b7abed1406109e1931d0d5976a7cae96fd029deb900185da2a5871b3ed950f75

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91f32f2824232b868b1aaad70e26b75b_JaffaCakes118.html
Size

155KB
MD5

91f32f2824232b868b1aaad70e26b75b
SHA1

8b1a0f782c41013f186a0971733b35bfa404b688
SHA256

b7abed1406109e1931d0d5976a7cae96fd029deb900185da2a5871b3ed950f75
SHA512

f8d7139dff59566939fbde6cb67211e2be35cfe9da229fc3117be01fde6561a2ff0725116d6cebfb742b2b88931260aa9dab8160f9245f51c16c44bbd91bb83d
SSDEEP

3072:ECILd3M8KXcj29SYTXL3HaKMtxp/tN+J9Skq:En5vWq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
3716	msedge.exe
3716	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 1908	3716	msedge.exe	85
PID 3716 wrote to memory of 1908	3716	msedge.exe	85
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 1652	3716	msedge.exe	86
PID 3716 wrote to memory of 4896	3716	msedge.exe	87
PID 3716 wrote to memory of 4896	3716	msedge.exe	87
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88
PID 3716 wrote to memory of 4828	3716	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f32f2824232b868b1aaad70e26b75b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb324046f8,0x7ffb32404708,0x7ffb32404718
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14240071867395561331,1186340524759544449,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03de0867-c025-4646-8a90-7ff14677382c.tmp

Filesize
6KB

MD5
b5f9b239ff5a33f4db51d3e1d454bd29

SHA1
c483b85898eafda43c810eec798fea40e31fd066

SHA256
ea4a74a6fefd86aa85138699164a981afa95f38355d0b6c6da8ad13888b3ca6b

SHA512
34970855f42d98cb74478a47a2099327f83a3f2c3e54289c3e2bdf3e71c57795324daa07ceaa5f72312821d428ad89e25f64f3dd14123bfec7796da216470694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9164c7f804d85fd53fbeeeb2396b08e7

SHA1
4857e5d6ca703b295ab829e92eafcffed352ce55

SHA256
978926ee60e12561ab5ba746968dfbbb19fd0e845d2eff012de4dfef1c002e63

SHA512
9e4266cd425028267db3cd49a47f1d32df62dd06c45b703a5da4068b48a635c63254b6d4adbea54e69119c71ec23cda07e7d9f17da411eda2eca7d5335f391eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ed96153ea17f3706685163d968f29e51

SHA1
3380f6cd4f1a659a93f91439525d8834be9b2791

SHA256
9e67101e763b69d00924e01f7cd09eeaf31467e18cfc8b7dcc029c84ea7d780c

SHA512
a43226f20c574617430f917495cb511ae01f92219f1e9635b1f0fe790f3c58c85982ace557243c2b483eb3f2a3d55e92da9231858912700794b7afe87c406160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b51c952c9d5a1617ac434908569a1c2d

SHA1
dd489aba8477c9d0a792cfbbea7ce9eab6c47813

SHA256
e3417d60439af1aeea9c0a766f02ee90dd9ebbeee333c767399df7080c01a3f5

SHA512
842943a604fd055a4867ccca0237c503259a3f92f50f7f29b37865eb12e1488df01b344d5d1183c35597a82cc8caa8d850fec035ff021d0177457d2ca63c54df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c755e267fffd519e5fef444091b49f80

SHA1
62ca99bea3d272266463ee452e451695a7fa572e

SHA256
cc39b3245f50c35e52b143e359c5283e353d26f5fd2b41e4d04422473155a133

SHA512
c8f06f1fd1b20d2e4dbfd995bead53e95cfad66cea4ddf19913aab62d25e969c320bfe3037435504959fa7b22991af5f7376e46bc9f36c58746cb0cdd4455546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
80a4d6032cca1901ba7be276c8956c38

SHA1
4ab4a16c3c2d1445bb908f5fa883e0290abb167e

SHA256
a50dacec8a637ea5887ca02e1de39b23a7a53726f0fd1c9549f7e761915d4610

SHA512
ab587a2cf1b8b756407a1beb3768ce25cba57f1b2f69349d0d653a760263872db82a1f86d810495160deba0cd72660e8514da7b8108b4672a58875f44878208b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d381221933939e57adb3b9dc1b82606d

SHA1
040ef4f88fca0305a56a98ca9b45c33624464a09

SHA256
f641ffa5e1811d07802455c44cbfe7a48f19f645c2328cf393cd238bfce9a388

SHA512
063d9673636a7be5cf7a9dceaefb5f7379e45559bc538e98942d63eed458e51336ab81aa65a655fbd78e0e7b8e9f61e438f7e77a2b7929392b4b276a8ede0a33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f83dbee96d20977753f7168dff80d0bd

SHA1
da4300e9cc7dcf3aa49f4edc99ebe1991095ec97

SHA256
b2aa7151fb1ddc3878de28f87e8f19bb28fb2a61527ff90466380a96add727e1

SHA512
9e8379131d4e70abc724b8e832837ce4c08554b3c63426832a35cd65160d6f404bc14b50e686ba258834c9b1c85f335e69b2f7c8c7ad68845d0daf539fd25597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f339.TMP

Filesize
204B

MD5
ab678698d630efed48da49bb108e5ec0

SHA1
f9c134f043c53a7736280f59c0328d0968fda5da

SHA256
e7e1b33db2a8e3d087a3294dbf547d6141d18d10b38938dcb7a72e9c78171e90

SHA512
e751198abf6a00d590afea87829e30d561c5ded8def989b95391fbd92a3316df5ee7548dee971568b58c47a0e3a7bb4e18b3431e920336edf3758537d551b7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
083d2ae36440de316102aec60197f620

SHA1
c29a2196992d21b3cd9e47cc0b4c30c0b821418d

SHA256
490d88c0546b38199d5eb22d858acb339304056381c3a709cfbedaa150fd23c9

SHA512
598bbe98651b2eee276aac711cce6a732f2668d554a2175700da207e7c49af40b7f39d15331a476f0fd8f537c168ea4938cb80da58894df9a8a031c42654e730

Download Submit