6ab3427ae3d4441e0dc1d56a351a5445055c4d04e953a141f88f571b396498c1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

261b70d3621694e5f3a881a5f166b95f_JaffaCakes118.html
Size

75KB
MD5

261b70d3621694e5f3a881a5f166b95f
SHA1

e6545f2797ffa61b158178ab793e2676d802a582
SHA256

6ab3427ae3d4441e0dc1d56a351a5445055c4d04e953a141f88f571b396498c1
SHA512

44f531c2f0e4f880fdead961caf5ae15d356742725dc1ad6a086f9c151cb4d0ef3b2fdf8d89a3ed747a0d0f04409776fa2fb054f62ed4eee54aa1b57c8d0302a
SSDEEP

768:0brJZJoagG0Cot5wDh+e7UqKiZ0KVeOLPMjVbxTdvegkC/xQWXXVFwNTTtpj329R:k/CCot5wDF7Z07OLkxThGntp4R

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
3760	msedge.exe
3760	msedge.exe
376	identity_helper.exe
376	identity_helper.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3492	3760	msedge.exe	82
PID 3760 wrote to memory of 3492	3760	msedge.exe	82
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 884	3760	msedge.exe	83
PID 3760 wrote to memory of 4584	3760	msedge.exe	84
PID 3760 wrote to memory of 4584	3760	msedge.exe	84
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85
PID 3760 wrote to memory of 2172	3760	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\261b70d3621694e5f3a881a5f166b95f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa604a46f8,0x7ffa604a4708,0x7ffa604a4718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6128790328371014456,17394570136978701036,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3fff4757d71e21d662ab133193be3ed7

SHA1
0ed8a910b328701bcc2e47fdcaba4a7bd35815b0

SHA256
f18adf62c4cd055892e23210b4cb8d137897be3e0a710f75bc6048916921489e

SHA512
e66e75425ea3ad39aad15a9f33ac808c99a4754a4517a0dc7ab01db907d2b1d982efcfc9ebc0b2518187eec89f60fe88154b4632d57b234b4810ba562570a19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
4a71a07c3478c331a281b7e712a86be9

SHA1
aaad08cd2d7875c2cd22270a9c13df14972f74c4

SHA256
65c5af5aebf8316f9c7f2a8218f0c2212b33ea83e98604b7c8174dff9a5043e0

SHA512
a874d705d544cf3b0c213721e0704153c946c0ba72bce74341748866365ef1f048810b7b228755f22ae13170d2494832ed3f4536411da5093b0a8b72b5df082d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b6ddbb53839d8406bce517977075f98a

SHA1
7c935c13010c81c41f2e14f411a9166f23350f2c

SHA256
d138d3a60db1729492179a970e8802ffdb557d6c932b7fb57bf0c19bf7108110

SHA512
4857fa54b52be9b475377e29f423af2804503479d359ce303d4ae0b3ea31559956b93c02cc364d05732fe97521fef7dd5523c025dfe285ea01aeac02bac7f296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a922080af82abe74a233056537224d8

SHA1
19cf803fee633120771d2a11a5427780dcde625d

SHA256
77b86c45271cebf3cef8ab594766bd36eca38ac03dc03cf9ddcfaef67a940e8b

SHA512
bccc00e139f4cb4b173e1a5d44d20bf8a5714f9fb5df05a49e540fe3c69e8cfaa60991757185d7de557f2168121aa2ff2cb0f39d9e3243cec62a6bedc26f1ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfe8001f9f4fa34945b13a979df3d55d

SHA1
a842ed6108a88c786c7e3ff2a36715104c30f6ee

SHA256
ee80732af18534b189aeebee521c9bc3ab1b660ef4195fae05c1c2e39a0b314d

SHA512
ea3a388f0eb493a38032a12039d4ef85d2760ed81bb32ccc211352aa2a54595e599dd864910a489c88860b3fee27215590dfe447c1411ebbc06a5be0e293409a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c8625efdb63636acd966e474d8d15386

SHA1
e0e3ee9ca67300b1daeeb33d11e3e59305796bae

SHA256
8f7b0411b6fd9ff4cacc4683972184a4ea22550df01eb71c72dad35b69595a50

SHA512
39110bc5a89ecab6dbb65ec7e483302a0792bea0994b8b464984f093249b782d9718b3dcf1271cc7eb7ae504443995e5e4923b7ee9bfff6b9a2624f3f7a1ded9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
671dacf2b9cd5d0cf6f776c562b6e10f

SHA1
98c9a378955264fe813246c6d173e3eac845e1b1

SHA256
303c8618b55a915d728d4be43fd033c2790533023ba7cca5bc146a21704e82b4

SHA512
0932236c3948003286d17d7118f25ca8da94677343b983dc284d7521e6ca7958d7c137ab8b0a34e28605a3c701aee8aea634a922848fd3c5303b50eaf186003e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
27243221a05d9a716b5f308b48890035

SHA1
8e86e01ffa9c362e44f3e1ff49dc839ff06e6b25

SHA256
644c2b8e3e15370ceef25a30780c29e092f4086d1c713adf67878a6c495e8dbd

SHA512
2ead092e64dcdda0d233d20681877af62e33b7cedf48e8b85854f4e944a9a04ef248967cb827b5df63b20f0f7bdf13c04886e0086a178e921efd498bfbe8e862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578c71.TMP

Filesize
538B

MD5
9c221c9ab6467c5a08614ab5c3701c13

SHA1
a689f8f9bd063089d3bde01448bc7e2eb5adf3d6

SHA256
4b18b07d3bb1007f7d6f4d013b758aeabfe2add59b53ad903aaffc35189ee56e

SHA512
789826bb9f07bd00d7d78ae367cd2d5851d17144072a4d289571a77d13c3a9d54d983e9e5e8d557bcdb25faa4f6c1a922cb8f0a5c938b00e7324deb46dbb22b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ccb254819b3277ec098d04f071661d90

SHA1
d12e30a56ec1a5dbf9059a78578dc1d12fa7d8c8

SHA256
617dcf70c19c691be172816f92874a42183d2c78c007dd05c1106490fb716323

SHA512
d0b766a67bebba767a0b982dd330a04d642951679b3c0cfe3d2daa090c8c254ab0f529f57437c822e63f3c31f0b961cce8a7612b00dbcc7d8c2c184bdc5fe889

Download Submit