8eaab3bc5a69df717430c07c80fb429c76c073ce561dd741ee0191f284fdfe95

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ff1584115b11cc2140f925883c4f9a0_JaffaCakes118.html
Size

78KB
MD5

5ff1584115b11cc2140f925883c4f9a0
SHA1

56a1d801c74786f6b8de850f1f5c4fb561bfe867
SHA256

8eaab3bc5a69df717430c07c80fb429c76c073ce561dd741ee0191f284fdfe95
SHA512

1bc29883d4eeebe62b564ad242ba9c2570fc8b8957180a71711397040ee7b98469b263a578736aecda207b5f3a65f3dc0ba6cf5a57af914d6ee23ec3324fd13b
SSDEEP

1536:MwXppD0CBEBONTRqqDJSwP6z3qDH9t523:MwXppD0CBdNtqqDJPP6DqDH9t5S

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
3936	msedge.exe
3936	msedge.exe
1708	identity_helper.exe
1708	identity_helper.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4160	3936	msedge.exe	83
PID 3936 wrote to memory of 4160	3936	msedge.exe	83
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4488	3936	msedge.exe	84
PID 3936 wrote to memory of 4572	3936	msedge.exe	85
PID 3936 wrote to memory of 4572	3936	msedge.exe	85
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86
PID 3936 wrote to memory of 60	3936	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ff1584115b11cc2140f925883c4f9a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba4718
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,499176797560399359,5842499415075832287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e2af658b8ac815ae03d6133f832ae8e5

SHA1
b486f59290ca3952c523ca3ca2885448908f69f0

SHA256
4304f8d53c0706ff281b7a88e61daa8d0d885d41168471adc5aeafe1880123b3

SHA512
9fc8f0681ee0944496140c3afbe6f1dde9e216ce8771ac96c65279469a226ab876ec4a615f59986ec13bcfd80e6cdc17cdaea8718531f13b600299bde604be8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
39516e37c4f6e6be506f8d65132219ca

SHA1
ca50c3caa9dc960e723a5873d7acef08463ac264

SHA256
e117d47ed9932f577ae8c5195d07f3fd7b9a405d4cb4cc7873233a63e8b6973d

SHA512
ed38efb0df0b3eb4ae79c9dfa5aff6525b48a1892acd1afd16c600d176f16fd1227bd4f1b37704f073ceb52ec5c3bd0c33560ecea736d83624c524b4e9630df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d45978b55973b8773969bed68ff46599

SHA1
f8fb7ac36edb9eda69264afc7ed7c587cb8387c5

SHA256
64f1b0c9a18424dbc18e1ee77509cdfa79df9c68849fae2def725ec0a88920d5

SHA512
32564cd5fb9490fa9354e2f61656410d61a0ad284dcdf979fdabf6cafb7675c59551b9b624983ad19cdb2cd619f0b17dd71ad970d9ef7747e14acf9f67f8ac4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2eee90ce5a88ddce2a50d0b2241d8aa2

SHA1
6eccfce961f0a0ee5153dcebe13067b450ee7623

SHA256
ee53e0b61c774804674e3b12bcb6946cf63e56005839f76db0f64ad200cdb48b

SHA512
53672b87cbecd19096e878bbcf4af4c36f01fc5f2d8ef34f874d831b7d1cc03db412d823c160dce676f195e82dd23027037bd8b8c1966a5892e476c2ff474463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f4ceadb436a66f36907d1cda3c75e69

SHA1
1008619ab104ac894de3945a955fb2a5c312620b

SHA256
526ecf1c506ee7a7f68b920bc6fbe69b0d400c78d1e85fff18e41923c8025812

SHA512
06a570eb0779137e9c28092382134b6df364d564f232ad785d3866f41d63197b1e9540b8ca5705cee03301fa5865f478b0a99e81000cf57e1ffd2028eab32ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81572d2c16b9f85e70dada2e944ca636

SHA1
4236d923e5e50e197a1eaef9cefabe36436df3f2

SHA256
1dd37034f4841ed7911cb158c2caf6ef3663a0bca5dd99e1589bf77b23b251a1

SHA512
1f22216ecc54b1a40366dc3aeec0fbf7acd819e98447229a6c35a3d8bad3f8258cff590b045cf951cb2c611c591059b8e2fc30c0fb85732b655e996b18f90cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59091afb4d0d26dca7e801cd537d755c

SHA1
c65fe2287ce3aeb4140df3bed342d378d5811c14

SHA256
cf13ca580a781a8cb2332d16b0d72a7091c85bd4e2cdaacc763c10c58c416217

SHA512
c4a0c16196d3f0cb148cbf5f2f025547c1a944902bd4bf6b92c2d239c43e378de58ef3317862e89222371fb56c871454ffaee9a33bcaad678acb35c2e71c91e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2bec3f9cc2fcb74e2346458dd29fe4e8

SHA1
c5329ceb0c3ed3e6cd2bbb03b0e6ca79d8cd8c17

SHA256
936113cc816efc50047986d3417c7a7e1829164e19a843f5cd5f204f135ba3de

SHA512
2500d5a6a867e2fe7696d053aa8ed6390619c7794f5de13286965a7b8fa6213c4a4f54795e1444318cbdedec534f2687c4055c61f36ff132bc51d0f3b4414411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bcb8.TMP

Filesize
203B

MD5
2a0253359d57f643faf9241cfcb7958d

SHA1
91d2591c38979d3286a9d8a320e647bbe8b80eba

SHA256
0ecb0392bef056f6b6716dc32f0c15e4b506245110348703a47418fcd48893cb

SHA512
3136f2d8f6b63a5ff46e6d883c40e77656ff33f73b0128cf526a3b0a19da0abb190c813743de09cbcc0079a850355172d40d5086314d0469ab087c704ee1d5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
79f6964283dfbce54409219b04b5d1a2

SHA1
a0c8e815be195f7889d1bdcbd8e5f5f5d98a9b28

SHA256
f5385b307d29a17f38f7599e46b199ebfdea91ccda34bbc65a998450de6ad6ef

SHA512
eafa2a104393e5fae26b8b0a96a3f88f7f166ad910c0b3e1ef8828df05807bfbdb8d77e1e474d59cb3b10a236047873ebe6f06bc204c33c138e316c90e51a954

Download Submit