d5475151f166a3a16cbb251d390b9a545d237982eff123faea12643dd0f4bc98

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ec850e5417ed5eb62fc9e176a779371_JaffaCakes118.html
Size

281KB
MD5

5ec850e5417ed5eb62fc9e176a779371
SHA1

db4058c89506e2c84dad68736cf97bd71519d135
SHA256

d5475151f166a3a16cbb251d390b9a545d237982eff123faea12643dd0f4bc98
SHA512

f6ba087bbd7899fd6813197e89a198207e641869536bceb10caf783fb6e2c53a765a5f7aa6295f89b84489acb25d76bf138a9c2b0571e7d96bc9fef105f9fb2e
SSDEEP

6144:uAnNntX416RZqyP4u458vz6kvKy0wb/mA:PHRZqyAu4OQ4/F

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
4480	msedge.exe
4480	msedge.exe
3772	identity_helper.exe
3772	identity_helper.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2432	4480	msedge.exe	83
PID 4480 wrote to memory of 2432	4480	msedge.exe	83
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 2372	4480	msedge.exe	84
PID 4480 wrote to memory of 1940	4480	msedge.exe	85
PID 4480 wrote to memory of 1940	4480	msedge.exe	85
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86
PID 4480 wrote to memory of 4540	4480	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ec850e5417ed5eb62fc9e176a779371_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f78446f8,0x7ff8f7844708,0x7ff8f7844718
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8471718684016468723,10577576666566579624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
8c9c5665bc956807322cebe5f83832c3

SHA1
e5cae5ad3b2dc9308c2a361cadbf6ba9fcd0ffac

SHA256
e1f3fca467fd20d739063f74cd83d40f29cf069d4689cfe861e731b2736e8424

SHA512
bde24d0b1ec695aa122aabc574f4560357c5b59d051fb264f9d44280eb1cae7a0e41655a36870867b87919e4967633e151f4e3e54098d18c0988e902442cc16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
741a252b47ea10f5f015be15e2bfdab7

SHA1
e82365f4acff35d146e99ea24878611af25e1d67

SHA256
ed223ce01c98eb2a2e92ea5dce3042d4b20e30721661fc17ad043e4d6f2e6879

SHA512
dc3deb6f113fabf9d0b42723978c31817e7a7282fd782aca9dc0a6a99ba9606ee813a27d7fcab3d4b3368531788488251966b54583b98791a6c6b5738af789db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2c85d8f1bde52f52dc79948ef0f02c09

SHA1
120cc626c0807f7ae9af60da80b907595931a748

SHA256
990d0a2eac62b557f012e1b7885b9d523e542460cb1e484fd0994ad6de53534f

SHA512
d087238c887c533a250514241aada7a2296181db92240a96041ffa23daddab93f205651892a927a66bf422e348338c91bcf9c2146a2bc7a9ee18a3bdd10a945d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
145aaee73702d250dc632cf93e29e1ae

SHA1
0232ee33f6142dbe699c85d72dd1d98323c5d97b

SHA256
e87d5d6362a047c444b99fb23a010213e1cf3ef84425a0866a9877c44e84dcd1

SHA512
5f4a99e3b99648fb55fad39cf9495b00047d9e25fe5af7b614ded2470db061551bf685b625b40d0eb3ebb797cc7e158bdf783b96a35d2701c5a67ac222a48c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5c8972fe83f0ab5800c1d75046b6c3c1

SHA1
a21b1c8071f6e5b1111a9eeaab3c00f9ab105b71

SHA256
fc12ffbf2be31173a6995afb4df30bd1ba81c0e1569e23c82c899c83cd97f293

SHA512
d4c931eef8642e57dcd84d309e363a22dfb813b5b4b65a1c00fc001355528df1adb67ac56ef8711155b9caa4300c5494bd85e8e9cc6e5c8813b868105c77bf7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
edde166946524be31ff54cc11b4a9e4b

SHA1
2ed8f1abb5ac262f77ac6d98abe2ee69230a68a7

SHA256
e59f36d25de4f07e8ba07cc6c9e4c5dc61657349c4cf2f585609569869029640

SHA512
ddf6396a72a8ee98186e0232d94ba44ab04a05e0a2b045b6009afbe9e7653e660fdcf53885a6317de5268dbc523b2d08b086be515e0e8ea06e0102c86be82e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e7ec728d2534a8cf8ebb3669eae0d95

SHA1
35688aca0975599d3823b826a7607ef43b8a8ab8

SHA256
41bf075cce0b7b722c4e05c811225f8e3cd3536a093434a3331045a4ba8b1d2b

SHA512
ea6a2ef32137e9de5f81432b4569230520080ab5651a6fd87bb978ef3ec7bf7c5ef1fce08aa9c8b337818f7c59a07dfa18872760bfabb832b616aef835ceb517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
98c778485f9213f7067ca280c5fd3d39

SHA1
48daa51e0fbfab85946930bae6b512b394e7d8b6

SHA256
f56aec981cb66758e3b30a4a362f24668eb84e387c459eec2e9f1ca446d1dddb

SHA512
df8ce0b9165a2df3173199517a757dd4f3aab6d7622d3be46aac531219ec15c3fef9772bdb3b0e1c191228f072c40bfa6d59c25ecf0cc286856241dfd93fb55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5879cf.TMP

Filesize
203B

MD5
5c48507dc466a539b32b58e4ce1a9167

SHA1
6389b014dd52af949c13fa5acbfc2712e9ca4241

SHA256
f4d55c1d0c92f663d3fad5f293bd6e762bf6888474a39a3f112fea54a2cbab6b

SHA512
3077c1822c11f9c7ddaafd14b26c79467ca98c28de03c9cb3c365aa896c694f6597e5e263153fa504448c697d990e5cc2b716553421254705040c1fe1c2a944f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4ed5123a8b31448f89d8b4291f932ad

SHA1
53a59cb6d142aa38bf0d6f734e04ee8828d44ccb

SHA256
b66b24759f0ae76b312fa706a736795170e4395bbb62b9a3f55c5f9dcf3982f3

SHA512
a5e50960cc2199da9a7a351954987cae9c741783e1217d000574595ccad0350323cefd9e252d49fa46dda5c2b398c01f0b60517d62a411dae52a76d1e0712fba

Download Submit