56483a6e46b565c3eba1fc4e5ca9160464d2495f9eae7529f5a173e117566326

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7da90881b5249e713a785a8324cb806_JaffaCakes118.html
Size

22KB
MD5

e7da90881b5249e713a785a8324cb806
SHA1

52de539fbbe26f36e6d82b702dc5aa8942c194ba
SHA256

56483a6e46b565c3eba1fc4e5ca9160464d2495f9eae7529f5a173e117566326
SHA512

9b275c58a6110ab3c69d1ded651d29c2d29c6a542ff7405534a219e2ac5d4ad056adcc014e632000354e1553a776dbe0452eec37b4b7d83ccb7b2b2714339b85
SSDEEP

384:F8an/WWmhnflvP5LEfqiSiDfQ3anVc17GKAWROVa8wNdxSIw8wnAwskkUgVLRd:F8an/WWmhnflvP5LEL7DfQ0qMKAzauOd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
3832	msedge.exe
3832	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
1128	identity_helper.exe
1128	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1572	3832	msedge.exe	85
PID 3832 wrote to memory of 1572	3832	msedge.exe	85
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 3432	3832	msedge.exe	86
PID 3832 wrote to memory of 4544	3832	msedge.exe	87
PID 3832 wrote to memory of 4544	3832	msedge.exe	87
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88
PID 3832 wrote to memory of 4788	3832	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e7da90881b5249e713a785a8324cb806_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb34346f8,0x7ffdb3434708,0x7ffdb3434718
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5532 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8166575880450506095,14209368616743052834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
  2⤵
  PID:396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
779fb1d8efa084d2532ce358a54d106a

SHA1
feb82ece003a3809a97301a30cc40e21cd020910

SHA256
415abb3d9af48e362d6b6781b12f5acc03792a86ca1569c09e626baab3412658

SHA512
0b56b6a5aa82b53a5ac70313b8e4737b7c84b9eea6e9f36bd6be356f43ef5ef63a97bda676cfb5ed2aae9a411f1a8134983b5bda7564c91de20f7f363e044d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
ed90e5ce0ab23c7fa4b488fb8507b9ac

SHA1
e8c300ab2d655de99c1a9c16a1b428f01e63c9f8

SHA256
d75f8cdd2f4818997a29c3e8498b1775c6f7e934ae45fc049c59014aa6efe337

SHA512
696b4c5b5c37ea38e0817de09358c7f9f43c45f3282ba5461d33d772aab711a6f5118d6d07e10abc37f1dac495d7618fc66365e5c59ce341ee0279d229355349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
95fa5f7e878604d83fae7b90cdfc71e1

SHA1
ec65ad0f4f29ec58a2bbe375fd19d53a5857592e

SHA256
92bce4544029d08bf92a20c8890b9595524e7f526cc2bfb89a52d942a359be1f

SHA512
1cd6a6bfe048a398d208ec055aa26deb1629b84ca83a5e97c674654696f81acf32aafa096fde86dd21996e02dcb55d799b920c2a76108f449e694507cc268a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b382b3601735ab9900080c7df9013ea

SHA1
de81cb67995a0021d867514196e391037ebdd8af

SHA256
7442f1e867d95f86d2461943b87ec43dfb8b4f6a94f50d63524e4f24e24bbb11

SHA512
d2bc6375649b3a2c7e795a8006071a1510f3bff785f4a5c376780db29a3545ec8a441e46e7fa73a9835be955136323758e1e2c7ab4945f763cfd5a0d5bdea73b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7b819dad6ca5c66b16dc9cd2ee0e67c

SHA1
1d2b296006af6830b0a5ce064e388fb31a9474ad

SHA256
869197f37440e8dd48f1bb2b34313aed796317dc2655fe0f319022440b646a22

SHA512
39fbbe1e08b1862ebacce0d0adaf5863331a4f5543849f1391ccfc60122f610d77eed1de9fc9c05505bb17ed581b4b55f2ea07d84c6e5e48041880946faf2dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7eeb4548713b3dd92866c23643e73c5a

SHA1
c83fa2a6511a7d6d14af3116611e888b17f7f527

SHA256
f76ccccd9cadc0457b9b61bcee559650cd71e0c80437f1f20f26101a3418f7f6

SHA512
0c023e8d8e84c103d737eff954929a918bb803869990480059f90b6611067c44ef869510d247163af050b67d2fe2964db421f563b508cb17b237089acf9b25ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595903.TMP

Filesize
1KB

MD5
278ce2fcd17882c9d4b271aaac586c64

SHA1
f81ceae350b8f72ee5ee9c85d6ea6ec3f48200d8

SHA256
63f7b4bf2b65607085797bfd5027c02297c8edad4d2ba09b7f11ff180da99de8

SHA512
e75a95e0a60feadb62c9e8a02960c3bce1636032458a86819352f9d9648b99041d2a7ae5326b54f04157a41faf783f427e95de35bcb586fa6d0bd3c2602f690f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cd4f2eeb68c7f22368e950a4cb572430

SHA1
b29c1a553905871e08330a9d023e8ded03534ab1

SHA256
a49986a20a5db6ca2d7234eb0de07d704c970a1e5884124c8e5272228366d43e

SHA512
f3ced650369058686bfd981bd4753f3f1455104cfcb4288c91eb37156b1f9f2056c20729b59b681a93d6e0f5ec8fbcecc9210aa758429c203d253c021ad737bf

Download Submit