c0fe651315148fba3aee8d38a49fae0ae22701107971f30f12c9638d982acdfc

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46155d45b91c6e2183cb4d988fae79ff_JaffaCakes118.html
Size

282KB
MD5

46155d45b91c6e2183cb4d988fae79ff
SHA1

ec1826a55c1e223f5d47eb188ada5778857b383c
SHA256

c0fe651315148fba3aee8d38a49fae0ae22701107971f30f12c9638d982acdfc
SHA512

185d5c3b0d65569b785b0b82870420be2e8ddd8a410d00c167c94f23ce8b806641b36ac7b2a1831132221aa3bf821a8041ac9339be446ce82caf460398bda399
SSDEEP

3072:OMW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgcj3VY7RJvfy3dFoUC:6DAXmNR8/lk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
628	msedge.exe
628	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
4884	identity_helper.exe
4884	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4288	628	msedge.exe	84
PID 628 wrote to memory of 4288	628	msedge.exe	84
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 4924	628	msedge.exe	85
PID 628 wrote to memory of 2896	628	msedge.exe	86
PID 628 wrote to memory of 2896	628	msedge.exe	86
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87
PID 628 wrote to memory of 2992	628	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\46155d45b91c6e2183cb4d988fae79ff_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5ee046f8,0x7ffb5ee04708,0x7ffb5ee04718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13368498814861790281,17064727836148334562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
8b41d9e82bfaf51825f94b0bc9facf25

SHA1
9f988a1b5c14425843d77bccca491b419f115816

SHA256
c0396130b9807c0b45615aefc58fd118f64899622a1a15e5ee6a88ae3516704e

SHA512
9d1caa1f3fea8e19eb0b8dd6c131665d826bbe85327757f4469b3e41c3c5dc77b5f3ae8bb2360a3979b5607933f7d5f7064abd1f196f7729e4ee90b23571c011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
10f3af9940ed2fe8f752e614b1a285fb

SHA1
0adbc57c2c54a58c3033ce66686294f3f641d966

SHA256
dbc21af542d6ba47e7ccf2f1e43fbec07dbeb4c919c0163dc7b091c691d9e81f

SHA512
5efee7d1f80465b9b510bc2459dd4021557e59ecb7845ef1ad5f91e9a0d4c8f8cd3e8445c46c053be915e546c18c7bd425eb5cf84b0e7ec16e14e5cd663ae6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6cc876d199ca7af38917a239e3f38cc5

SHA1
df86c256fde77c9af6e147a7f57d0567103f14b4

SHA256
65191211ad979bed99cd4722d8cd294a0db8b2ce667d35eb744b40f32dfa24e8

SHA512
83064cd057ad3b393e1af0714591a7dbc40266771fda860d9b7e129d854cf1ce76c63dfe6f64d518caa6837f363286416b2e5b96f336a66a6cfbbe8eb7ee2767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
251cb88b34413d7a08e0f4aae6ed61b0

SHA1
c4a98cf8b2be795c0520986f7b9171a5a04a6173

SHA256
bae00ded4c35be9e8278e4edcc61903b9e2d820c8947c5494c5e7e7f024f8406

SHA512
fd177ebd7280f3d7801d2adcc724f877f3e32a55ff7ea07f26f6b411f93c7f4296b80e52c6593f355c1dd9071e5a936ff93d9d4f459b2a2c9691738a561ad3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
94eaeb7fa22da0d49ddf437e9b3ac01e

SHA1
9a15da100e80b74ee6c5ce97e76048c1e4d83519

SHA256
469574ba772bbd95f338ef4255cb8555ed2529c101e7d03270e87a0349b91212

SHA512
b5ca74f43affe46ff92594c41b967984e037bd7ca4328afccdacb61cd924719a070786dbdd49daf7166eb879f6a780828f4f290ae04f578fdfc682018f516797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
993e2d2b0048f1bd399f1ab591ec6e3c

