b3800fc57301125b5955e97284ec1c453ad5f8bf6e490194b77a9a0cd38dad25

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c0c562ef1fdeb69ff56d667a8ae3ca1_JaffaCakes118.html
Size

146KB
MD5

6c0c562ef1fdeb69ff56d667a8ae3ca1
SHA1

7eabd2573e5870ec567a5ca668e6c90e517002b8
SHA256

b3800fc57301125b5955e97284ec1c453ad5f8bf6e490194b77a9a0cd38dad25
SHA512

580ac27a1e4167b5002d1a06c1f96e23f4f4d1057fe1069c67ea8c2860ce33994812b10d9e57482f9718d601cb485de99670395d46da7e670f9aff8958d9b629
SSDEEP

3072:qHWCZ9hUZUCBLbRZ2cKNTCj57nAk3+PLCly:qHWVWGZ2cK++l

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
1476	msedge.exe
1476	msedge.exe
324	identity_helper.exe
324	identity_helper.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1488	1476	msedge.exe	82
PID 1476 wrote to memory of 1488	1476	msedge.exe	82
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 3968	1476	msedge.exe	83
PID 1476 wrote to memory of 2328	1476	msedge.exe	84
PID 1476 wrote to memory of 2328	1476	msedge.exe	84
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85
PID 1476 wrote to memory of 2932	1476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c0c562ef1fdeb69ff56d667a8ae3ca1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14208314753959918870,15612424934193340188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
564603cbad676e80bec1b4fa6f2ebbe3

SHA1
5f852cb65dbf6e06b15889b676c34d7125674433

SHA256
c2ae630c7b89db07cf761c54cbf6c27d42c0e7e6e2ea9fc46938e1f15179986d

SHA512
1d0c5158144f5b8a59f548c904c644a56a68f34ae2c528c396b5195c814dc1762750b30db3834e6853f5c1ed0ff30d22c62d6562fbec9b856fbb0befdbfc9de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1a59aa9e5a892bc911b6e041645066dd

SHA1
7a7220d903b4c05be318f4029bd607e2b5e83024

SHA256
9246edf65d30cdacec21a8fef85ea27c75bf73cb633186978d90c97a10ff26f5

SHA512
bed2d669d261cd15ac41d72eccfbd759271bd10ab050bbd70b795bdfebe85a788683c2d974e3462a5f2ddf0bc883c3d97b356d084ae4a422713c2aa177ab19c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
557b73f105ada49f61b4db6f200a6435

SHA1
323183c18df58208e63ec287c7f9ddd85faf285e

SHA256
f0a6bc233527b1fec138671dc2bd85f12b102cc602da55ef6891985148a421e3

SHA512
ddd9953107257dc1000f885bc1ea18c63871fe622055bc75d51e63f9613cd84b95374b70705d729f8be5e719fc59199e21f4be8f99e9f47da1184449c54ec168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1378681c1a8fdcd438c56f355d8d0f24

SHA1
7d497f84c99c4427ea19c130e6bcffcea3b62f2c

SHA256
bd71fdd8600b537eaaeb213dec349f0802ff4de4e402f7df30754416874987eb

SHA512
554a8b9895e4f77cb207be0dbe9835c47317d07e3637d43c9d108d9f3de9045a738e61cd400554800f18ba4ba2128d49797d49f52941ff3da7879af2e0188580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a62375806cf268535a1e397a9acc5d3a

SHA1
a853d61f801d3a8314b662241e0959984620135c

SHA256
b3b27ad3cf2a1a3425d748b56058ba711832e3ae5195c8835f9f636e0e049bef

SHA512
eeb5a69ac6d1b8a86766baf910348cabb77ba47d3b36d135048596f4a92ec8905810798c037967a204fdec52e406b5c3bdad199bf92601921bc82894d7282d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
319e1e0c9d64d9fc6c7fe800d6f5f815

SHA1
3a04d9c7aac449b5049c8491968665ce17223c07

SHA256
0cd1eaa1da009bf1e88b65ba444e41db1cf963577f19cc8dd0ebf106fa9aaab1

SHA512
c40a06b6f83034d47edb00993e36c7d687db2d06edc2c90f19bfc08d35a49177b1a735a1c3699acc383c5d1009b62687f5f0cb2e2d5cf9ca1caa8a207861902a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8282ab50696561507edc05e6c3024c83

SHA1
f5636f31c0e7520fbc8382ac725bd75de3acd531

SHA256
ad6c388b83a926ea44a6a2799835e6e17322d8ebca8b474f0c686673287843cb

SHA512
d5f30612901f9d5d3defa8068b391a2578cc6c904c17f74fa477a881ab8c22b563f25d7eb6f2185b0ec6e00dacf0f04b4919cbc8ccad7a04305357decbc00d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
532B

MD5
2d18ec720760ba80b8167e0e22b3f263

SHA1
83efdaa4530471a7a2d88ef4c376b2aa78af9acc

SHA256
d3dfcf49634a34b788fb560d20192494864f51c9d30b50be8b05969fa79f90b2

SHA512
444c4181a8d34c2ba5c5409482c7515e933fd8f84f0f2e31782fdfe7591da6cdac3f84155d32401e886eb4b40a9df74be0e606dabe1d0b49d3e7c66d64451155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
532B

MD5
ee00c1f7f70ac69c1827c9ecb22195e4

SHA1
c60ffb7328280437c228aee97b127db0281d16bc

SHA256
e5408979d11f2118964d0afbe0fbc8e88fb3673f2190dc4a00ff0a78720d0d24

SHA512
2e1ab98d0ba85cfd266bbbd4f888e6062114738851e37a9e82644605b199c3d57dbebca18e13bd5756e0a12807b64afd28000fb759938199627c904469eeeb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
532B

MD5
a74abd39147f382d6e288ad13173b42d

SHA1
0cec7e56d207fb6c4581883461665aa2acf5a2e9

SHA256
0c916014723ea98545cbffe3ce4b3fc22643beb4dbde4b991de4ba5341022c93

SHA512
a38e49e9428d564b1380e93575e16f195b24186eb7f20722e2f3456328cfd3437bb8ecfdb4d80bbeb536e44b5530b83d821b078426a507c9e3864cc1acb2e4d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57974e.TMP

Filesize
532B

MD5
12583baa21dafa221afc45b0b88b5e60

SHA1
b26d4291ea0f66cb149155019fa9668ad498cfb1

SHA256
e90f690c9e9e98b58b5497d0dec76560dbc080b2a4af5943ee5c073be057c2b0

SHA512
629e92d696ef8007016fc72e5460c77ebcadde0a4fe2ebcb0fe8025d9fcf3a3cc6b59603446a8feced7869110fe6b7d2f895176a802970bc071e4032f34c6a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38f4baf12590afd476102c9e1d64c0d6

SHA1
9f226d20da4672413c48722b14805a9424c9d2ce

SHA256
7d518f50f8f39795e058c2a9cb9ab2b31db115ec6d6956c89a3587c5a14eda87

SHA512
94d66413b464b1fbd584702dc493ea824573bc8dae58d650b26ee1daba159efa6667d65c3d7e33e8f5b975dc7bfcb4f05bba1356c5a6de22a3ca024260dbbb2f

Download Submit