ed9a5c8bcbc768cf76585b

SHA512
e46cb263474879660112fca9b3b16d070626cbc7fc3834894653186c9602ae2184a5d074f7fa7c250d7971a32928a11e060bcd94730e40c960abfff083fbe85a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63a6e393e7158780c5c8dc3a7168f4fd

SHA1
3aff58698ee169ef71ded1bb1baf5c84efcfbfc3

SHA256
468e30b658f52671fb96237ef972b58e08a138092dadd277369d85422bce9958

SHA512
a5d01fa6effda5ba64a8ab378fe85465e193477ae98950a3e5b952e3c072080d9aa24aee67c0f1f0279ae52816f9691ab6a3b162bcc481c6872322cac7f2966d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8e15074c0dab1bed5bd9f45c6b3896a0

SHA1
e65d0d9269d0db8fbdb61cb80bd6d8db6c519589

SHA256
d35f96a207547fb3167d1b45deb1a4f62d29ef0031e8464d99b37ef7b250ef19

SHA512
4f6f6f3a5b06fe402634ea0e044845501e5882d3628a8f44f865b9804d8bdb21dc194259f10db70754ba464ef905bd0896f975e36faacedefa0e8edf75b550cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
f7f577bd75a27691c5e49c9be07bcfe9

SHA1
9180147afb6aeed4475fec374af9b5705d19616f

SHA256
65523974ea8d3b445d0f4e932ee503b11298983b11488bb3cb4c5395064863c6

SHA512
e999191c932f984d297f1cb4a51f184b98e7690b41e9bbc6aa904b40e4d9b7a5165d06b94f42f1f783519e0cffaae0ec18138b09264516a6e81552b984df7dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
b03b5eb3c385f7577e91aa2d9c1a1c70

SHA1
e646ac4f5d0def4899b7f56e685f1bac96e925ae

SHA256
d110bf040b7981195db02fc4da1ac9002579418c216036edb7f555406b1f134f

SHA512
bedb28337eff34043c0594a49174b513fe07530674f9a2b7880f0316be050fee5481215141da99d68fe56188a1e4fce92f7b1658a825505c24fdcafb532baa74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585484.TMP

Filesize
537B

MD5
99a5b0c4d851ee6c7b01ca0f54363796

SHA1
fa671055d164d0388cc7c96e711b104900fbecb9

SHA256
17bd075eb24f938ad67f0826fed56336f7c0255a66f8264535b3f0ccc02b2ce6

SHA512
2641ba3284a075302e352c3d90ae65936ee7cec71f21c434739c52c873a8585173f156bcd40bdd1c2c03faac3d2904619a2fe82fcba8996d28c8656db7d6fdc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit