5f5b9f8bcfff78b0e830c4b5bb40e3466f41d35f15b4c993d3eeb274696e3c81

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24e2a5448d964b34b4655c57ef5cb736_JaffaCakes118.html
Size

122KB
MD5

24e2a5448d964b34b4655c57ef5cb736
SHA1

8df2264468a17605160b9e2e0a6a24fe7d586bf9
SHA256

5f5b9f8bcfff78b0e830c4b5bb40e3466f41d35f15b4c993d3eeb274696e3c81
SHA512

da1bf93f19ee3fe814e80fe504fb2cdb42ae29e36a1805cb440648f0145ae8e94e7db2f5709e34286345598270ccfbe14ea71ab4bcf56a9b3b0fa98cd96d24c1
SSDEEP

3072:2HBEyRxuHaY2aVjfbQLDsbDLkyCz4GsU1:/Ul0UgLk7z4Gt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
2992	msedge.exe
2992	msedge.exe
4344	identity_helper.exe
4344	identity_helper.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3084	2992	msedge.exe	83
PID 2992 wrote to memory of 3084	2992	msedge.exe	83
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 684	2992	msedge.exe	84
PID 2992 wrote to memory of 4400	2992	msedge.exe	85
PID 2992 wrote to memory of 4400	2992	msedge.exe	85
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86
PID 2992 wrote to memory of 460	2992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24e2a5448d964b34b4655c57ef5cb736_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffff05446f8,0x7ffff0544708,0x7ffff0544718
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,16525766323347775637,15061086825595309598,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
b4d8d46981937763ff633d8010347741

SHA1
9d80dc29e64efbbc476150a7b626b30a10bc945e

SHA256
dcc32b99da837f93fc577d214ac094221a0a252bdecf4e3cc61f10a8aacc268c

SHA512
fa5b0c6662125069e5eaa3e8bd129c914814fceb13657b6a0731e54342d10dab48e998189acbd1b3300c36bdca7713ea1649daaec93cceb85989c89f9f098bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
65c15eade542aedfabdc6f2207b29fa8

SHA1
ca246a63180d3c4c4063d08baf3414a5102c47bd

SHA256
613732e4a5b6f1932e6066189b9b104278adad8705c0dc070396e43b17767e9e

SHA512
16bfc54c5ad7ba63a08964053ce5bb8952a01739e16583c13ef8decb529cc1a47c055c7bf7997e85bba07d2fd55aa0a036aafecd2c6a9a74b59ea347854ae192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
46b02528326136a959cc7bb82f4cde3e

SHA1
b38d775b9d2d032e24a98c57bd5ab6f52f254eed

SHA256
2ea9a217fd298d443a9c296d745d32cd2163f540246bdb42130c2e727efa2ce0

SHA512
1b27ab73cd4cfaaf422c70ce65345f1c78a1e3cc74aa814a0af1645f4317bc7661cc1d40da5b11f4caefe33bc05c89e34f56d3b961e750f45041393477bddb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
180a512d00fcbd65212cbeb55656a3e1

SHA1
586b42b0e737fea4fb5b1591a21b0bbd8e7f726e

SHA256
5c808a7d97c02e2b20617a406a399ad39f4b89a88abb32f2c82a9f31a7fc5c29

SHA512
be1abdb167e6b53ac9ce477e873a07e07416f32dc3c16604acd9b85019e41466136bfc95bcd2bf88b21a0066ac54c9469e0f3b926a6bd167a072f575cb5da9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd082726d77216b0552def7acd6df172

SHA1
1c1aa126c389b0599cb6306bacc3006d6606de67

SHA256
ff18b7d9651f9a147cb500918fc054712c32df953cc9a017b85dd73e8539f279

SHA512
4459e533ee862666285bd44d8730666721fda17040ef52132fa43548e2f3077eb10c28b9d5d6ad2a5ec998f432644b977718339619420bb2bbbda6c7b383e9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58301952f17c2da21751e9d6d658ce70

SHA1
c3b2a2839eb7d721174ff659050640927fe33aa7

SHA256
f59cd0df53d10ab0158288834d684b1f5ade3b2f77f450f4e08da3c3248a58f6

SHA512
ecd9883056e5b85923fbfb1b05ba3bde952c26b77e1ebd6081b481a35547da1dd25a262a9e2984255f8e733197651730661d8af939021f1173832b8c14eb2ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1a70431e1b71a95cfdf021f0e40736e

SHA1
3d5cd9f44ad4392f2182f6c4f81c6165e53b491a

SHA256
22a423491c2c02aba853b845bad142618a9abca7fadc3b8043509c0b02e76c72

SHA512
e80fede9ca2232dfd04ca3fd2d650082ea79b95185110907396cdb2ba35176354d7717dc62e3b116dcf3cd5e71d4442c510a87a495554690c5fc7e18a15f1d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d9fb682800bba0cfb37cdbb53b4441a

SHA1
ec7690744e2d5428e806c7077e35f9aa28f7f391

SHA256
d887f7e75111f557b42bbe7872a5ef974c569e53895333fc377bd4c78207688a

SHA512
18ef19dcfe09c84d407e06e39e717466e6a3668f45a33fa53bc4b7b8bbadfec59519384fe96773cf9deca11acd2f8f9ef972593a188bb34aa06ebcc837dd1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
82429c0b212a33f5da00fcb4ee70a78d

SHA1
1fa57da4b35bbbf824ef93fe55ea4873b5223cf9

SHA256
e6e5a4173b68a19dbf63a2b0450dc868e1bd7549ca860263d1f9c5aba02c0c27

SHA512
9e0bda061c247b9b9448a7ce5474e6de6a598e856e5a3c762685bad39e5254d367d5d1a6bcfe09f926cb7930bc1b877dcee33fa29f6951f2f7ce48d38ca1d3e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581df3.TMP

Filesize
708B

MD5
4090e406ffa41a9b3af06669812f661d

SHA1
f0f016f5f4831790b3d79073fbf9d2702c7c8039

SHA256
30d59c63cce312fb9b54c547b17ce481d4a246d97d8bdba236ec29616fb029dc

SHA512
15dcf226968d6808a31f75352913247a9f78a7523c3f5866d76949c9b8f56ca8cce35e7e9d3f4051e0ea84fbba10281d8e4b3b30d8c527acc9d3fe0a2aa1da1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fc75b3452dad4178df716ba14162c73

SHA1
dd5ddb4f3ba1c6f0a2199230883de956cc76199e

SHA256
ee4e740e24d121d060353743eb89fd03e766c6f70c38c6f7a2744705405017af

SHA512
d1ae2df8e87c505caf806d71163c9a14972202dc1671848f274f9965f97d1c13f6e5797a6d910044f27a1160248b942fb06526156575b4cc68932fa34e3baec7

Download Submit