45ca25a430084beca91207992ca058af879cd2317c80a99e26b8feb30512dd0a

max time kernel
60s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a968ae8b341fea64aeb3983d7dda9f1d_JaffaCakes118.html
Size

57KB
MD5

a968ae8b341fea64aeb3983d7dda9f1d
SHA1

4ac62bfa417f114e5c3618f843265ff18d51b239
SHA256

45ca25a430084beca91207992ca058af879cd2317c80a99e26b8feb30512dd0a
SHA512

e6023dd9748d2a1a477851c2116fb944c6b5a9478617ce12a4ca2ccbcd30f6d12ab0bd5a939f48bccb5e608bef81d5148e04d82d15d2fd6c9c184c48c2cf28aa
SSDEEP

1536:ijEQvK8OPHdsATo2vgyHJv0owbd6zKD6CDK2RVroTvwpDK2RVy:ijnOPHdsd2vgyHJutDK2RVroTvwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
4692	msedge.exe
4692	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3712	4692	msedge.exe	85
PID 4692 wrote to memory of 3712	4692	msedge.exe	85
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3364	4692	msedge.exe	86
PID 4692 wrote to memory of 3132	4692	msedge.exe	87
PID 4692 wrote to memory of 3132	4692	msedge.exe	87
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88
PID 4692 wrote to memory of 1292	4692	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a968ae8b341fea64aeb3983d7dda9f1d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650446f8,0x7ff865044708,0x7ff865044718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1727887673180207760,9134477057964451423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:6096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
53b59b2ba225119cdfffa7bff3bcc63b

SHA1
4f9d08788e3559ef563aef64fb6e83f688909816

SHA256
91cf10a213f01f8db41393f80e07f235e031942ff507b762f3f06fcc0a23c2ec

SHA512
ac95475ae82a63c45d00593af24a609a4fb0fb0e00eaec189af16de75636b08d3e1b160cc79c9a3fed92950ee55b3df573f9eac1b57d3af83b54606c818d4e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
63KB

MD5
e4cc1ece2f2425b10ae2ccc212c1dafc

SHA1
92609e6d0093693110baa23758382889bcb30da6

SHA256
92e9415d8bc8529e2a3f335258ef7ff159cce2965ce3b2b7c15f73720efee809

SHA512
2848dee3a6da891b7044518bc97aeafd340705cebe846350b9a7f314b52450f1eb977b8b492638965ce4674ebaa341e4f832438199c3cad2fb0a0793ef83a619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
20KB

MD5
8266eb9d769b0040c61f9107b9233d0d

SHA1
7d84098b0f5a6b1fb73333838e071558086938da

SHA256
389603813af8808ae7ec8ca4f2bc326b15e4c2ad5d86eeabfb271ac4d170b923

SHA512
82854e09e38363bf682d1426cd72d2efe770a58531f8b006c80c32718229cd9699c6db6ae4afe0a5ba64504a08b16568e53ec8fdf2702b5abc41ef7711f011b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
35b908680d8877170a7b954959f59386

SHA1
d9f7d5cafd6e367b249d054bc479bf2a1583e658

SHA256
53a4952e993c6a3f866a7cae83cae2ac55dbdd08e7d048147ee7a63694f45e09

SHA512
55ce54cf0d30f5962a0588b2eb285a269ec78e4d58bb137e96f98813cb6e8b5f96d5b54c4a508f83c3f5d1a762eefb8ced5ffbb2931ed7245de5a56cdbf5b20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6f390056ce9c5b5e6d010fcee0dd0c4

SHA1
0a8dc73550a33f63d6cd63b606df5e7d48a751e3

SHA256
0941e8b65158009e1e32246000bd7da7051aaaba68f28ef5b6047809caebb96a

SHA512
5b6dbdf41c496dcc5759782adabd65b6870b6fd19eb91d222bd5c0f90547516186d78044c0afbac959e4754a2fa96b0d58358503a6d57d8dbd7affe78e2b83ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9800ff3e45176c70aa94aa7241eb37df

