a910746ffc42ce798d2c8963ac2856b2882047e7f27af5e1ccb82278f2df7333

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 05:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e0fe4ef64ba3ad9ef2e94dba15efdb4_JaffaCakes118.html
Size

24KB
MD5

3e0fe4ef64ba3ad9ef2e94dba15efdb4
SHA1

1476e7ade9067593670fa7e144afd09fcd0f276b
SHA256

a910746ffc42ce798d2c8963ac2856b2882047e7f27af5e1ccb82278f2df7333
SHA512

83747c483b7589e7498008fa476cfd308db2175fe5dd42f92b55f1197d0e0ae2ae6a58d74fb2184292acefad015554ed7015073fdbf346e7f7f7fdec3c3d3b45
SSDEEP

384:P+pf2TdyjC5K1ZDUFIerNN2HeZnzuUKrjyG9xmKepTe+dWx:2pf2TdAC58RUuoNNQc6ruamB6+dWx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878641211-696417878-3864914810-1000\{29F31817-B8EA-4A78-A501-036D7F215BE3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
1920	msedge.exe
1920	msedge.exe
1116	msedge.exe
1116	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 3684	1920	msedge.exe	83
PID 1920 wrote to memory of 3684	1920	msedge.exe	83
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 5116	1920	msedge.exe	84
PID 1920 wrote to memory of 2128	1920	msedge.exe	85
PID 1920 wrote to memory of 2128	1920	msedge.exe	85
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86
PID 1920 wrote to memory of 2964	1920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e0fe4ef64ba3ad9ef2e94dba15efdb4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a9546f8,0x7fff5a954708,0x7fff5a954718
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8682346258768888024,17522082178500907639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a9c39b7-e647-4273-8b77-0e02dcd622b4.tmp

Filesize
7KB

MD5
2c85d393c91d55975573e1857e302d5c

SHA1
cfb284cd8f8f7153d213a6599fb9b7c7f4e4a9f6

SHA256
a5cf930655ddc97b227ecd31a8c1ee9af539cb701a0230efad9ffbde94ef34ad

SHA512
1330bf3b707b9b34ce2614bdee0f151c4121ef518822519e98741510e62dc353f14f244637dca03e7658afffe0656dd06bfebfaedbee533f19ca1d80a2fabb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7637adcc5c5865e53e6ab0697b36407c

SHA1
e4e96584e96a1cdcb0586beee0c19f5b3ea6ab94

SHA256
dd4ee2c81a207e870b1952685fb31263ca447ac248307cee3cecb4e4a0887ab1

SHA512
75257d4f6cfe53cf1b7d4c71f3370e4b3d3c674d7475618d8c9bb957aca39225593cb77bb1814781295cf9f5399555083940beeecc3350df7ee0260564775509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
600B

MD5
1e077cf8089a70c411541d58eb29fd3e

SHA1
f23a2344365c1027a9df152dd26c6a105798b54d

SHA256
89df3c8a77a164cc36226b8a1c5647d264ce7e8305da45a5957b1c13fc5460ab

SHA512
63927815825a05ab936569703251a1fe367625205d0c257b30d9e5a3e6c28145356623a6b5f7390828b3ccd35282c7e381b80df7295413b5066a7a86eb3532a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3a0f651a3ec979a085d2f908a346bce

SHA1
fb65bf4e4469c15e7ff0edf9947e8d595b168995

SHA256
97f90275200d9f439d7cdf6ef12c0a803567e55d94f35586a44f3c9f2ac2f0ee

SHA512
2a70eb775e435d850f05715659a406a5f601965051c5348d31e19edf953984c6ae612524b970c5e66a1893608fb320589849c27edb398944c2a8a872b6a86427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b14f2d32a283b1ff2dffcc07e26856df

SHA1
0c6cd4144962df441b5b23601528233bcb67b06e

SHA256
5a1957727f51ef83e374e9a12e0b4e0ca0006608d046654afdabc3f176147ef8

SHA512
8aa3bed568e76d5db6fc00bb8031df0628d20c419a0ee16ccbf5cf38186cde7d8b19f32fac57caa6db30deeb4607cfc9e68b36429dcc19353db56d013e5e3bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
4e18b4d1d70a572ff103089efa7f80d4

SHA1
5c7d611362c0a6747f5f61ee35d382ce0c69ae89

SHA256
fe4a5eeadaca504e8f42547acfe7ce71869f19eefb0f41e0c284972087c86672

SHA512
2981c4feeb8c199f97fc0baff0b7f3e35585b21d492d0684315e2d8a7c35af702b71f63f45cda9f598e1b4ac5eb31e510e625646f564b7e0a2cc74996e9c5125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d9f5.TMP

Filesize
204B

MD5
ed70bd3862005bc936a792ab6f26e83c

SHA1
51219b9de4f4100b6f9ef03ec1bbe9e48a65d685

SHA256
074c1b0f88c6fd600e3ada1e94fd0884ff0ab6339ae161797361162293faf711

SHA512
8fe883b24b8d233fa7412420cbc2eb3ad2e6384beff06e1f83cfd4efdcadf5b7369741bd56a933714109cf8b0a28d1da0ce77d9342092c852b2112d540592384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
97251f770e811abf188aef71b29f917c

SHA1
ff2c5b2ed6f8aa1661f0cb630b6e45ac8fe1e257

SHA256
ab88b704ee23e5a8dfa6220d7db07e07baf42bd87e83d8922140187d72d217df

SHA512
4acd41b86a56c0bdad7f3b5e9572718d463d5600c24219dc1a44795ee6b6025da201f43ea77ef80f1dcb16605f7bc81734cf74845b1f8893abfd3a200b0a025a

Download Submit