5d6ba9818381e310504c243bf00ad63728c7a646afed489836bcec9078dbca86

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fedd0791f70f2bc59f00a9bd09e33a0_JaffaCakes118.html
Size

34KB
MD5

2fedd0791f70f2bc59f00a9bd09e33a0
SHA1

a0c1c99ff11ea0806e5acce84b9f1a2477f7db2b
SHA256

5d6ba9818381e310504c243bf00ad63728c7a646afed489836bcec9078dbca86
SHA512

7f8def72e8544879798f0b2c5d0c56ae32ae7013b942b9f89f4612eee750407a05237836f66106bf09bed69721c29c607e5f40dddbce3a33bf61933ddafd89f0
SSDEEP

768:nQUjDLOl6lzUy63fTokYw0kSX/qXZfplq:HjDLOl6CV3fixKE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
4928	msedge.exe
4928	msedge.exe
1712	identity_helper.exe
1712	identity_helper.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1072	4928	msedge.exe	81
PID 4928 wrote to memory of 1072	4928	msedge.exe	81
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 1668	4928	msedge.exe	82
PID 4928 wrote to memory of 3956	4928	msedge.exe	83
PID 4928 wrote to memory of 3956	4928	msedge.exe	83
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84
PID 4928 wrote to memory of 1364	4928	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2fedd0791f70f2bc59f00a9bd09e33a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd03446f8,0x7ffdd0344708,0x7ffdd0344718
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2476803795339818428,11564745225883352961,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\875aa7c3-a95a-452d-9e2e-8b4acebefeb6.tmp

Filesize
7KB

MD5
d184a17455783db84cd058d5815efa64

SHA1
0337291078be9509325319b7a042bcc9031137bd

SHA256
f49c8f2d719b227eb4032167ce11bba2e9cc79e2bc6c885d00ad78a9d4623bea

SHA512
8abeaac48b491d3653aab2996b7e607dacb2a717532dd0be3b7e03c2819eb8484c5b1b675e56d6266a5a33b4294083130326ae6b22781929b3344d67d8e7ca0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
0558f7e3505ba063da887b97d118f713

SHA1
b1c70776e678f2b8da366d31d5781f503ca0096d

SHA256
1e572d6b9a0ea54a30155f32ada1d2d8b627c29c73f27b5b70a0a55412709d5b

SHA512
93809f2c771d366962dfad189751d1444283bc2fe4e83e404c0a63a394f00e94bd522f51b384deb79d675f5ae902f5da71ad3a5ce9a3eabd4fa14c96984d2fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
69a2fb5e65fd9a0e7f78322c970fed36

SHA1
abce8afd6c625968512ebaa8bfdd22929b7432cf

SHA256
11b7c901c3fbf711efbb993745d79cee4d87807a27082a2faa9f61a4773f2370

SHA512
2285192e2c14f18e52046faf1ff8fe5a74b48663eb98c9acee7565bc3663c0b57aa68b538433c79599698185cd32c93177d19b3c97d5532cab36b5493d7a3f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
247c75160269f0fd2a93cac7bfe12f6a

SHA1
39e3a6571192f747b80da3c66c9819f803b2b79a

SHA256
1e43af54baeabc15fed48139d980fc7424f0bb96b0e8992c64e38a2ac7d187e4

SHA512
fbaa8a18bb1a9a49a75af5eae20ea3c6be30d74f3d82fa1acce7f155c91dcb92071e251caeae8e4ae8d1daf3d0d1018087e9071c414c58ad16e21ac11e9051b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c036b877b68768f6901983d6ccebfc60

SHA1
d3ecddbaaa3e734a7764b33340d614188ce6220a

SHA256
d66aae05fa24a2312b5996fb26b255183cc7d9f7b8da9169f1da7a40ad899150

SHA512
a4294afaaaf82f72638333601e15c855500073ecbac8f2e13103f9c0bfb96818e06e8627cb4015f04813cd7b2070e5d11478266e290029884af1c90d6ef0ecd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aec71693d77501a43ce064440157aa95

SHA1
c49f876148cc8c04777cbc7ab594e353cabe1eca

SHA256
59712e609075f9d2b0e624e2efd7c80f62cd654827472faafe87d21a11a52c02

SHA512
baccd9a348820d3da06334ade9ab4dd2c877b48798c6617e8703e2eba7abfac94c7465a247799fc39d6b80081e42de2803bfde2b0cdd4ca8c01e24a7f90177c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
23ef192b5669084a15420b19e17d7b52

SHA1
7f79525c3797c0249b0ca163597fe92469235843

SHA256
021838b6a7daa1111855e1fe1da44f415fc1f9598dcb20a83b8fd654d7a9ec1f

SHA512
d11ab3c3fc126b592524ebf1d366604c75a74cd8b33bd1469c483182d136b6dc15257265636108d968d776eaf2d0a229e18c7fa282c56f8ba29761e3832dd9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579f5d.TMP

Filesize
538B

MD5
155f3ab0cbde5faa01df41b6f24552f4

SHA1
82d95065ab3cd0cc645b93346604089b15794e3d

SHA256
124a3963713cf779e2d9a0b0ff7a26320bd0815c62d81a05508f79ee33581a4f

SHA512
a91f368c3fa991156c328e291106e27154d3683eb8c21b07bb3f53b17ac606240be7ba431b467111fa9a7d8c338032352d4aee2b570e4a6e624b556c4c8ab73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d5ff51d0e3000a7c22f95d0e45e0be30

SHA1
a066da23f1bfa15c8891823babcbc5502d1d1416

SHA256
936feebd380be60d229a49fcefb8bf43d4ce4a1339f617ce829930dc98b699d5

SHA512
9ee5654f78f622ae88c786ef2495b45b27f98b8fd3391faad6e22a81418c2ef7e6ae06a968d56bcce49fd4400523715ce8824d7f1531564a04a2e04950b73c5f

Download Submit