8068e59d596df275e7304f8d4587e714c6b8f60d837118dd3e2ab24a00137f98

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3c1e60c6c8671141c6d3cd0932bd61_JaffaCakes118.html
Size

59KB
MD5

ea3c1e60c6c8671141c6d3cd0932bd61
SHA1

3039b49b96e15bf4eb35068a4c50249e0046260c
SHA256

8068e59d596df275e7304f8d4587e714c6b8f60d837118dd3e2ab24a00137f98
SHA512

800d70b01023570b74ada743278a316b6b50eeb29866a7cf11b5f118c5852b3a22652f23c59a068c4ee4ff067d221f49242b58c796524de6c1a92021a3beb80f
SSDEEP

1536:Cs2i/juqQhtmQcJKOvygDhIna5K0bIFe6WErUJ2EweGlIVL4biRiVbY:Cs2iK9cJKruhIna5K0ZGlziRiVbY

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
17	sites.google.com
18	sites.google.com
10	sites.google.com
15	sites.google.com
16	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
4700	msedge.exe
4700	msedge.exe
2240	identity_helper.exe
2240	identity_helper.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2348	4700	msedge.exe	82
PID 4700 wrote to memory of 2348	4700	msedge.exe	82
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 3636	4700	msedge.exe	83
PID 4700 wrote to memory of 544	4700	msedge.exe	84
PID 4700 wrote to memory of 544	4700	msedge.exe	84
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85
PID 4700 wrote to memory of 4384	4700	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea3c1e60c6c8671141c6d3cd0932bd61_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd860746f8,0x7ffd86074708,0x7ffd86074718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17859149362492676113,12702415481439131753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c268eaa3132bc42de18036079a417580

SHA1
b45cefc71044f47253c65531835954c6e3e63506

SHA256
90c0e3010955921ebc47601d9104e70516f1cefde723e3efea7d86531e28a682

SHA512
110c16a9d3e3f91b38dd9317a00d0be2eced06bf58e0df46f74afa73b453dee6d45462f5a7fcf136eae6c3119dc36dd6685c47de411265d1037a49a9bb560f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
94e6fafe8d233c54bfd9b294d375c9a1

SHA1
12cdade9770f1e7f24b6ae9ef4dc7104f51da480

SHA256
0ea79aee4ea9857d93c86cfedf6b6b8b8096f0082e71b51abb51b0a517e818c7

SHA512
2b1c8bef83187395fd92888356d8a52accad65327d60d5c0938a3a3410ae7c1b172032a5b0ee1a2e86f095f6d5369266ba7029065173e1f77dc07ef856d060c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3313cf0c15d5f95d3901e8eb836bd0fd

SHA1
25d2aa7c6ed52cc63889b8a3fa55f0332e63367c

SHA256
e367d21bc05e002bd1758b9d25b79d85c7dbb1848b6c94d7e7f80d9050772ee3

SHA512
6de23c03754c3cd088d11bc76ebf0496be780973cfbf7f544e14da2537546b17d2b5aa627ccdaf6efe86cd499c79ccabba66127af39221c9794d4b59f145295c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc5802269b23ac77a2cfac98080e1f86

SHA1
12b8053d268038d2dfa7a41e52c9ba856f150bf2

SHA256
e45bc6d68503b594cac6e091b08ed9fbba335e4a760c3402117552a5bbcbf038

SHA512
fd26537fbf299094b33b837aa0de3f1a2f5d4ca02b883d73dbd9e775c4897e12d14954eeb4487a5a442188cc5dd71d7d17022b61ed5a428f1161cdbc03c48c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb86bf5408321a9025ad01d0dc435f6c

SHA1
e1c45184e2fad69eaab10e73436632da4644705e

SHA256
6c3f38f47a94c5873da17ea3a1280fb7dd2884f75f285d66253a57bdf9cb0197

SHA512
6baa29587e665242b6df4b28f4604660f5f525e9053c6002e49ba59600a56c0507e33b5a56914ece76ffea940497cf085e1c6651d2f16cc0deb72c7ef419ada8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b02a4a803cec94ec69536df81bbeb180

SHA1
390bedeca51322d61c7648c3e217d5c5ba6ec820

SHA256
04c4caa89e124f248ecb17848a7b5fb5f452ef3d3796e74b297da104a7555763

SHA512
924cc52f472d0a3b639df21cf3315b7f6430f76732a3615c82dc1194795102c4d00f625ddf0465b80b1a66c953eb58ef0bb32ec4d3fd51383f40c2ab60b65a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
02a9d34a3d9ead37b386c431bf9216b3

SHA1
1f407ff5836692c04bac0c98b9581015a1444cb0

SHA256
ebabdd0e79e117db87c4983b16a9ee654acf980c38175e933da65fb9b9f70dbc

SHA512
cbc0ea4e2a4b2332d8debf5b30b95021b8a40754bec1a386693b6a60d1b0d1f0138818473c86a64b1d8af6b76a6c8db29696c66bf0f33b667b38b8c8f275ed33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7c82a2a18b7a8cb1dd346f7c6c06c725

SHA1
8ce7266c6f5b4efcb8db31901c6c7faac184ae1d

SHA256
6e8971dd7f6bdf3ddbb23e4ab7a79adcd61ad4901c6d2a6ba4326123b7d29bd1

SHA512
964450253de0604fafd3556cc9255d2610ae6f0d94f6252e994edee08aaecb2e0d26069a177e78a32876155c0f85ea5a83ea232a2feb7f62dd203b9f7c89fe86

Download Submit