f7682aac92fcbbd43aded97faf5a536a77d2e509746bfc0cfadd60537cbee161

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c5fab0d551776ee621630067c441120_JaffaCakes118.html
Size

161KB
MD5

4c5fab0d551776ee621630067c441120
SHA1

b9f143deb9222866e49bdad58146a6135c126963
SHA256

f7682aac92fcbbd43aded97faf5a536a77d2e509746bfc0cfadd60537cbee161
SHA512

abe058d0416e8ed315e04f75253b37862861214874977e06ca87277c7b1df595a9e29ba962c7760dd75aa226166db05990e507599dae3576e6a6b940b5fed1a6
SSDEEP

3072:GsDnfSnIoEVynyJlPIVowgR/uIQZt+2WY:GsDnfSQK2qWY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
3204	msedge.exe
3204	msedge.exe
3844	identity_helper.exe
3844	identity_helper.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4500	3204	msedge.exe	84
PID 3204 wrote to memory of 4500	3204	msedge.exe	84
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 2484	3204	msedge.exe	85
PID 3204 wrote to memory of 4816	3204	msedge.exe	86
PID 3204 wrote to memory of 4816	3204	msedge.exe	86
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87
PID 3204 wrote to memory of 4544	3204	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c5fab0d551776ee621630067c441120_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e48d46f8,0x7ff9e48d4708,0x7ff9e48d4718
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17237491759585494077,15385387245343743445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bc3e1e3c859c8e38f7bf0930a705d717

SHA1
3817aff25b61deca2c4571c02fe100a5ced79367

SHA256
2f57f6a0be643eb83ba991c7b14562d1c0bb69f76d9b420765ebe99304a09456

SHA512
204b6bc988f45d6631678e2c026b85b4546a9b964cb10ea90229c120ed657c59d0dca79f3073c9c9aa08b051b25995c2e3c616287739686ccdf5198fd7a5f3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
83d2ce26e8f5f0c4e05ae095fd9f223e

SHA1
74c1f54e542e0c024c2a54555c9bb68ec9b25c28

SHA256
96f0ff1187c96af360e9cd06b359f7705bfe7d573cad6865720ec998c0cf24c0

SHA512
737f2dcc8f5cdf15bc9ebfdf7c9b24ca3eb99fdebc529dbde44bbf7fa59c2a822dd9de636f32fb176ae7b50e5b5ab495228607aff8079935835d70cb803ab984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55762b1468bc0081234be6887f1eed5c

SHA1
ce54377266733c500f8805d331db90549df4af40

SHA256
9558c677283ab9d1e4236775614f12ac570151a6136eabf7965776eebc50c52f

SHA512
a9ea2aa307546c2828c8082f6c25a071bb586d83b02f36b2cffd77947782efc31a5fe32b3555a2f181f570d0533143794c6769780ef93f9a20f69b08bb40620b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7aab24699f0668af719075849fa278d7

SHA1
bd98b8f3c4f02fb0fef308187e0bb271aed42727

SHA256
79e325be74c9af2a8bd9cf186e8e5e16898ddc92f2126c9f4301c2133155f6de

SHA512
38950e8c7dd7075d44a34d196ca12c2db3c544e6303fb397a8e4e51e83e3dfdf65521253624e4374f68430afc4bb720528d50ba8202b9f93e77a7dac41f1a0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d51f0b0d69052050149dd070f02607e8

SHA1
d3cfd1965802f4f805e3c856cfa39b4406d662e1

SHA256
687de388225e4640b0ba5c5dc8bf47ded9cc15a63261ea1cb6ff55cc3e6232cd

SHA512
062c471df8dcc1f4926d80a7450495d6425d5392b2d3624500b0b45956fc44ef5603346e28653ebac96e6a66169de43861dc6a4c49da7a793c3281e02f84f49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3ad71076f767d73e594d34f2e211d476

SHA1
8f7af0c01a2d359d369b36ffabeaad85fc73d864

SHA256
d691f0646954f12a9e4e3188f5fc6842a825c2a34a547bf3e9077c0bd98137b0

SHA512
9cfe01edc1ef26d158457881adab5b109fc9e56d657af2ecf96b512b531a56b830febf6a461451b85f718e9aee087669a9546a6033ae9311fe5ccc84238d366a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
61bba6e9011f5582fff697e9eb6ceac0

SHA1
9e4a5a157c98118b7daa187c0b826cd1f6c650a8

SHA256
e91e0982160ad6686a3e82247b5174b19c4f1ea3b96c947283e7a2b27c39dc05

SHA512
8a625f240e69d1819e5199c38e1b1e296c150382283357774cacc4d9fbc79b785b1666318e8f227aaacf9e5a0e3e0783ef520ba775f283d776581aaff3e8f2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5844c4.TMP

Filesize
199B

MD5
752f86a4dbaa626d46d59d28e2373611

SHA1
bba6bd8173cd9ceedea3ba994e094b23f0492a0f

SHA256
7795b0c9ed2c55a349941b21a9f903cd41ae94d73327531295b4e10e80c946fd

SHA512
7358696ffe4a3cf56a2f462b0bd6cd208d17a42a635114d671df9607687ebf6b5c2eb3bc6f1d3051ad68f8e7901efddc607c5aa059d0a61e27ec4ce5629517d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20d0c124130c25bb27b82875ad85ea47

SHA1
5f66ffddb0f2ec9cee9b36c244ed5e8f29ea756e

SHA256
0ac79cc6c3dec43c0d4f668a77c82e56143eebf7dd1d671495de922846283a3b

SHA512
0c34555fccc0ceb28bd191f2772ac6bad07a246c1b1fed4db6da82aef621d2e5359087f22e471977d9e45e32a811f2b2006c3162c866a36097e26e9723435811

Download Submit