5de20c0bf4f420288ca84b093d4c647c3695c4fe1a0605309c96eed37d118f0c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f00bf73fe37f280740a85eb67182e6_JaffaCakes118.html
Size

160KB
MD5

f6f00bf73fe37f280740a85eb67182e6
SHA1

c3b99cf06253521d539d92a46ada93d08203e4ae
SHA256

5de20c0bf4f420288ca84b093d4c647c3695c4fe1a0605309c96eed37d118f0c
SHA512

8a24d30c3f19398e8444c08064cb7ba8d4c707a43543937aff226777fa46a0f1d60c6729086d41a823f4eeb4b448435f064afc6f385ea4b2e97124e34633f7c5
SSDEEP

3072:OBUwNoQz/nD2rC87otCvO4ebkLlRIMoS7wY7h4ij8mYW9mLnuyspHlAeqVr:cY6AW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
1764	msedge.exe
1764	msedge.exe
1748	identity_helper.exe
1748	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1180	1764	msedge.exe	82
PID 1764 wrote to memory of 1180	1764	msedge.exe	82
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 3016	1764	msedge.exe	83
PID 1764 wrote to memory of 2424	1764	msedge.exe	84
PID 1764 wrote to memory of 2424	1764	msedge.exe	84
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85
PID 1764 wrote to memory of 2892	1764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6f00bf73fe37f280740a85eb67182e6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2e0146f8,0x7ffd2e014708,0x7ffd2e014718
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,49277876431543551,4011669903652941802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2d6c85e0c390befa0596e0ad235838aa

SHA1
6b8bc2e870d3c3d0864f929942832fbde577c300

SHA256
ac4d62b9e8bbe1158bab5290c76bc3b7c514f06806435798e281abfd14f3957c

SHA512
0548c08c9d00aa53327ec36e3ece5865a64f3115f7aff0e0160cb45613e83ed50d056c384914ed883492c746aa925833856335ba6aaa1f217bffca49386d4aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
52ccbdc746b686619bef8570875ff982

SHA1
5a5161cc51ddd4a52a06daef705a1f036dbb612e

SHA256
a5be7806188f0f653c532e6b380114283d85a4b650c3d4998f1f9ce4123b171a

SHA512
93a6936706f76e8a970dc7d7f81a02e6ca537c1d2851c9e37fb3450e30289d0af199b8aabceefe5cc377152b128bda96c8c9bbe84697bc45497841260ed9552f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4531cd6bf579b6a2ec49f4738b763c84

SHA1
5a3218b54719dffc41571df9860da4a5d394935a

SHA256
a620222b245915c2efd448eadcccda1c4759fbe7b0b9b4139f6f1936fa24119e

SHA512
f16e9ee209746ba8c8c9a9bb1bc6a36ef08423677e68ab2ece159fee51d1555f61ad1cc6acafa65436f611641578f4ca3148a5850e97ce4962a19b8651e11b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b49f42b6764bc65b0d039a6b35622e2a

SHA1
1ccb8aac085ff004b0a75f6ca944d2711e8929eb

SHA256
32cf3cea125b2d14383101edc4590f0c7f5b075306bf2c1fee63682d2716b03e

SHA512
299071578fbea11dd191ba3efb9a61ae51dceff48064b8dbbc56c1ce0ce52bbef51902a872c7a419a63368a2c0cc317de160c142e93aafdf7fe404f210c36146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cfe0dc49b3230a4d7f06fea886cbdbe5

SHA1
56742a2f9ebec8167de43c5f67cd33bd52bd356b

SHA256
5284b502c2b1a85d740a969331f265befac29494d7e9878c8f9e027c93665683

SHA512
2c72c0803e069347f381c37fb90fa409507eb5c763dc6f8b84751bcff90dd3260db9d83952e7cb040a686a374c39ad8f1ebbbbff5308bfe86baf0b488735c034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a21513b384531be79362a3b44fb7b72

SHA1
ae936494ff3994f32a3e9858b163f8e81d519766

SHA256
cf0d77018711ceb6374cf54e67e5a5416efe2a887fcc4c427231239abdc572d0

SHA512
a21dba81f863c6221ffd6d4379e0d5ef97551b1faa14047cd48ae0986d9e6564fa333460360b112dadb7ead2a11f77bd63d09057e79071d38968a14d0437a89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
0880efae3ba5d40d94831006a4e3e74e

SHA1
708085fa133ae950e151b6cdd69665c8c57103e4

SHA256
b1e3289ee789094dc355b320eefcd26d323c53244d406eed18ec3703c15d5045

SHA512
6a44b617193f6373ccba1bc917e24a1c80035ec35f9b02a06f5bd8cc01aac99732ea30166200db5fffb4f27210699df9a924c1de90addc5ec31433b8b7c84240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5802e9.TMP

Filesize
203B

MD5
3cd49a85bc58481ecf59655a2c40df00

SHA1
d0c4b71e8bcd8cfcc093d0e287b0d7c3603e3dbb

SHA256
b5381af8402147f9acd1ed88cc11a2f2e96e9533b258037a459a9f119307d76b

SHA512
342eba77e74d23156b033e5b7d80134e30180905a325b6c215a8a8c6b4c220371d7c521ec912550b8d62e12d47af80327081c3ea7dfde77a500d3fe8644bab04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff9b672d218e39cc34309fe5966a1ee2

SHA1
7275b091ed2e9ac83a2cd2fd15a4b199b57fc009

SHA256
41515e91d3396fdc22d92ed85ffa4dc88643b1b31deeec2ed2b2ffd8b6b77a20

SHA512
20c02c84e126524bece82324732b8b2f745fabb8d600bd061b1a2264788b5e8cdc06db94f1d8541c12bba92809208c8a59c3e381b0dbcab2ec61dea623af4333

Download Submit