d45677cd96dc4f9a45d09504b1921f6f763bab15b6b8033af00817ac109bc374

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67c5ac06a12c2ab4275c7cf04331d6e6_JaffaCakes118.html
Size

122KB
MD5

67c5ac06a12c2ab4275c7cf04331d6e6
SHA1

922ab23b18fc805f5a04ecc80dbe03daaa31faf3
SHA256

d45677cd96dc4f9a45d09504b1921f6f763bab15b6b8033af00817ac109bc374
SHA512

b5cc294b850d483037208fb61efe07103bbd8f5d1052687ebc5dddd8b4944e26b70e6f74a3c6be176b29fbfb99a566f2961342b3c24999b14c2966d52748df76
SSDEEP

3072:WgXHShorhodbnckaYJNeMcTfgrvMZOFYaiDFNajISZOFEtAUHUopiLFu6h/igX2D:ohorhouWsvBdigXS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
1396	msedge.exe
1396	msedge.exe
452	identity_helper.exe
452	identity_helper.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3964	1396	msedge.exe	83
PID 1396 wrote to memory of 3964	1396	msedge.exe	83
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 4908	1396	msedge.exe	84
PID 1396 wrote to memory of 5064	1396	msedge.exe	85
PID 1396 wrote to memory of 5064	1396	msedge.exe	85
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86
PID 1396 wrote to memory of 940	1396	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\67c5ac06a12c2ab4275c7cf04331d6e6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c046f8,0x7ff810c04708,0x7ff810c04718
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17723473254508742461,16464732501357211242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
85a3284fd468c4f521f3e1b566949d81

SHA1
5003769d91049df5618651e58b992996c8ba2ca9

SHA256
ecede67a43f33edb482c3dae286efe57e0fe815ff45c134b518b12738b303dbc

SHA512
93a4d2067e115befaddafe8df03f385c4c9e4838bf22a4e4f35bc035e6c00b5e0404519afb59edfd3c95bd5fa82eb9808f4011889f5f564c764558895b06dfe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2833d82f22adbe8aa09772b2ccbefb8f

SHA1
aa09469e2083fe6ca4ac4bd6a54595c5e08fb66d

SHA256
76330b57dfc56deeed1f731dd760023cbe7840511e13fd7bb6a252135e1c6848

SHA512
c73f7d6712a2889f91c6646963dcc1c234873991841468f62d337514ab37d09cfe5bf23f81a6c35a436fbc5c9442d5b735a0ea148fa6951f170d7170ed60196a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a939fb99c992883de168fb8b53fe3e82

SHA1
a2580c9cb82d8b9de362202e444316df4af890e8

SHA256
b359a997f95c363e471d7933edd55e8b8914765e5a7b7eb56b26b2a6c4723e02

SHA512
d053ae2725236bc389b84d5a3bfaf3a28858ce2f2ba27ebaa190270ef03ec4e2428993cdbb06d460f2e0df321c3065fdf79cd142e07c94c89667fd698e182416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
93e70494bd041cf8ae628ac1b5719084

SHA1
77bf67b108cd964424aff45c644ba75e4897aebf

SHA256
97fa6054152347182e0805b5901750699840b0c16a63bef69a72e4cf035f58a7

SHA512
de711049be24f4ad70865c3bfb6b18492fb438731bf39d0fc9c69181ab3de1c9906ba723083cc819c713d41494464a7c663c380d15488dbfc83e7c05f4cfcb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45e3eac66eca05de446fd7372953247b

SHA1
d013635bf4af85d824086415ae119ecf8ce6ef22

SHA256
48cc40af7e6a9b73f06ed04563e051b4674dcc163d32eb02f7fe4b171b60aebf

SHA512
ed8269810c451335d71ef1c4f81f0fbc8469b0574fa65ab17c328fbf0ccb23eca0c62d855ab105560421946e7f509b46e3edd3df6fcb63c11c0339bbc6f9fb83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e521cda570cb0d7e9dcbe6f82309a562

SHA1
d44ad690b4270fff9018414b96ab1f58bdb20da1

SHA256
812b8841e12b888c5c620b5728ac5cf7c802ea2d3325c9e956a821837588b00d

SHA512
61b3973b5d0f7df15a3f781da65e950007611a2b3a0ff2e17f74ca1a472261eec66e37e35d33f3abe76d806c954748c491ce9cfe1864739be3d52ffbef3a3657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9cf1b100cff7618d0a9e6ad88a184828

SHA1
4d9b18030dd3526ba1c200af7b87fb3bcffec36e

SHA256
10a36c46521a2e3066850f588572378fe6a4a828ada40260fdbec5d826f60c1f

SHA512
8843f1d49edf22fca6469983def79b7e0f9906383f88ec3115aa539ee69e6a6b419acbff22adbd7ed0dc7aaf28173f6ea515ad2f39a288cf4780c5d1169bec04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c84bcb6c45f2cd93cd1dcfeb1ff33360

SHA1
f3e1fb9db82863b75d5d8d98a451fe479d512ba9

SHA256
e6343d9938f9c3d493b59d12eb5f31c648061a7c07f6e41798ce29cee40523dc

SHA512
3cd3ca7c3e9f2239ad803ddf4bb153809bc955b705c0c95900454845084c7015dd5cc1e6c522a5993762fd43785ddc7094bfc75a788a74f265ed49d60e2d7af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bb2d.TMP

Filesize
203B

MD5
c4fd5e752b324dfd9c8176f3e56c11f4

SHA1
2f44ff1be97951c4f6f0d918d15673b527618072

SHA256
b9da0fd5ceab4a113a364b062b013996f4a267e0208feb1a2e6a6d7e69b4d434

SHA512
a3ff2922ff94a8355ce4840732fbb83abbaeed51deba72821a77fa49c5b743919885a4498dfc81621ff40e40a39d121102f83393c055cb4a95c2455f3baef0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
08eb0a1d2442aaa5d0ceacef3ccbbe44

SHA1
f1bc552408337f2c9b853d50860ac0a745a89746

SHA256
717ec82a481b8123f90b0081411e0a0b19f609f4503a552ee25fc42a3265cbdf

SHA512
986a92bd38a32968b513548850a612d37266648211fb9fecf1743cf71a03173fc0fb04ef5d6974f0c4073e84f4bafe3f1e39044e07e855e2efcd4eb7b66f9943

Download Submit