290b7c94d4f950e03b7b50f001b3667edded876b195accd6da6d992a3655b141

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eec562d992d3f2236878d25fcdedbb7d_JaffaCakes118.html
Size

297KB
MD5

eec562d992d3f2236878d25fcdedbb7d
SHA1

f8e360248e8924fa5599bc329141eeaf842aba0b
SHA256

290b7c94d4f950e03b7b50f001b3667edded876b195accd6da6d992a3655b141
SHA512

313f8ab08dde363b8becd23b8aaf7c1066767e73f14bbbc139112e36b368a1a333b488b71bbb23072660d7d0c498b357783d6db60a7f505135351da75b4de33a
SSDEEP

1536:GD+SbTTF1SjT6SNkltM/jVII3IbIre0Dtwm06oodJLnvK4oIFYg3w9dE6kWxEA3H:0+SbTTFxSItCVI2MGHcDiTCH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
1176	msedge.exe
1176	msedge.exe
3772	identity_helper.exe
3772	identity_helper.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4412	1176	msedge.exe	82
PID 1176 wrote to memory of 4412	1176	msedge.exe	82
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 3568	1176	msedge.exe	83
PID 1176 wrote to memory of 4560	1176	msedge.exe	84
PID 1176 wrote to memory of 4560	1176	msedge.exe	84
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85
PID 1176 wrote to memory of 3184	1176	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eec562d992d3f2236878d25fcdedbb7d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac07e46f8,0x7ffac07e4708,0x7ffac07e4718
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8046415357932445355,3156503587325933166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e94663a8e74a58e0cedd01000309e753

SHA1
bbebc10e9131c63aa78eca93ff85ecdd23c91594

SHA256
834888e4972ad3a0cc71a212c40f22dc29882ec46005cfd94f019c8350966466

SHA512
e548ed8b8cbd842f0633d4942b61d3846677b9633132dcfc1853e1a25fb01edf3d8d7c335478dc09c10250fa42658a03ecd84c8944212b62fe5928780919cf29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
0d7da01a86253e2bab2a00d62aab76a4

SHA1
be1d52a8db5f7298cb79ac16590cd57f05c36d21

SHA256
dbf9e17a2546a566ef6a65bf637a9a9cc77c8c004a9ced559b1915016df6a1d6

SHA512
af7c824a4fdbc4e7c19250706ced006616a67bf0e3cee044d476d6a6111d7dde576dfffb51e94907074495c5c1908cf390ed8089197be6ffc3845e198fde69ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7af109c1a4b26dd2b7e56d50e7a44925

SHA1
1d9b356a476d4d7b731bf6ce5780f143cf91e535

SHA256
f9840411833e15dab864d5e0a5bab6d8919495058c5fd353376055848e7325e5

SHA512
d914b43c859c6c574184a07c69b95362bf111f743d59acca9dd0625dfe031946fb69ad22442334e44dcfa59f24b9b38ec350ae84c8391b495f99b152698f110d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fd634535bb770c450282a3aa6758398

SHA1
753ec73081295490b88fd10031d786abd4a610d7

SHA256
2d5075bf41ab3e5b6305c179b97e0b1368ae5428417bd9a3c62fbd319c1fc18e

SHA512
e2a51fc193058dbaa1b673ca7ad65cce4886f4a8dfeb12cdb84df947c386a830da0b440f4610f7c5fa6fe06709a718040942d06fb720f2c2e938c7335c7fb28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee7354061a6b28e942602f40da442aca

SHA1
e10e305c807e41e6be242f0e350f5fc3fc582c5b

SHA256
ece05c97d3b2860ca43497440e1b41d3594a19fad47c835e2833056b10a14e91

SHA512
86c5743c66a2338e57bc2282b400f473b30f647f2c12e85e39ce817da812f6c4de2bd2bb7c7fa9e04f9782c5c1f3bd82c4d872601f69e62d983e610ba1d10fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
960ab25f9b3f5bd7d4bbf3c565100b84

SHA1
f5dc8a55723a121acc8b90f3d81999d7a1de7371

SHA256
5268d43e31402e147f96fb3c6b4483c73ca28a03b2e9c8d3856a1c1cf45e87cd

SHA512
b5435d739151fc7e1bb2a32bf071564d254cd442bb06c2dad58edf9b91f3e35e1c2abb21e02e35314deef33c0b0bff37696d89917aebd66b8bdca408c19ab036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f28e18f6098996a0d50b10b948f76afe

SHA1
d1693fc48922b1f40b10944f4a5864017b4bbe00

SHA256
30ce2b803d03543f0193bac445b930d285e22b532ef1f434a2cede1efa56ac27

SHA512
7e5ebf0147c7fb5e22fb8c47fe6550c9f67182fd176daed459286a442bcd6ab1a8a15f48357ec8eb28cdfcfe08172396cae4c2ce17c89c5df0135764d8566497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
b9934729138b180ddd91be98d717b702

SHA1
e0652e1857ac969ca1f0017d38beebc396c50a62

SHA256
10e545498f26422bc5da399df30539c0ded9f385321c1bcf393e0dee10100f1b

SHA512
f49aca99ae94e101ad2fc85aae899b5058721264d16c2ff737b751a86a95e190f2052291a977e0de2b1f1beda4c9c3a9fc425a96017cf1cca276e2dfdc81c602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5803b4.TMP

Filesize
203B

MD5
3ebca7fd28d0dba37d055cc38daadb05

SHA1
6a576d34257837c1bb7d3f30172abd6f7040522a

SHA256
2ca7c0c7c1cf2c10260a4d69b9c6ed8314528e2e002e0b103456126f66dd8e9e

SHA512
dcf678ba7b8d524e12d763641a0778e83b48530148cad7521f040e623d8fe576ab8d1fd2cf07370576b8a19cf6a164449cdf2d9d481d488d49a2dc0c298b6e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
16f819bcf78881282e55526c0a7e8d25

SHA1
0dc04f9d6a1cf244760aa16808ab69ccc524f71a

SHA256
de13d0f5aa7e636417a6716fa47d57ab9ec04f1da2f6cb74b035ac242cf096b7

SHA512
712a056a843f5901eb81b5c971609a487719cf87c9b0469b063d0dafdb8992b406ff9717d348d4d3564a4cdfc98590987a27640004464c0a49e0ab0833294ed8

Download Submit