19c6be01dcfc9d13784abfd32474cad03dd1ba425116ec49be3a6c4d65ed02a7

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f11465fd4a1d0d74c9efe372fee7cd23_JaffaCakes118.html
Size

281KB
MD5

f11465fd4a1d0d74c9efe372fee7cd23
SHA1

4de802f9dc21e894a5cd961338a45b83c72052ad
SHA256

19c6be01dcfc9d13784abfd32474cad03dd1ba425116ec49be3a6c4d65ed02a7
SHA512

a01ef71f8513c91d28a5c127c5e85fdc2a6aaed0e9506ff9e96c4a7536aa56b49dbf5422be497f77de78c2ebc9610d4ff02954769eefe1649fa0edc8fbec3570
SSDEEP

3072:ObW6WCiqYxDNvG8rmgcXmNRSz73Ler71BMn3JoBmGGdvaVY7RJvfy3Y9Tqv:FDAXmNRMUHX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
764	msedge.exe
764	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4540	764	msedge.exe	82
PID 764 wrote to memory of 4540	764	msedge.exe	82
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 3196	764	msedge.exe	83
PID 764 wrote to memory of 4404	764	msedge.exe	84
PID 764 wrote to memory of 4404	764	msedge.exe	84
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85
PID 764 wrote to memory of 1616	764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f11465fd4a1d0d74c9efe372fee7cd23_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7fd646f8,0x7fff7fd64708,0x7fff7fd64718
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4069681964053572885,7676251722549976604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
8528b860fe39ed8a7acc4294fe7763cd

SHA1
dade8872b1366c5b8f2ec200de8cb2c75b119805

SHA256
17d72c2c2c98aba5da4d3fc131b1af52033b4519f25e4613841d77392e62b4c0

SHA512
3d473949eee2d4f7d47cabb0f6ea934c540079bb4b466aada608ff4cc0a947c2a69c92123bf7eac7273d5ef4919fe205ffb75e4492bfa4a60bdd829dbed3fea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6689e4f91ecfbc40916630b045b51ccd

SHA1
1b48dd12ec646d4e34359d1ab6f513875b1b2aed

SHA256
b17d90fce069657d75b1ec6406c3cd11e740167e16b62df78071269eac9eee7f

SHA512
6f2d30042a2558842b3113ffa067cd4db51c40ebaf827440536847ae5bac18927b1fdb12f7335f6a96a28172937fb0a5d259d4b186d0c252fd42dca2a3100c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2669be6752b9b249f44d1c8a60596d4f

SHA1
764de6ac2072db7736194dec95ccf27388a1d4fa

SHA256
ac8ba9de1662163c97c8e2d6a10116aa9e13438972b3dc0bbf8b48173c1e3e4d

SHA512
e4b763ac05e9e3a02c35843e0be7c0c647e5615bf57f9035c020b0480f6369a24df38ab4b6e9a9bc4f88151aee4b4f4916e0889f8bafa0fb0bc92474dd71831c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bd5c4de1ed31bb191df3423024b667c0

SHA1
e4385f6a112e89c25b4bbcf9ec41081a7f258ddf

SHA256
98b66567cad0eb401aa596f957edac528bdfebbf5df1b5183e4e96ac896ce3f2

SHA512
549fd23b69c6f4f64c9fc3432606e51d5499787d94c7705b0feac5af7ce2eb40061c6058bafd0c6430d4d6ad10f129486a6fe0ba005af0d2010a38d78b29f034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47adeb48a5e5289f64cd375b31e087e0

SHA1
355ba52753bf681d71ae9faf0b22750bdb879863

SHA256
eed6a159d59d38a2fc5b22d743e28656db55e3ba55f1b079f14e37a7f65817da

SHA512
57cc718fcf5053547ad3ea59c5e6282aeb63d76de733a3bc1b11abeb015631a32cd7d6f4b5cc3a3a774151ca299b70c3bc6a22d9563001a16ea0877b60915e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb9190893be77144c704316793591a65

SHA1
cd0b17a05522da925032087cae43b88390f8ae4a

SHA256
59ee305d16f5d15d822c5e668648cebf54c07b1385022b5f1f00304df87d4645

SHA512
a28ca8c7b880d47269925db60d0663ae706ffbfb8fef1b3a2bb903547940dcdd2411d990d6863da41cb932fed55b0225b7ac3493cd760ab64b7305d2b1a39cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
96562bf1da2d363aee11197decb7e0d2

SHA1
63b89f0ca12c817edf7688be33a55e8644b13176

SHA256
b364a96fa4d74d50304a6bbbeb1b8412fbe27bb554c5a7fe0c07870cdf591bfc

SHA512
557fb2fbd7ea14861d3dc2a232d44dbbc32a71ae457dd36d83977a601a458850dbdd3abedbf11bc13d1a957204ca517f9bec0c5cad39bbc78bc358e551edaabd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
bdc5eee7354a83120ad6707f6f3dd2aa

SHA1
ac9d8130c22682beeaf8dece372fe2abd2919448

SHA256
ea93919745d1f2c22465e9c3b22f9709163e58523c88352d59d350d59e1b27af

SHA512
ff32d1bf0c49fc888d7c1c52f8707d1f26b117b58d0d7d949785e4b0f966a41a3dd89de3b788eee0e971e5b69e9f9a64240c67777ee871fad5328f6cb7080f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
5e1afd2d75c5e35adacfe2a4fc0e5de7

SHA1
04f0c811bd30faad1d9853687015712c00a7e5e9

SHA256
d6d3048071164c88af7543ad4dc9b39d05c3b6c722e25430e035e6f59dc80ceb

SHA512
bc6064f557bd8a278a4378a1f24e5ff78c63742ba92f954c18367fe0d515aaee009c083754590de4e1fb8cc0b3e6128b601e7736ae91333fdf3a9221bf8facb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580b84.TMP

Filesize
203B

MD5
1a5878624cbe36ecf0a52886c5471468

SHA1
79f59c1a9238bf80f1c93d68aa7588569149a2de

SHA256
5b336b78ea63e411d551d5b481a97b208f5c07935024372c88a3a6ec8f54317f

SHA512
8b1a883a78512d5066c09e0d38fc7f73640152251ffa0322b41eda7d4db782448eef35e8e50113424cba063388dad6e4294183a6efed02482d3ef6201153029f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a8b3ff5bdd40d635c632c98008186f96

SHA1
eab12726c5cc723fa14bb03381ec5b80938ccaf4

SHA256
0c602ff8a61e5ad1cbe9cb73cd7db330f144fbeddd3a4ada036091a4f14e184e

SHA512
eb945674f5db1041ce4152d3a27aff297e0b9217332f2c6b31b45d29426ea57b5db3e89b797abeccfadb6569f93618f8f700be919ba0d64a3cfa557a261d5aed

Download Submit