1159761b12005cb9bba5aaeedcc1411f47b06c13ce3bd9bb68ca4dbdf6c4ae7b

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61bb14f529fe0ed1e4029e2d88396282_JaffaCakes118.html
Size

167KB
MD5

61bb14f529fe0ed1e4029e2d88396282
SHA1

0c52079b450df517aaf364f600c29704af04abff
SHA256

1159761b12005cb9bba5aaeedcc1411f47b06c13ce3bd9bb68ca4dbdf6c4ae7b
SHA512

7f12f6b3a9b4842b732d7c74e32a90b0afc51cad57885bb2ff83222a6435e5710912d11f3df970c18d0b5b062c4ef799aa16f050881ad2dcf81e4a2e8d1df99d
SSDEEP

3072:uvaHtY3+GXlMPbDCEQNGN+tx6DzifhOP5I:uvaNYuGXck

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
2944	msedge.exe
2944	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 952	2944	msedge.exe	83
PID 2944 wrote to memory of 952	2944	msedge.exe	83
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 2952	2944	msedge.exe	84
PID 2944 wrote to memory of 4368	2944	msedge.exe	85
PID 2944 wrote to memory of 4368	2944	msedge.exe	85
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86
PID 2944 wrote to memory of 2612	2944	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\61bb14f529fe0ed1e4029e2d88396282_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a64718
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15076226900190629514,3269436980584758265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4b26c6646dd342404e4c29494070c031

SHA1
03571a5b684dc1765ff7581938ac41c285e1ca80

SHA256
652f6c84b109283b919631677c2deb200f4345d6fd3f59dbbb7a98f7369f5abd

SHA512
8824ebbdb95c0ae3304d56a3bbe75d073f42206548718e7b6a5e1dc9411138f7a5f54c1446f2eceaaba78b69b5aad1353a63c2d34565cd21ddc864dafb839a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
3253167685a6793ce66601c5d1d0cc61

SHA1
f73caa69360caa7273a569f74e0225cd4878c6be

SHA256
b352e60f4583c2a9b0bdd6830243b25d83636c8b93f0ae412abee6030fa72a75

SHA512
879882b8e48337e3d26b057fdac4d7cfabb1e8a145ec6ff7eb6fd9b63c7ae5586487d072c4b726800027ca1c3f9de7f8ba36d75892554fa49a358cc5935df001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3f0ae37ae3a43a8a3f1f7e9b55a43265

SHA1
cc2428e91edd82f5165bde4da973f789b3a5997c

SHA256
c513b954ba3fc8b8aa698d0ecf7688d67fba8171975590972164288dc2a19f9d

SHA512
41370cbc1b74550453035bf049a3e23f75117d840df68c93cb14b8696c46abf017a8c397cedbdb7f5bb6b607b9fdaaf0f83cf4d3bf660a2f596cf1cfe872d34b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
162b0d96296e4bbf95895de57436210b

SHA1
584eaae41de69200a8ffd620fb18ff3fab3490e9

SHA256
19b326f3721e3d173f40d1d268fe3e3977d1cea60d13e1f6babeae04574ab6e0

SHA512
6636120be13cb45135cfa3c99422c66fcb51713ba552ac06b6b1c3227479f914f118c28f17117560a28eadfc5ed8701367c99b9c015938ce32348b194c15b8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
075a2ced170294b3b3a3ef5f1e6d0038

SHA1
b1d257bea0329694ea0bb36ae5d4f6d0312fcb4d

SHA256
62b23d9b0e2daa24f9abcda84285024834c19bd7568fc06b482f84799680c566

SHA512
92660957e0fbeae461abcb680969aafd7001be1c6586ece4cf0c1c177ec6777184714d8a724d2ac01f5bdb5745fd72f275fa1b91b25528880025c75412f4c9a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e30a43dfa99d15aa8c8ca97530daee6

SHA1
b4623bb94447b410452bd83e74f8f2711286484b

SHA256
31b73bba76fef6def5e77442b99a4f5e6cd24cb572e445310c17debcc4cfe0aa

SHA512
356b1256c4c155df1311a5cdfc6c48f5b21185994ab6a8c01069c3da196cf34c3d0134a4e21dffc4046a9d8cf53797ea24438dbb8be8a0e3d7fe8a5a03c353f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
680db443d81537277258a2b4d7a04190

SHA1
713db9864846c790601f76b72e6e7eb9f043caeb

SHA256
891c804e82ef6a8b64aa0a742b88dda6609299435fa6430b8aaaf021b8b9cf06

SHA512
bb51865fe26983425f6d488ae6349e0d0490896b1ac21cc093ca8a54c363308733f08dee9b4485edce49be00fe68daea45ec4e15743f29f696db13b8cc7a1e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591989.TMP

Filesize
204B

MD5
1fa62a1d7ab9b3a9a90bde33ee8eff66

SHA1
a5be0d145ba3a207c202788c57fa1938c9788884

SHA256
cbb05b45dda1023bbac07446d449d097bdcd50d92b2a559dd75a0a0f1acd4151

SHA512
4caf1c23fec3c8f4f080a489cc777b379b721a68c32e351550f65d1e3b7d35f0e5b5f33da3755f81c299956ec37eba50867fa894e2d56ee223212c7d7dd056a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e7330a6b2dcce69d9586b05b9c462ac

SHA1
8a4a5c883b9b16072adf876c579de25b3180e5a5

SHA256
dbcc967aecce34bf0ddead100118a1e023ece029bf581d89169bb5a37fea33e2

SHA512
ff97d8ae309ecd8f8dbfaf344b354ec376a097d24c3ebdfeaeb22a8470f7fe4dfb80bdd56794f318d78e4e787c0d1f6c176503472d8573abb33228ffd19908d2

Download Submit