f99d560c8dc18b51e5c6450ef45cb755f3e06adaa72e34a31425e4ee2b6422df

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ef3051f58750b9a4e9fa833a643f71b_JaffaCakes118.html
Size

42KB
MD5

0ef3051f58750b9a4e9fa833a643f71b
SHA1

67bf97162c26c642a1d593d347562cd538c3d609
SHA256

f99d560c8dc18b51e5c6450ef45cb755f3e06adaa72e34a31425e4ee2b6422df
SHA512

653e7c33e86a3ce396fcd26feba22df06952a81c303f48036e9017a8bb87e1344213c6b2afd6fc13e59a5cc6f0ac3bc99bc011600f5e4ce95ba5086bd6273a5e
SSDEEP

768:PiPCehWWv9K6glshaGDDM7j5t+mZARkvTSO:PiPCehWYK6gls94nARiTt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4068	msedge.exe
4068	msedge.exe
3300	identity_helper.exe
3300	identity_helper.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3940	4068	msedge.exe	84
PID 4068 wrote to memory of 3940	4068	msedge.exe	84
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 2588	4068	msedge.exe	85
PID 4068 wrote to memory of 4908	4068	msedge.exe	86
PID 4068 wrote to memory of 4908	4068	msedge.exe	86
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87
PID 4068 wrote to memory of 3948	4068	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0ef3051f58750b9a4e9fa833a643f71b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff728346f8,0x7fff72834708,0x7fff72834718
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7328097482905386277,8072403295697728380,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ed316380cb0f3ab577c5f938976be149

SHA1
5a7f401ed9164f186d5b21edf09b1648b405ec06

SHA256
fca49b156a3f10ced26e31de77601a8590a37c62ba3423e14afe9d7ef502b6ad

SHA512
5dcd392e46e5f865ffd7590e3657948ed00e3e717374ebdfefabad58fde8473a56d074d4b66d72ae9917a4c2dfe1728e22212ea99aaeeac05a6a9943b25dbd45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7a23fe72d18dd899da51e5011734a9b2

SHA1
8e8e9ebee430c20d18b6692d581cb506e710accd

SHA256
2def8fe9b956fd4c6c7719a058b3d240c097ad93507211038dfe8b3fb4bf630c

SHA512
4b642282d978dee45a7e7a92e53c6195533a070b161e68de11fa992e7724ebf84ef491175b484a1b10e814b4bd941a96d9967604b92f2f6de7175e45e43109e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e831f9d518de0d826122e98469cee9a2

SHA1
b7c81e80f8363a60d6376c810d7573ab16a1e54e

SHA256
5f0422dee9175247377526827a4d68de93f9aaa69ef19e8c6966c4560127dff6

SHA512
afaf2d7a3d863f9af048c41d6dbfc392a6d015dad990b1f900ca2be90fd872d6e7447e0c39fccb584cc9929374b85ccd4dc0f1df76d5c71f5f6d3745adbdfdbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8bff32374edf9a526c9e381a2eb4241

SHA1
a1bbe9136e7fb8c19d75eac9b52111f48e97a841

SHA256
623d42775afeb7ae984c6589a29592959ba473c972a6a4d28fa1a8a489edfe68

SHA512
69f2ad71d24d25ce9ba463ca205e0a9bf4a6dd9aef74d9a7e9e4d59b4eea40157da2e66111b9452ca658a9f13b2f4c9531638b5a0a8a5ceb6447a464daa24f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f1faa8bc60b42486360b23189c43d48a

SHA1
bbf606b8372a2f5b7efbccd81c2cb332f96d8c00

SHA256
f93e5294e9dfea8efefe41bd65d1887dfb025b0b90817ae1f7eb7560fbb5a736

SHA512
ef1dd1db09d3d4d1e226dcb6e8512c9fc7b1a5cc157a9253f120e3d411a7aa4690e09ddd17f29a02eebbad17258c4513bb2f06873d179cf4acadf89205a22e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a775c36fa14ac3825b9f92a1a4db45c

SHA1
c1aba62a35b373214c18cfa61c33a477efe0e51d

SHA256
47b176d32648b53ee7285ed4bc45f859c0da580fb1908f61f9c63ff828dc33a8

SHA512
200f02b6fa08e8c08f1fac0e14fc6fd8aabb64204f91014bfbf0128b36eddf80560739ec85c8147ef04e643fc254c3cb668cf6684863edd622d0406023f7063a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5af82f94021396f9b5b0de3e3dcad4f9

SHA1
82110201457c1c9fd87bf797bf1c532528e17ff8

SHA256
430f202f8a952adf7709f45ef8c5356856a09c18dc8f457ba7f654f83b9fb704

SHA512
e3ca7f227aebb8a508b4bf36a84e01462d9b93f49b5b1b5ed99123661a99a7480120976e92a1552b08a0e9a4c3cbdd0221895d3e9355fbddfbb4612dc1b7531e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ea3ab56e04ed9f95bfd86031bdd4b835

SHA1
6225c526b1b47181c41adca87a0268eba003c351

SHA256
58a6f0838816ad763f21b2ed33ca267c9ba5db0136246129dace752c6972da65

SHA512
208efcd06e5c6758c97e454cc3af1bafa4f45d0164ac380a1bd2b9ae9079c1ffa70867ea332788498e46412a00d6a325d31892741fde2942a278747aa56a05c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cf85.TMP

Filesize
204B

MD5
d1b509924fe10a909ab3578fe419b596

SHA1
c6732bce1e3077446115e8895e1bfb211f48686e

SHA256
a0dc787118cb797524c48e90ccf6b65c759c6444fad25ee8fdd224b3d1b1f4f6

SHA512
ee0124d154d9e53ad7874b867d0c096d3537f92206b48bcc74843fa5d21dfb9ef6724ec0a98dbd96c92db0908741a6dc7748a80c5e54e64ee1f05ab97d199793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8355347a90405b46954b155eb7f6833c

SHA1
78920800d09c289ee3e494c75a1426dfb55940a9

SHA256
0a40fa25999673343d7aafbc1c62f213d429b3850606fb2011cf44ac0011df8f

SHA512
1db94e0fc2e20f169d79a1a043fe79800bad72622000fdbce31041041a197eab1c9acd11d23abf474a0e6f086dfc7e7fa636054675b7edf1ddb449bce6c91240

Download Submit