099411617597494bfb5757c4a8f4d8a76664c31df36586ff451196e65acb4f03

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67b8dba77250bd0ed94da7b681741451_JaffaCakes118.html
Size

201KB
MD5

67b8dba77250bd0ed94da7b681741451
SHA1

5f0e10076e143371f3fbf8cad02e19e9e184b335
SHA256

099411617597494bfb5757c4a8f4d8a76664c31df36586ff451196e65acb4f03
SHA512

be046df85ab5dc6d1c2c467cf983cc8f8f1bf6b1aa553163fe90e2f85c245f08cf6159a839a8461e3b924df0ef9c3ad0ce85b284b3ee676f31f66122b62dcf1a
SSDEEP

3072:jdHggzlgjUa9XB/nCXAOAhx2n5UMZcsceRKkMkNr37YC7CBmvv:dAUalB/nCfpL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
1352	msedge.exe
1352	msedge.exe
3100	identity_helper.exe
3100	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 5112	1352	msedge.exe	83
PID 1352 wrote to memory of 5112	1352	msedge.exe	83
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 4804	1352	msedge.exe	86
PID 1352 wrote to memory of 3884	1352	msedge.exe	87
PID 1352 wrote to memory of 3884	1352	msedge.exe	87
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88
PID 1352 wrote to memory of 3300	1352	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\67b8dba77250bd0ed94da7b681741451_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb64944718
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,14000107292244457489,10032398509565566938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
04041fc52600e0631d1bd203eef63064

SHA1
7c83ec3ba3c4e888a6c9d588f015d1dc6951b847

SHA256
19d64128d354b4cf51c6ae32f38f5a877d2d4247710568689af7f64b04a349ae

SHA512
d0f1049240596294010bf6058e94ed5402beea6f7c5b6bf8325e1a4f450d51158828140e985f4c13fc958be85baa11b7930303df51a01742a043ac902b13dafe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
079f2dbde2148f285bcc03b00ede0f1c

SHA1
c8471818205358c0545429def07701bd7a35f54f

SHA256
da63b9b72f6e9c397965e3ed498b48ea3d7fe643a32fda9a21028233a9cdce28

SHA512
36ba093c949104f27675351a01793cb106ac1b84cd6b4e010bdf51c43792898ed9a74ab31e0c7b8cda1aa6d040ac3dd5e2987075863aca7ed90f3e652a5673f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fe924a15be694d9c897a612d61764ec1

SHA1
70c6db1739406c5c565f205da4bae03568c798b8

SHA256
81c369d8aed88ef42d20edb20fcabfbcd557e6adc11230808218ce46ce5ab0fe

SHA512
dceff24f9cc25fc21a0e0d3f4f8a6acecd198c6c6510105a2b95493af50f3c2bdfbaee30070844c7c0161266f96df7a61db00c44bb32944c0da88aa776051d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e06d8b679b8d5f84074d0218633071f

SHA1
9c3317673fa6bbaada2d16e0aef6f7630ffdf576

SHA256
64d17d4b2580d0a691d7116e3ae3fe99848a01dbb851c49e41bb4563f5cb2950

SHA512
425f92f5e329beb8bff5a0e8aa4dd06a3e74cab41db8a6647785c3e9564e466921e32367df929d1b3e55faeb461e5ef839ff1e70b6db537bc9133f94eeda0267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2c4080a95f13584d79cc0416f3b5020

SHA1
08ad2a2bcb70301ada6d69e15101a11aa8c32e7e

SHA256
02ba9fb5a758f229c8a14455526586a01950af2e448165e99abfe23255fab820

SHA512
756c5fd9bc39512bd6aa38834ac534eb3ed21192a803bd7e3ef7075052dd43eda4bba8071ac366864bbaea56d5038485ed40d2fdf82c811a2559d755fa0b4f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
107d525f809b370e60c4aa88ad10afb9

SHA1
defac4c2b9f799f1d324b4291c41f77d8bed6036

SHA256
fbeefd5dda4806044cf815870e56ff838f8bd8184ce145aebf1bb914496af6f5

SHA512
877dd7626ae85828c24aa16bb16b7df82789f7d8e72eba79a249903e5f17191641960caa2f92b001d27aaece759bd8bb4f6b90938979b1198022121977e0b83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69ecdd35f0352b7536394b757a4f5e78

SHA1
46f75c90a80c5fad84fa35686e28d809f98be159

SHA256
f89ccf3848e58ee76ea80ce68629e9e147a605439bf131fc047748d1a47f5ff6

SHA512
cd56bf65ab93137f9c5e2849cc5e492e907a651e9b66e577bb876b541b9bff079da62c20e379c9496ed9ab587f45b595ce742f875a2112befdd341c43e3054e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
0b1909ece9cbaee19c9f97d59e58f506

SHA1
9728a90db9a6c2d23efe53e03f87537e32c9877d

SHA256
008a9faa05bd268b53ea380b21088dfc92389a6f347850d659983c62fac8d640

SHA512
901e6afd6e51d577eacf64364ed01963785dfedb28b90a3892cdd97029fe6ab5773736406e5b4db9d55a3e5b4f91790adac27e6a5140b6a0c87acdb272bd197f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d810.TMP

Filesize
204B

MD5
65fbdb8781163cbc5ffa870174a2b2e6

SHA1
bad986eb75dce656094b8ffd0016b276843cbff5

SHA256
40327e929b493d52d8c3faabb09f518f9c8f02a8f9171dd5136d8bf5dc479fe3

SHA512
702689593d0f5382d89096ea86eb8ccdf64a1063ef4a83df5457d7c3b1bd4a5720391723eca346c1e6280aca828ed81da1bc28550be224ed4c9dd65de24e025e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
34c8ca0b3dd040aebbb7a18710077148

SHA1
c1516d55eba362a7a8fb09f6b5fc598bc45efc9a

SHA256
eed6797e393e19192ab9e60e8fa57bb574fdd2fadfe364b882e1983d43ef1580

SHA512
e9fee4d601713d5ef8aef7d0029a485b9a4b798cdbd58fc1a5778f8b28ad2697661a0c0545fbe38dec898024ae12b75a2198bf242c56fecb217eb3653dc112e9

Download Submit