ce32525bce75af873569c4e689ed40908b5a2f2609819e3e91e49c54a8801aea

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

295c20dca08ac679cef6214b7637aa76_JaffaCakes118.html
Size

252KB
MD5

295c20dca08ac679cef6214b7637aa76
SHA1

18256252ce96cd316e315f901b1c75dee0b9209a
SHA256

ce32525bce75af873569c4e689ed40908b5a2f2609819e3e91e49c54a8801aea
SHA512

89a08b77987556a8837ac748eeed161d26d061b2c4c469f3a518e9fb1eec4402ab008303742515945213ae46de87da2920b0b5c46b3228650aa6a5ea39fa183f
SSDEEP

6144:Y577oBNOxpA9ANB7YtRM0RxJoEo+uSParCAvivlvYO:YR7oB0n3Na

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
4236	msedge.exe
4236	msedge.exe
1964	identity_helper.exe
1964	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5084	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5084	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4680	4236	msedge.exe	83
PID 4236 wrote to memory of 4680	4236	msedge.exe	83
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1980	4236	msedge.exe	84
PID 4236 wrote to memory of 1144	4236	msedge.exe	85
PID 4236 wrote to memory of 1144	4236	msedge.exe	85
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86
PID 4236 wrote to memory of 4536	4236	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\295c20dca08ac679cef6214b7637aa76_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff977f546f8,0x7ff977f54708,0x7ff977f54718
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7574471373068491399,12977537219282552664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0cf1e08355c161df10a0ca45a48b9535

SHA1
b650dfc2e48a5dcef59f09c0871f399242a4fbc8

SHA256
842dd0f4ac06d38f72458c31a63eeb7e23ec108e76ac1bd4bcfbb674684da17a

SHA512
67b7a36b813a67ddc06f2c6612638468848585767c57b36a4a2116c8cc9bc537c873463d97db8518ced9a2e9038a5ca67cf109f2c7f3f8a6ff574b6df3c9a5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c1a0555ddb76c6afae53281371d1c04b

SHA1
3affb680dc7b6ab591f8cc63fb7989514c64b7fd

SHA256
b5771ad28d455b60c901916995f663c55439747276a5fce15f4b97e85d26a832

SHA512
7a06b7c106a9f00957b5755209dfa500cec1ce5952091b70635e0580a3d5d72051aeec2fce3753f7e7ded5fb73163ec3f9c7c0a083f0057302637d6cf5e41c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e49a11a47e549a358fb7efc4f91e1e93

SHA1
ca62583aec1a1bc9efa7e1d4bcdbb7e8ba91250c

SHA256
43287eeb1ae4deee474fe91c1bd0a5fca23ad182a94ee20f97b700a5d85e9f57

SHA512
1807182a5fdd9055d8b40711f3d25522042a45225b4b3a0719b82d2ba329978975495ff32eb8a9d143abfbab4da041fdf888bc6ab2c55eb44dee44a7c2959204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ed161b9cc8c8a2b1397543294801dce

SHA1
fcd5c942781f9f5664d0f67933677734731feb75

SHA256
f20a25a675e8795d5b36f78dac57e73d4370ce5ecd32fb55e0535c5bc5280277

SHA512
686c632e12e55f57df039be8ac999d640a14da7accda52d64d6154694eb188aee80b787ee1b6d80282e705911b8b62918e718b99886fc6c6305c34fef5d1c028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9fb88734dd7e7dfced2dea99a6a20256

SHA1
5b7cbe7240d8f75bbe42f6227c0800bea02ee1b1

SHA256
1a657587f51244b445d2145167c78b4470cddc20d6b2f24e8d09c75d627de175

SHA512
f770a15b97858fe619f3d6e66bea21c5f249a04f33014981f47d56e0594d024270edd01b81676abdf8974d6228f37633051b2aff01702cf447884c50ed3ce8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8eb693fa5854596889f4b1755c38bdee

SHA1
093396a67049fb778385dcfd599f58fd07500d53

SHA256
c3707c4a8b58482cf87cf1319b8f13fbb0f21892b3941208b9d797a1461ca989

SHA512
6cf38cc43f31612be8cdab1616a5ba1c453ef24206c8092de7189ce52209bc81fa9fe6c45a6b4525210003bb44ff18b4e6cef05460f45d509b8324c4e80cff48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
4312267167c0e073ca03a6cd1be3e11b

SHA1
0ee617e2a9dfdd6b4baedd2a87cff9c950a10ad0

SHA256
1553d871dd8b203de84ba94a8698a5b70d43244020c64c802262721c2d49fcec

SHA512
4183fa31f8ddc6621eb192f5dd5f629bfc1d182c0d58a3e47b48b636c271b50142658a20e016c69f2a97152fbdf5d9053c1e0ac84c2c1b12ae6fb97f352ec2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
71160184e4d27e714b6bc69e7db61289

SHA1
eb0e708d4d6cfe4062bc66793fb9c6ff675f3cd4

SHA256
7bb9e7fcea1f6a3d7937a5ed594d7976fa298dca4602cb42e510ebf1df1c1aa9

SHA512
3dae43a8798e7e870c522b44fc1c1850728df1356f00cec84a35329b9a23d2cc68b2b2a176c71ce881d1ee93b87d1b2e4020064e9e3c880fb9983c1d6348390c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586ee2.TMP

Filesize
372B

MD5
63195925fc5efb987b377ae1c7e56b22

SHA1
726a2504b1e5fad931a7511276b477a39bdafd90

SHA256
4971643f80aa150578668924cd39cc17cf1407bc4c8c8f4b2221a8daa383975d

SHA512
6b2dc1374b8c3d6e625c56c041b7b920a7aa7b07f2bd234cd2cddb5ae1a54bf37465e1b70b0bedd6e7a24ea1cdf52108d503fdb4274883f6036be3d54b25ea03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
156d4bdd3f84a632b7ed8abd89d98b10

SHA1
ef46eddcc00f4c9baf420de84798dcef71e3e310

SHA256
eed71469a716ca56065624bce9996c70b52b0bd23709e44698ead8cde46b91c5

SHA512
6c456e78a1b3905c99f0fff55e0accc3071e0263d3b33d22f48393dd7c045a28965944d7b95eefcfafb19589181b4d68df6df2fc9cf1df46a19bc542a995f2d7

Download Submit