c5ad39ab0594257ac3c44bc7a58e2ea4cde9bc715294fa2166318216671e438f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c7e1b0010fb52e2e29a081b8b4ec145_JaffaCakes118.html
Size

119KB
MD5

2c7e1b0010fb52e2e29a081b8b4ec145
SHA1

99917e31f0a7b75d6743a1069be7a2c7deef7150
SHA256

c5ad39ab0594257ac3c44bc7a58e2ea4cde9bc715294fa2166318216671e438f
SHA512

45ec6dd184905abce66b9e4401c0152b920afd77a8769e2a8464a31ebb2f8c34575933336c1353dbbb5ae5c39b5d3dbba144fcfda575c225f4ff8c095c89d3f0
SSDEEP

3072:crVMw6TtRU9Au+eNPmgVPOHj1t8aNACKFsGK9/Ckr8sDNKCkCDbA8pKB5e:cxMwat8aNACKFsGc3

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
13	sites.google.com
26	sites.google.com
27	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
936	msedge.exe
936	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2280	936	msedge.exe	84
PID 936 wrote to memory of 2280	936	msedge.exe	84
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4824	936	msedge.exe	85
PID 936 wrote to memory of 4416	936	msedge.exe	86
PID 936 wrote to memory of 4416	936	msedge.exe	86
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87
PID 936 wrote to memory of 1408	936	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c7e1b0010fb52e2e29a081b8b4ec145_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12865010567290520564,16944164319931406052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\823a9672-27c2-450d-8c82-f769a7d4cbca.tmp

Filesize
6KB

MD5
4574043a2e13286e1f1e78df0886765c

SHA1
d94ed709e8f52c0814fefcfa8aba5e388873b724

SHA256
1f423340dee651c9895e115521df0a7b3235194327993a1aaa96049d23722517

SHA512
7fb60b204d08518b110d4a0aea4006c1cfadaded3d0dbefe77f1459753fed9edf621d7dff6c344bc7900a584055497f48fc45c0aa7ed4cd30d54d8f6bc63dce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
59KB

MD5
03f7b25d3c0dd894cd9c03c410faa1ca

SHA1
1c7298d3c58109630cc03f1c1360b4b59047064e

SHA256
fa2e1ab6e9ab10893f003538a857ab9e792cbbd2df9b7a3a5470001f3c9b8d06

SHA512
ae9d0236bde263c57c2b3cddbb925b3a124d410c9189aab42a152becc0b3c6f2d205e2afb027e6d5b7f8f4124e87efa53f58999f9701839888232df4c0b63a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
d6f40a78b62f20e5823dbfbba74dfc2f

SHA1
12da753e8de0411a12a5886eb3b6738d08793559

SHA256
1cf88f1a2263aa1287011f1804b353be2ba61cfd951ab578744f483ec2475e58

SHA512
99ca9f41492b4c415512d059a893a71a7c0f9c7ea1f9a231a6623ce846d72ffc57b5d7e5b8cce44a64de5fc7849d974dfcd2ea82be3aa626432f7448fdd7fe9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
b5cdd8a088b20117c895d0a2f0652060

SHA1
b2a2e454963ddd6ea801a6dd1fc12aff1e7f07b7

SHA256
3d0a322b7e573fe482b2141e6ebe4fe5f2f49e951b79c932facf3019b99392b2

SHA512
f8eb10451c900ba0b36870a48e35c38d9f9591605081b66285687cdf46c6bad4eac1af19f90b727c82e3acf468ac58d3dbbd1850c9fe4cf3ad67861798969f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
75ed8a227d514770abcdc0f74b256734

SHA1
ccbc0ac091c34ffee03a1e9ec0ea0acdda448282

SHA256
4dd037ed66de6d6eee8423aff5a5236d5d579c2df3ec54c03edc270d52eaceeb

SHA512
6e0e8d2ea70da7522e6416a12b35151baddd72f8a99958de1fbf6e227931568128205310446995d5c22ae95904f1395d686d8565f14b000488f17939c65502d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
560a8231abe5db4adfb3584acb0f8619

SHA1
93451a90dd500bc1f142f40804ab6a5de6d5b98a

SHA256
08e2786e8aed44688fe31d28c2db82a7bea977c7664b25e4bf926eec4d16c016

SHA512
9866a6fd66167626b207871ade4a1bce5974397ba6a54e6a35b3f0452d18ac2c7a8c29403aa2adb4baf85100464e6a92ecd2457d19b4338238726f9e9e181137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23e50cab50b9c6533c04bcd5094cfd04

SHA1
bec76a5e9043f488dfe42a38c8012e9449b04b8b

SHA256
3b74cb5f7b91f024afeb233bb77e0e37d188d048c2219ba73da71f2f4f61607d

SHA512
6994e4e9cffb1ad80d3212ae5900575b376d40e6d2c1765cbed219d34d71f307f089a514eb021f1625617b1a030f215e71de84ef0d63e68f14fa2700bf1def8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0142d2680ddc1c3ec0a8899097f50441

SHA1
0ef481d43b5433bb0b82ec16fac20dda8fa6dae4

SHA256
ea5362e6bfd86dd553524aa6a56cd8e9f7354bced476f704184708544b08bf8a

SHA512
cc83a47e5867020a974ca6a41829c6b4f231ca5ba442e9e3262601a95efc02c6599c6fab4496289a7ecba8608c289cc48e0b914fc743947e1cc84ae8fef30d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2c818a2d035551caceb02d558203ad61

SHA1
23ae96faea24a13c7ae26e8d902d41b26cf24f7a

SHA256
9008590e5286badd2832b95c3cb14ea0d5a633e6e980b628666dd1ca36b25e8e

SHA512
4b53edc4e9098b06ca6f79723197f2176e2db03a6cb5fcdc494063fde502d2c8e139431585a8c3eaa6f0a59c88a966db2eaf1da372cb5488bb750f2072fb9ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584ac0.TMP

Filesize
371B

MD5
f5a653b8600cf73885c53c9cdb02f19d

SHA1
6b4b7ef2727e4c1cde9db7c4a99f5254ce8765a6

SHA256
f07910777608f7ec5b580da94f4865a81dfd502cb4491dd3e2d4c2ae47a7a20d

SHA512
b9c58d86766d57e0ab32cc3a087ec532eeb3037c9131bec6cbfd15d5a58cf057b47ed138a50e1cdbb421b3ac8ba8471aed00247a90d7e467bc97fd764feb62a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
647c62a056ef98781a8b138378352368

SHA1
d368576c9a31d9e2f443d8b9b71a1d21ecd46728

SHA256
ade926387ec5f5a27f3d4d3c0eb756500a851bc968067e34b7adbe4bba9a9564

SHA512
bcd243f837ffa8df89398461d00cfb2f5ab09bd2a56713a14e5fa33021d1845f60b8063969fcec0ab2128953b2727b539795036bc3348c1a70792c2558899841

Download Submit