b1dd3d861fbb8edc28adc7f23238901a1ff392da25cf3913a3eb4718ff14de3e

Resubmissions

26-12-2024 19:37

241226-ybv55swney 10

26-12-2024 19:36

241226-yba5zawncv 10

18-12-2024 18:09

241218-wrt7nsxrgk 10

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc988a1c324b0af00f493c21161369a4_JaffaCakes118.html
Size

151KB
MD5

fc988a1c324b0af00f493c21161369a4
SHA1

7e5aaa432dfc8f6567a2eca85925de62be9a4ef0
SHA256

b1dd3d861fbb8edc28adc7f23238901a1ff392da25cf3913a3eb4718ff14de3e
SHA512

51bf4a012b048a4c60b01b55166cf0dc0aa3915becb60e32730eebb1b5338235dfed45516a4dde87ed5b9f1e37da9d7b20406620e670333bc93de06f94ba889b
SSDEEP

3072:cwFJ6/15vmVbzt8aN3tQq22xEPKbcBc0cIuchy:cwFJnXt8aN3tdF

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	sites.google.com
13	sites.google.com
16	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
4880	msedge.exe
4880	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
3736	identity_helper.exe
3736	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3628	4880	msedge.exe	82
PID 4880 wrote to memory of 3628	4880	msedge.exe	82
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 4144	4880	msedge.exe	83
PID 4880 wrote to memory of 3720	4880	msedge.exe	84
PID 4880 wrote to memory of 3720	4880	msedge.exe	84
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85
PID 4880 wrote to memory of 2608	4880	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\fc988a1c324b0af00f493c21161369a4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4fe646f8,0x7ffd4fe64708,0x7ffd4fe64718
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17822472186261492056,2160118877101623407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
bfe6874ad50d9debdddb1c81504d35bb

SHA1
a338d721c61586ec1ec1f316e4beb75a069848fb

SHA256
ed5d8fe39b04ad69854046e0008a434dce70e175cd6ced54ae352143749823a6

SHA512
93278b0c3e981352ce4a7e7782e8f2a4437710d6b5c7a8d9f55a85ffc4c910f5cd47c057b6960c496d9869867725d937a86ebc44445f956cd4b2ec348f2a94b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
d5ac2ef4435f2a13b29c230621804e2a

SHA1
1f4d178430f364c8cd3858d6901141c5fd2ae509

SHA256
2a5e3da42f7502c711bc070d1a990bc683717b4ffa2902369e48b3c0e67e5d2d

SHA512
8c4ccf072ba425df21733ff3036b6effaf8b8f7da4db531aaed13706d7e86c23c7ecc5e0e2f7f4736b1710216a0b21142f2180e817d8007bb2b967f74c94235c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a7301637ff85857a4b37bf94791ba84b

SHA1
b3d8a078bf5d9d26a40642365518dbb4cb14e4fe

SHA256
1279476747450bb4697a9bb2901243e00c0c194d22dd9bbdaf99d51ce9b1153f

SHA512
0b09bdeba61114aaf5e1d0da2a02be8cdc3d9e607c2e44d6783c86c676ad9866a826e9af27b88a7ccc9ea2f46c10147d8a74db2d70484b6f06df5fca1f2ca069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
15cb9b815d59d5d55bdecdb413593866

SHA1
76337facaa55f85419c26f011296c00e6da1a343

SHA256
bd99bdcb1ac7eb140372b289c7fee25305a5567a668cb0dfd3789590f73e9952

SHA512
03f9a9b30c2164d7a19c374ade8cdfde14e60f5db3161abf4e1a2015c103b22c47025d1b7201335e6b429520f3c33ebd60694e567a92cbee2b11918eae9be811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5cdd8f6e3cfae56db86969932314d03

SHA1
74e4acbae5a024f4953dc1a2073f91e323d672c7

SHA256
91388220188e39f858997d6eeeb460555ef832fd94eecc02cfb54d0716d6dfb2

SHA512
15ee1f555a61d78cf26047ba310915f0bfddb0c9da8c1a047d7e6d47a4e2d5b90345a8ababdb5c6dcb0f096bc7fbde69b098af8a8efeccd14114be6a72688edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
484e459ad5a396e0c050fc39cca69bc3

SHA1
1e27322c98857159fff3c4516f6163abc3ad87af

SHA256
363e2a1f988ac1c9fea258797c2ec2716a8d19bac5b2fdb14966598ebcd77048

SHA512
5042c98c3b2315740766fce18bfdce2932ded2a077dc12a9c52de8e4311f58e327e3596e7058a05f986fae2e27392ed017c5ec80a74c84608495a664b8f12bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9594752d9a96b0c8516afbb22c133e31

SHA1
e97e08d97a3ef2926b9fc6d47074b4bcce004c23

SHA256
82f5a20051d9d4acc64769ad3a96df3ddfc41cbd1b0fa5ae3e6a026f0933beaa

SHA512
5030cfb74cdfaaedf3328e09e0534bde027ccac058bf61f9ba6812e27658eba4d18d6f67709956d81a093addb195fe52aed1d3f2f7c737497c8a58d2bdbf7340

Download Submit