58feaad1c67e0711d27f0ef559219db6654d4e8ba93179096d0daa65a8bbcb9b

Analysis

max time kernel
101s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac87d7324547e88fbf142103aa28fd2_JaffaCakes118.html
Size

274KB
MD5

eac87d7324547e88fbf142103aa28fd2
SHA1

fbbc5a300891ba8cc09513fe056e8e1ce59aae0c
SHA256

58feaad1c67e0711d27f0ef559219db6654d4e8ba93179096d0daa65a8bbcb9b
SHA512

5180fe9c34967c661eba89a4c43c92ff30de5af72f542276d1907a0d39351af340189d6cd1b9cad746cb8c8121c618c715d3c76ee7b33c2b45fdefe7ab57daa8
SSDEEP

6144:h8xXsauKvvSF9HEIeDLaZN1xiceJ4sNvIn+:hWXsauOSLHEIeDLaZNfI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
2384	msedge.exe
2384	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4312	2384	msedge.exe	82
PID 2384 wrote to memory of 4312	2384	msedge.exe	82
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 3852	2384	msedge.exe	83
PID 2384 wrote to memory of 212	2384	msedge.exe	84
PID 2384 wrote to memory of 212	2384	msedge.exe	84
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85
PID 2384 wrote to memory of 4956	2384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac87d7324547e88fbf142103aa28fd2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff51c846f8,0x7fff51c84708,0x7fff51c84718
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10625361380880353834,9042879478307129105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
bdedbffe190ad3d510186a29aaa67c89

SHA1
22775f63d060e4b4fdf92a32556b9771947aaf39

SHA256
09d520e2b5cff40cb317c2ff7bde16d85327a377031c4a046c971ff7cbdc792b

SHA512
f5ce8aeae63bf844b434aebe745f351c7f4d6a1c6a854d8e34165cd0c1902dc39f7f53a46bdc425bd38c4540cc003d94aeb48499bbc77443b21a4fd1cf1b59e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1388bc81b3c578ddeb581eb5092b06e2

SHA1
db5ae29510015e1d71c8fbf4152265bc7ce770e3

SHA256
f608af0b23302f4bc8891b73f00f17e67b64fb9597463b0c76eccaae404b2c03

SHA512
b6bed7df7668947da45ecf5efcf81133943e2cfaaf5f510cf7bfaa645c3c9f56143e38c5415543a7a7f84cf85daba33e53bbca07c9772197fb939491bebf262f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fa9cf8b33dde2eb9ce90e92f9ae186a6

SHA1
6ab5f7eaabb8e9a1fe57da51940299e80a730ac5

SHA256
63a541f8221f96fb6612537359ab755cfedacd23800ea202a5147d5d1d4ae51b

SHA512
4fcc4350676056557e3020ba9d97102b714e46b0da3f235c0dcbb476cfef5b629801c70e995b2dfee6d0f74efed118c7c198f410004770193eababe1e79655d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7e83b1dbb8bf368b775963663dd8ae52

SHA1
bf86c02df99d36e0515b03688b6adc7e60aded1d

SHA256
8d55019915b3806cadc94c6487ded1ff61bc6cbb69ff5efe6513f6bca32e4793

SHA512
dff778840879f9ff9aa886820cd2398a0097c684fd6ec6d3a7598be3a268ed3e2b83b5e12bf6e7a3ba7b8321096ad2b9e97c988aae3ee041c152b61d4decf2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91ee051bc7338597bce30c38f8f34b89

SHA1
d6665999332a3d2a67e80ffc0c592496dc21ab18

SHA256
d1e2a010a3c24d6fcad08e717c39a188b38141de3067e7455c7eb58422e396a0

SHA512
56bc78d34ca673e8d6f9e3f2333d0aa49ebdd7316aecc67e1c398d2a9f87aa4d4871b8b698487f97711230151f51e6c7e6861574ae9d2806135c4a1ee1519435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8106480153e3b5f95f3854ac243932a

SHA1
449cbf021febd20e223cbe803916a23c4f899c5f

SHA256
3d2c54a441eaa66e61c14e66f7d2639e90424bec5475af6469ec76c35dabadf1

SHA512
31e9722f727a15a66ac4846fd3f60556ffdd077fade8ed71a8948b547f8b19f377eb8fd37a827f6feab649016d9d64ca36f443bb84fae60a882bdbfc2de6dcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f57d003959f23679826b79b12878445f

SHA1
f28f68c6c647667940b273772261231c0bfe0b60

SHA256
93b299e315af924cc64e708fb41a29409819dd25ad9559d7afdf3a44ca1905d6

SHA512
deb75100f38c5e8548088be0f36c9139da8d67eeb2515f295d1e858c32875a07eae45d0711052de3f1b0edd5e36fb53dfb8ade5980ba5a26042a3b4217ce7bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bea2cfa62e96468b9844834800b907c

SHA1
0276355fc18af6db5771ddce6cf70aa56ae30c9e

SHA256
abd06225ef95fa7f8c5b5c12e98506b68f7bb0cd4cfe67759b3dbaacf449d66f

SHA512
9bc7f971d113d03ae201b314af268ca7d0644503ffd1f7f45929666c2219fcedc422ec1e5370cb2be86d7498fa8b322c068a97f5005685f337b188cc514f78ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa500ee544a15bf7c569123095aa6d2f

SHA1
f0862397b94697a9cf537659015c33f49af18d9f

SHA256
2f6ac90775a2cc6e5852b623a35c42757bdad115f7781d2700edcec07a86b5e5

SHA512
94cc948c84127580c2825503149a289fd9d738181d5a0cfbcf039d5c48ae9cbbeec786204605e2d1ad9414624425b7e7a945f0ab3f51870b8db84003686ba0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4f396baf9466b32aa4f683839b53be0f

SHA1
b27e732d3c8925754db2eb4620d8670e8b08d088

SHA256
9e254f64fdeca79fefaf77754f118aa50c44eb8ef2f09070b71c899d74170291

SHA512
ad687913e9e93fc66b32f14d3d49755d178ee3a14aa839b96144bfde69302d2d14c1b74a8beb72c6b7f440e9c41ffe9495968213e7c9e513bdd619b869427b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5842e0.TMP

Filesize
204B

MD5
e866608fb08e95815678a5f207645269

SHA1
25781658cbf484a7ccb518af2037e32c028594ff

SHA256
75d3fb1c8b91cda1058cf49007610fc60b888eadecc5b1caeed17b4c981410d0

SHA512
d71bd8c05692bd211fdf91dc9ba1109efac3ba7851491f999ff40cfde0a9120f1d77c88b087507bf23e2d719bd0e9bb6d2cf985dc128dc6b5054af1cdec01e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
784718b7db4f48c3278c93cf2c8a16a4

SHA1
61f4d31b58020b4355418bf03c820024c6071238

SHA256
a22496d8b9d60470f2d7add27537295c9e7afeeea1f175ec60072a366f3800ee

SHA512
e0915873170fec911397c6b887b318c09ef0322c1f8cda75e9a6a7d04d50e6226f1807842755e94aa4a7f1b350bb18885a5427f6a00adaaddb8e2634a454d695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e568633055f117b4d82ea9f2ab83d323

SHA1
d1c65a719670c4274be4d10066a759ed6df00244

SHA256
498548ffa9bcdf53e159e4e17b494358c93bd2a7d353513dfea2e28ba817032e

SHA512
d87a4e94b19db263ca95083bb9df9034f422791231ff75c54122aad3b70a5e27de2aae83cd51f273b083e893ee7133525852570cc73bf866d5ad3d69646a2dc5

Download Submit