b1dd3d861fbb8edc28adc7f23238901a1ff392da25cf3913a3eb4718ff14de3e

Resubmissions

26/12/2024, 19:37

241226-ybv55swney 10

26/12/2024, 19:36

241226-yba5zawncv 10

18/12/2024, 18:09

241218-wrt7nsxrgk 10

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc988a1c324b0af00f493c21161369a4_JaffaCakes118.html
Size

151KB
MD5

fc988a1c324b0af00f493c21161369a4
SHA1

7e5aaa432dfc8f6567a2eca85925de62be9a4ef0
SHA256

b1dd3d861fbb8edc28adc7f23238901a1ff392da25cf3913a3eb4718ff14de3e
SHA512

51bf4a012b048a4c60b01b55166cf0dc0aa3915becb60e32730eebb1b5338235dfed45516a4dde87ed5b9f1e37da9d7b20406620e670333bc93de06f94ba889b
SSDEEP

3072:cwFJ6/15vmVbzt8aN3tQq22xEPKbcBc0cIuchy:cwFJnXt8aN3tdF

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	sites.google.com
17	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
1048	msedge.exe
1048	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4168	identity_helper.exe
4168	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1664	1048	msedge.exe	83
PID 1048 wrote to memory of 1664	1048	msedge.exe	83
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 4420	1048	msedge.exe	84
PID 1048 wrote to memory of 2332	1048	msedge.exe	85
PID 1048 wrote to memory of 2332	1048	msedge.exe	85
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86
PID 1048 wrote to memory of 4812	1048	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\fc988a1c324b0af00f493c21161369a4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3fda46f8,0x7ffe3fda4708,0x7ffe3fda4718
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14038994596741553460,15015355482300504185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
41KB

MD5
1da8deabd421929fa1a865599f43aad8

SHA1
88af7573c39022643333f85b523a329cb6448675

SHA256
07b01330c36ae322ea1f1e2ea70e60b629b292b3f7ee7aae5a9968dcf341e685

SHA512
0be3f8d02397c3cc32164b116c807115c42a310fd70c72c94b3b523732422ea2b222d8762e81d91ef0c36a8328df4f7ae8e4570c4bc46ab94cbed5131389ea3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
ea8f30750c1fcfb8e68506b2cee8f12d

SHA1
15dd83272019af4e823610258b6cdd0303685ef7

SHA256
fbd8357647c73f28d0de14f4447d0984db2c5b467fdecca88144571eb7c5c68a

SHA512
ed783c185c9163af965a8b99208bba610d9e686e1ad2c0fd9e356d1d7f2ceae59f3fb2b7666dacc0a9ca8642b373ef99064da92b53816c65f05b9106f9890b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
a2a59a631c693b19530a5291ca130769

SHA1
8e8853b6936a41941a4ff8a4a5031ffa6170288d

SHA256
47f9ac0ca01b592e47de17fb44e8fbbcc846254aa71c45ec17f1fc5085f51641

SHA512
0023183e7107d2b87602ebc4ae23eda774b2c8b78301f5f66f70d0d7d5689419515582a310f77f7ee60b1240f6d122f8563a54644bd38e58bf35a8de07820bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
612ed52f8d52ed2951b5d7b70631a225

SHA1
b31c3142e6ecde157b4ddec34ad97f92d5e08ce1

SHA256
e46aa3517e4e38d3d14d1ef4c47771957c48579ec95f8fc7658981380101714b

SHA512
88e46f320891de0fb95f049d101df409860b7441f4b46cfb29575961841212ed61f890d978cd2e90d8d2c8230fdad3b879edc763ad2ba5ab2c52ee50c3191618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
446b3e8c61350fe8f82995a3150f5a4b

SHA1
d689f4b3fff55ba27d5d2103411d84900675e1e1

SHA256
fecccf1d54ae50293964becd871522c7430177d9ac89c1859264813bfcd08c51

SHA512
56a90bc21311ebd07c52ab36e6d8d5e6ee9362dd9d238ebdeaf6468fd781efcd79b949d76f22edf2747eff3aaaf1461fcc540bb7aeaec782e016555c50300433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96b952fd9ac216abd66e535b6089f4f6

SHA1
46861cebf0f884416559ff85f2b925d99da85c0a

SHA256
bdb7464dc69202dea7f8b007c6d2a30fee342754b8233026f460fa2b2beab43f

SHA512
ec1b73a299b19b177f9b391601ff292fa75aef93f3057764d8900aefdf7af5c94d0d6514c6abf558203114c5a10bae27a78fd62ece465216f6f41c066c7a4059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
22da917a127aa66b3a4fe53abfd0bec8

SHA1
ee80eacf9c22e51030294404ab230bb244cdd90d

SHA256
930a837a4d9d5fb7b1326dd1ac01d65529bc747a34322dda5f401e9f8bddee57

SHA512
35fcb2932238d2ab4a36710ac63db3b95d4b6cd6782dfeba52e0b4b52712797b0d85788b92c1df76e76bd9384c55a20ae3c856ef4bb4f4729949362846d29405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e4b53238d48827f2a6ac42573d575c54

SHA1
385d5371fc72858ad5013c0a408632f724061d7b

SHA256
547b2590efeef95a8473a22d22e19c13c73790de656f9e4e9b8d2f97f85a6c4b

SHA512
d9d8a368f180fceb2d9d509d443fce5852a826d890e7cd7f17064ba63fa9a654f04ca224304202bc4c4f6c5eb0960f6c146acc764d0ddb2145c7934724f873ad

Download Submit