SHA1
df1e8db5f7e1d4074632a04449e6bed0afb31b11

SHA256
be9eeeb2a1ecae24a4baf62c41bf93279635b7b841f46c3fbaf5fa824b367207

SHA512
511b24d6e995beb0ad59ab378953142e26cf6866b29b26efbe4880e992b828431884b07e05aeac4943c9c64117b263fe3184e5c578f898aa6fd977c6774fdbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a283190ce39cb361c9a15205426f575c

SHA1
eb2469d1538acec9aef6890f1078ec3c0f01f048

SHA256
f723fe062a1e7b4b47394a0a5c062b43d18099731a29b08c971f4a8c20d5d974

SHA512
489f122a7e99707858ec827bf3dd0f0d8ec7a62fb35c506ad8eae0385fc3b2e9d5e5ef2afc1f392067b3f59ff1a16d3dc2d13eb49366636c726c7f7d8c5dec99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
43c8f87e5e0075e4f93025e5cc5de4d4

SHA1
9297359aa001bd87c53372176922c6b96bae4540

SHA256
109843d4ba67eb9a87e3b32a2664effdc4baaf970e6f6bbee00ebf82586c51da

SHA512
27f064a23440d82a280580cc23acc9f73ac6f2ff4bacd31746defc8ed21cbbfe978ff82ad01943addc9cfbf21284e63a47b79b01378bb130c87a2133b86c9b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
cb3da26e884d0bbf4b6eabc60c6710db

SHA1
db94b337b438d4c27e67a49f8841e42b5ed61c59

SHA256
9e1abf92d1136626e565cff445b49988d07148e133c5d31e909548cf0cdd291f

SHA512
4b288036a2568413c572db2dc62c95afdb8dcd1ddcf3a97eccf445bd577fda0b2659ac2ad7c2f308dc57317bae4b7ee6cde702166d1c04156ac71faab1cb3366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
3ffccb1c7474403842981a755fe48e75

SHA1
27a01794849091604c83242e292f877ae9031c2b

SHA256
561338c754093dc5f493074d8a4a3b87d232bf5027c59603e281082c3934203a

SHA512
ad984f7c4e85fabd51b9f3984a154a1ae2ddc8dec201f9ea83f397dbca604adc182f581d0eccb93b2200ac70f0b04c2bc47a791cb030f6727ca2e54846218f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a16958d6296d44e63ecb3523319f8c71

SHA1
eb892ae5b1d007fe5dacc05a4577dead4ce91c6c

SHA256
effbe79e9716bdf306844d2e931c6d7ee88456dab086e15bcee310b833ee7f54

SHA512
7aa19e2ab513c083fc2ca99221d77fe17e5c97f88cc53e5e249e00de56395253776f2641ab105a786e5af5216c46d035a9616ecd69fc5f062bd4331c7f23a2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fb96.TMP

Filesize
203B

MD5
cb6d16467ad2720fd0de1f7793257003

SHA1
4e6468f5ec2a98916c52809075374cfb00b9a1b1

SHA256
5fa117a2138530d8f6882275b9139e9847145ae2a757808eb6f7146a5b9075a1

SHA512
f838ba1bfdbba4bf32ee80afa05d5eda1d90f94c2b650a45a44e80af2c36a5a2b45129925bdec759ddf5aa8820b908f075ef9f9bac104e8c6f0ccb581c2a02d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fa3a6fbd965618f97d64d851c758ed67

SHA1
5ad18860b6d2b1a2c97f152e1ce1b41985dbca97

SHA256
00081ee9a01e18c56c17cd812d38f963fa5bf50a54bb94a5095d8287297a8f9e

SHA512
105709a27ec4213ebbd696e5115fbb77127f89611dd2c8d820de60772a5020a5b955247788ae8fb49461a23564877517b21eee5e7a6f17f5cd655a66c23b21d5

Download Submit