SHA1
a7e48be7077d8d4d0a9e957983dfd547dd4d7c17

SHA256
f99337d7d9a6af6324eb36f63594cdbe1846422dcf22508a1e2172bb8702fb86

SHA512
f802b64a80cd86b9d5c9a7be5b0c46f56d80f162efc8957af719c98c5101e532590cc2ce281e7194f233da1f246c265b82bba0b2af3715f76486fa8f7c97b999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b51c52b7965a69108c4c461c7a7cd51

SHA1
7a87423f148ba184786decfa47197047ddf47a7a

SHA256
e74026ca31445360913d30b7690beff5d2cc620c9f93d81b5abb0bbfcc75e117

SHA512
59e8a0a4c651f7992866e541d71c056bf4013b4a979b17f58df2211a9b18b3ab8f0ceda2210cec7426316c876ffbd0e86db969fff963755af3a5aaa347846a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d4974b7ec400bf7c9dedfaee128dbd20

SHA1
4eec1bfe83c2648e6a814810bd2380fa837cad7e

SHA256
782bdd75b0e607814df0dec1f002083d2ca896e76782173fb5bffa1d867b957a

SHA512
39f90f8abbd3785953c10d44287b70621f5397e5261c9835feba13209d6dfae993fd13b2eaa0239bc23c97a0dfe1466ca172ad6b8d63bfa9fdd8308551d1a6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585985.TMP

Filesize
48B

MD5
20cba71b0c884298cdd623841acdcb9b

SHA1
63fa877495be28fe94ca412ac6b04ea36317e6a4

SHA256
937412f4d1a3f6036d2c32a2a74e7eb4a33662d6ecbf70b356a568f891298159

SHA512
b0cfe5841f5ee1426b66c46c3443d14ea2366cf7d879dfa8d948032908fab47cf8563c958e6d74188476e6e14a91ad86e650556ba32a750002350e46d56c9752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
296be779f04e87c4da89e51fd59b9ab0

SHA1
47648d0e88d566f42637f476e58133b4abc9b80f

SHA256
4129762e1f258c4b1e2c90b4c89b74f7b12511f4b23608fc9e66a3ae245de74f

SHA512
2ce173efe0a6ee688ffe7dcc50fbe9f8cb5c4c5c92350e4e38668bd0a0398900144554289eb1d62f768de237052c2c4445c64b80ef24fa7a7b8379b841f6a294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
442ee0c65c028e53757745a0d9887943

SHA1
cc67dd59370089eb885dbfa843757cfd5591d45c

SHA256
0703721f57d711e2a61cf62c143e21f67df2f9759fcd36ebfcc11c73a0c54f18

SHA512
6cb04da9cfec4f12462ad4b76ff16de5a57309ff2b2cf89917776b241a800be6a7f41e65ee2c0a017ed648e85450da5ef905374385c78968ab2b6fa818832aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582fc5.TMP

Filesize
869B

MD5
6eb8c6068a2548092c7bcfb93d678c52

SHA1
6f1ee3e04ac5d1f8dfafa0159fcb23f73f0d37f3

SHA256
efee934f6eb45a22b8cde915b9bd66de4290e3c84e16e511d182b29ce684876a

SHA512
88fdfb370266b36587d71781f581a324169a5c956d3bcd666053b9f35e9f646ec0e69368be37e95dab0911afecc456929d40f9de76f2f4163a63e2763e081e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a3f7adcaf149c024796770d24136222

SHA1
77dbf10e16ac8b313f7126283f1f11072fdde169

SHA256
30c0286d79c460c12d02ec84d78b76d35bbd720dbcdd4c0f18c2a3a9c4721ec8

SHA512
c86862340a5f34b3514b839dd65fb6be978ccdd7776fc84e3b4964ddfeb9ea960c5694cc12b96800a65c25fbb41c9b86e28313c1fd1bdfbb7304d002fb40c7d2

Download Submit