3b03e9f32e67d74d895d1aaadf46986526efa08dbb5385a8d5eddf314a8759ff

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f570a0f30298ea96be44b1c9c17bd22_JaffaCakes118.html
Size

45KB
MD5

2f570a0f30298ea96be44b1c9c17bd22
SHA1

a6126b9d0994f157010b9d1acf187a5215d63f8e
SHA256

3b03e9f32e67d74d895d1aaadf46986526efa08dbb5385a8d5eddf314a8759ff
SHA512

1dabd9ff94fc15ad77c8c213cdef594cff8b7949454a3670314a99048f9d8904503e848def509011fc940d0c7961b552361238856a72285cec7eea811b619f06
SSDEEP

768:3M1NpgSBAQ1qHn2UWtcpFJQL1sa4bshTMazTe9rCX7CesIlKsG4lMCgiw9fq7FAv:c13gS+Q1I68FJQL1sa4bsZM+C9rCX7Cb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
4388	msedge.exe
4388	msedge.exe
740	identity_helper.exe
740	identity_helper.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 3328	4388	msedge.exe	82
PID 4388 wrote to memory of 3328	4388	msedge.exe	82
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 372	4388	msedge.exe	83
PID 4388 wrote to memory of 996	4388	msedge.exe	84
PID 4388 wrote to memory of 996	4388	msedge.exe	84
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85
PID 4388 wrote to memory of 4896	4388	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f570a0f30298ea96be44b1c9c17bd22_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc113e46f8,0x7ffc113e4708,0x7ffc113e4718
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14404211009548381739,8299581706077769201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b2986629ecb6a2f2346f82eae182248c

SHA1
95cd95e11d37267531f276659e81e592ad1a0532

SHA256
7d1a5245d63f24c4bccd26b410098960a64b04f4c9d2954b91e74cc96035b427

SHA512
5d4f1ccf5cffac914b03695c7a531720b26d623777aeb55858016888dfcd0553cf7a6962ec9258c95f188f092996c749a7406ca3e5f11b38ef77e681dd37fb84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
80e652a3d5101c3c1c9bef8b09f7ab9a

SHA1
d729cf0a15778eb7e689019ca432c20b9e3b5a50

SHA256
b1c0382964f938694cdff01922af66858fa29aca5c9b96d3a26a00d862691cfb

SHA512
5ceff30b895963bb483adbb22c2a04113ab5631dacafe6569ff72efa8660192326dcfac7d5e7137cec34d6ace23e9b8acaa1df03a089d6c495b6a176eed7fa41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1dd2fd543a462dbd6f4eb12e2a23b7b9

SHA1
01b25cb88dc7efe02b62ae8e4330ff6e075d50bd

SHA256
0f89ccae961e05071fe55301615882d698a30f049543bb17246b87b38218c0e6

SHA512
d404c4d62bb6a94f70e7cfa9a3c70421637f5c3661127fed4774bf196ae59e2af8f5e330fee92b99aa3b9ce2dcbf788cd1b74dad1c4f808be1f80d60318338d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea8fd1741802cc5141cb569fd92e3bc5

SHA1
f33838b3ff0d8bfb2a92215e1016bae20b328a6b

SHA256
b9a56d3f700db16071f7c70121608bfe77840a68170a6eaa05ecd0e5c535c58b

SHA512
ff2f3f665e1d5faf6702c2e7023f01dfdae46c0613aae7b6fff15ced78486d0a4758d004c07080b91f1af71825767b84c78c1289a7f1d49844532b9e3677b517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bec78ed6d83c172e7082b6afaf1714f

SHA1
449c359ce788be2a0e75963ebd72f707cae2170c

SHA256
7ae224cedbb936b2c0293c0176a18a947b74ec9d986f2d6f3791eee620725183

SHA512
21bdf0c89120f0d3a4f6fcfbf3ab7ae7af1afc8ba871ac2d9f8b107c615ffcb72a7c25659d8da21ee0fdb452891839f99ecfcb2b3bc56fde17ff75728e45a70e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b663c41aa8bed257165762c97cd084a0

SHA1
e85d08a686a871039e4d7058fad585f58d7c49bf

SHA256
66248ffe5481d18333b1273f997aafd43e2602f58b27d7c9c5d7c1bfcf64207c

SHA512
38a93f402b59cbc0e21c2d007ae5aa6a9e5d4ba57e67a50a2c41d4a5687c85119daddb2a462591cd1dba2895a9c68ed195a7b1e7e2b4edee92e7cb2ee4096db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
3dae632b339e817a0c305a5b835f7379

SHA1
db8bc684a938c675e47c14765aa8c775a7bc2258

SHA256
5bb4e2c73b6550f25796562d09bef0ad8a32ddbab7c5c1c8e425eeb5e28fc68c

SHA512
2763729be38d557917a5fb6f66346e80ad43cab3698676a231f9659c71dd0d8f452759821dbf66caaeae3bdb2db7ea51d97a1a4fa6910c8667b076545e8ba4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
27b40e8d657b0065c227370d9a86e860

SHA1
a4a367c2b8f450dbaa2692853befe455bedd1550

SHA256
8ea3b7003fc167be55517f0652e89980444d44268742290f25750d5f22a2d150

SHA512
068c59f45cb399c4f57b3641d8d4572883f4401f67b913298891b457de550dcc12f962b031caf0b56d224d0b5579973bb9d6bbc5a54b4e951898b8ed096f5655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a56d83e0bf0cf09e45a0aaad1054516

SHA1
87a8e1ee0569c399b9927de9f2f3a07403d11ff5

SHA256
37788699b8b42ac80531b2169db313974b2be064870b3d48337031c367fbee7c

SHA512
b8f7bdd10aa52a76cfbba1c0b1f9896c1909eb76edc97cb2c547e6c340ea9b74cb12d78f5ab85220b938e6c756c925c639b79bcaf0ee2f8b5948998f6a0530aa

Download Submit