2b7cddcd7156c5c7906745e16d91c69d457160397a87cbcc18d5f677d881294e

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

508ce4290f2a88d4f097051fa5fef15d_JaffaCakes118.html
Size

301KB
MD5

508ce4290f2a88d4f097051fa5fef15d
SHA1

eadfb85bd02f9d3bf11adb1504bf8d8ae0e876af
SHA256

2b7cddcd7156c5c7906745e16d91c69d457160397a87cbcc18d5f677d881294e
SHA512

bc965156c4d21a43771baea3d126f687fd0da1b723d21bdb8b709cee03ba979829d49b57b41b9ea5bb21fbe374bc84da11154a5a54c3da3a0fa8c89c8e37503e
SSDEEP

1536:71+SbTTFZSjTt6NkltM/jVII3IbIre0wbzmC6o01JLnv+SiSlSK369dE6evI8Xag:5+SbTTFU6ItCVI2KqFQIiTCh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
3456	msedge.exe
3456	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 532	3456	msedge.exe	82
PID 3456 wrote to memory of 532	3456	msedge.exe	82
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 1448	3456	msedge.exe	83
PID 3456 wrote to memory of 2352	3456	msedge.exe	84
PID 3456 wrote to memory of 2352	3456	msedge.exe	84
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85
PID 3456 wrote to memory of 4840	3456	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\508ce4290f2a88d4f097051fa5fef15d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb820c46f8,0x7ffb820c4708,0x7ffb820c4718
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,14754479805452426358,10113257499724648492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
144B

MD5
ac68928b631c6f7f6bdbbcb60b36c522

SHA1
0224a55042b7bb13bef6ea43b552a9907125bf83

SHA256
da05bce8b7dd772c1c9d0698b01b51a82c0a89e97fd82dd3ee1ba4b82a94447f

SHA512
64304497f0fc99af7b20f61e1f66505b5470e63b2ec6c9045afe70f812161b820e1c260a288a3efe395ce22f6754db9a2a8d12883b3d751ceb996a4e68f2e2c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ef96c839c210b2150813a6fd183cce18

SHA1
f1b940b9c082309dd675ac0897b854879fb8e243

SHA256
26a883007b73b47b6dc3b1bb0bcdc3d163eec1f308f1a2e7258dbc340a10d724

SHA512
75fa9d80170e1f92ea08167e0ac80d4b5ada9b202f782a1992bbf52bc25ae41653f72fc9cdbbaf03223b501f165fe12fbf4d6f1c6bd333c31fa6e576cf3a96de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
06ead115081dae6211ba086cec2ae0c5

SHA1
e57191e791401b62b0b96e24a12e1ba0e643b144

SHA256
d1b3ba794a677c86538db5a430588e2555f92007332b319b54c0de459bb8dcf4

SHA512
5543195b1b7fc8edaf21805502ffff6acee9f992a6ea56eb4391690c63af0fdaece9e519086f85901a66b6d9b0b73479878c40aa556064bb341a34f4c36b6a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8f40b46ddbb3a300499ea89e69e5528

SHA1
3600f5b2dd791d5d20c87edc223469bc9573f7ab

SHA256
dd91e359e7b93c5c46b7aa37fc64ca8bb4c5aedbc4543b3333ac65187ee5796d

SHA512
521eb55e6c8df9318f261bd8bdd2faa82d423520ef254be8eeb752b13734cde840c6b08f89e4480411328eff87617848d17839a8cc4b24d8ae5792222373f83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40b8188eef485627f672bb36a5b5529d

SHA1
5598350ac6113c64493cf472ae5b7675e5560d7e

SHA256
00997a35b0ef70fe7ec60ed984992a8acc84c70479c659a4b164f47334262288

SHA512
361d9da4f12922cb801db2a2d77f3f7235312ff5cae453685dd864587a15faebff81e883447eb531cc5878592eefabbb4252bf69e81ae9d449c756e503f51493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f34cb4bb7101220a0daeee1dc7044dd

SHA1
b8120524556c8e0dbaedbd938e19457b022e3bb5

SHA256
061973b8e3e3affb096ff9d3d848646502aec97712bf7cd2358b0ceb153dfc8e

SHA512
883f09add258616d6fde29675bd60aba4881e67b15094441b3b88517d9afad2820361e37591dee5fb1ab8511b3060673f11cc997033370c8bf62590828097ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9eb0c45386bfa4a48cdc25aaee7f750

SHA1
30d613350577be83402e16c54e0ad9063d1940ac

SHA256
6a1644d7705654cdd1f5e5cca86f702c8b9a8b20cfe988818ab13ad180e48b3a

SHA512
55e3fe81cb4f3cce807e40e0cf9f8e3ef7219fc200ea92d5e1850aabd8537eda69b45f6466737c7745a34a4e080573386d5d13635f02ad1d2d0e2f42a89e7e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
3dd784616c82060027de35b0a1c406bb

SHA1
44647eaf7b8a65881d45e09660a0521beea94041

SHA256
bfb549861653f2535e71df31e13b45d41ed2da867ce48af64b2713f4c7551551

SHA512
faf6431e01eccf27769fbbf830b043f68213add30bb4266c9f8b1cb562cb0ef86404f4b6c2f41e17b32c94f82a9165f15d3473a421b0a388fb0b03edf3133538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b381.TMP

Filesize
203B

MD5
4838b8c8b7bcc0570a832fc26ad370c2

SHA1
590bdc6696f58f6bb1483c8157a57c94a3c2066d

SHA256
4722960f8aabb555838806bf233afdb3487fd0e8e6ef9b8efd65053439884ae7

SHA512
6f50e393161c41ab6deb00c57982ecd05dd5537aeb46f71ab186015138183c700aa575df1b6c85f4febdd772df810d3315071252d0016877aef592e30631e500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
61873b27ab82f79f9975217d06ebff8c

SHA1
aa5dbbdaa3abca50d1bca2d32234d210af99bbf3

SHA256
281ff452653e36477e8dda1bc600304bb1024e9708c2c90c7a9c923b85119356

SHA512
9c8f523830996de0120033c5d4a2bda74e7841305225e4ac62cc587738347f92a418c00f1a0051de08427ccbbd049f650f0d85f0ec6eceaf8324fe9367c3013a

Download Submit