c88dd4d43945848cd024bead09c7812a36b2f20c8f73902249a6fe6d59b34904

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

960da4382c9abd4c45d00bbd8c9d62d8_JaffaCakes118.html
Size

165KB
MD5

960da4382c9abd4c45d00bbd8c9d62d8
SHA1

ca059275f0ff45e539ccdfdbbe3b27eb655c4a42
SHA256

c88dd4d43945848cd024bead09c7812a36b2f20c8f73902249a6fe6d59b34904
SHA512

2007e325ae73b5d01e4cdf88ee3a4e325407affd1e2f6ca71c9fcf78d45743ab172931fb67b518481ed58da059b807fbf75bb57df743440775d309f073d4f216
SSDEEP

3072:pthO2EsEnRE6gblm0/T9gDstYgaNUVz1Mbhc4Dp+3:p3cE690mM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
404	msedge.exe
404	msedge.exe
5008	identity_helper.exe
5008	identity_helper.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2428	404	msedge.exe	83
PID 404 wrote to memory of 2428	404	msedge.exe	83
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 884	404	msedge.exe	84
PID 404 wrote to memory of 752	404	msedge.exe	85
PID 404 wrote to memory of 752	404	msedge.exe	85
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86
PID 404 wrote to memory of 4172	404	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\960da4382c9abd4c45d00bbd8c9d62d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952e46f8,0x7ffd952e4708,0x7ffd952e4718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15281471085309184656,12809458177490510503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
2301945000d0356b1f3aeb027d50eb7c

SHA1
636f005e3ebd02f2d2d12b55efd1fb2502b2c5fb

SHA256
366e88f0f05f2cfb2a5088e5c920546e1c36895dce5d3b1160b5c5f4bc6bfd07

SHA512
c81d97d13ab18f2e1a2ae51c9a2adad3a60b17a4cf5aa76349b078005bb287138dabb753f231c97f0748ada8b546763c42b7199f3fe001c4cb60dca2845554da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a7c30dc57f354bdf52eab8fafd8ab006

SHA1
673b0709c6f28fc3ae6baa8d18d019cf1374cf3a

SHA256
6175a218bfafa2658c9824b1cc8175ece18f8d4cd3008b272fc734531beb0412

SHA512
0448f80d2de389f62a30ab1a0bbc21e796bc18868fbf12ea598c17eb87602d1bc0b3d82794093a7489d5167d25a3f0a6af365bbb5044b2a52f2381462913fb58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
44ca139765ad4d3a12c99ef27f0e25a5

SHA1
49cfd2a1d45fe7f24e41edd6dfec2875ef205be3

SHA256
170dcf457199589937058aad29e5f0ec9f568cb28099f2a3cc13221eccef8515

SHA512
3bf5e0855d645f8f4623c42263ac568d433d890f9db8c9980f5c2bffd46378c19775b98d98500fc253958d8c87be50a153a733e714303daf8f8ffdc187af781b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
17b18e274ee0012214aa6e3737022c8a

SHA1
b46080b1493f65e955b7d60e474a2682a6248ba6

SHA256
b972f4b8e09e467efa3a7f871d58fe0c7a57e647e87607488b3286548c3ecd9b

SHA512
5b49411c8da23082c4ae43ef1c9debd060436473cd4cf14cc5e37633af2c94dbf9eddb04732435b2cd2f45b61a232ba272d747f76b4f22d6dbdef23cf660325e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ca2d9dc860969b36e1873b85343f4c0

SHA1
30e9408a19cfa7bcc2aa63a3d541569a15a225a0

SHA256
b4b446efe67765498c43822bbfc990d7b6399b35a7a597c40fed2e485859d117

SHA512
8aee495dd78175344e72926da42d1dc97e274d59dc9448b5cead78edfcb51359e0595c7ff62deefb13bc680326d226b4b9964822870d6027878a38a5bf146393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bdca4c9780a1a55796cfee00ee4c5ea3

SHA1
905d9805d05d6ab2dcd1c5e9aa736554bf057eb6

SHA256
ca23248c135ea1996d9c8578290d7e7ddb9c0051388d69c06c77bd76c491710d

SHA512
2eadd58e36bf0e02ca3b5b0a05a4ff7b6bc315eb6dfb414c2cc5920b460c3bce3a4036bfbe1805b7cce88012a9370ce4d71833c7546f7421d7f9408d772d49fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92bf73eadb0250f6a0b1266ba81abb95

SHA1
0f31103728e49574c12d40e0e196e9cc51545b68

SHA256
ed9a1dcc04ead30ff7bf81569764cd9419c2842c5f14e36029bf8d115e904cf2

SHA512
e2e8dcefeedf2c76e582ef9d813e907b66ed4e4ed96fdd9a5820ed322826232068806f6caa80cb2065ea3b6e4471ebed8155443576a5602bda89a660643d1b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
26ee911588f021a6a6d14916bd0139e5

SHA1
abbe9dc44f170f7609196f7f3fd540f4967f6176

SHA256
65f241c9e02d338cdd1c600960488523e576d90d06d3afd4cc948cfac3305e66

SHA512
cbffa5fd8111149acede47062fbb5e12e3967bc90e6734fd4c1354ab804879904cf7f9d6f9c489e9f14755e2fc854295325e8ccfa682a76bc70380b465acdb06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
1b3febc4b34a00c6fe99fcc114478bb4

SHA1
34ffe70f8de75576e12fb4723abbc7264f43b4fc

SHA256
a5cf15dd5ecf5bc40fffea904512a03d9f333f3c98147c17bcbada6283e60a10

SHA512
c944e1a1a40616d70509a447bd126f71f9d371f82de9d6f76b1020c8f4e4a91170ca459aee87a5c3f70d0b42e9c3fe043ea5a0a7f7372a23e875d43c7ef06fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5883e1.TMP

Filesize
204B

MD5
cf9a9ff4888d35ae691ca2a97acf2a5b

SHA1
98e3191610fe0c1449217246491b16659f125fe4

SHA256
b9e7889b3e7e279181bfc05ca90a362d03e3b9d182e92db516d2e154799a2e6c

SHA512
765c25aac243b4d8883e4cf754f8ef6f5a74d0db16abc48b27efd521c46f0c72cb58e6cac0bfc933130b8a0e5ca1727d5ba42583050af331965fd492dcd0a806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ac6a0aff1dab15364888e419c79a7228

SHA1
045ae041c7c49cb4704d7dfd5ea9f8af503bbf2b

SHA256
e909571f0d852a638fbc2bbfccee68b8178a63b15bb6b320b18e7db64dbe684f

SHA512
f82e657641e826e95d3db8c9335c393fcca94a07f532ce81fd2820c95a52c8e87cd5e336ceecfc237b22cd947acb2a283f11adef150cfc45eeafe2796a9f7441

Download Submit