98a7fa82a5b858dffcc5afe61debfdfd5302cb1f6c98c7f766f1c71ea453bb1d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

701954abde6b27138a944a66f558d24d_JaffaCakes118.html
Size

98KB
MD5

701954abde6b27138a944a66f558d24d
SHA1

480082fb67272d74ab80d70d33761c3feeedc8c7
SHA256

98a7fa82a5b858dffcc5afe61debfdfd5302cb1f6c98c7f766f1c71ea453bb1d
SHA512

7bb77788a48219ecb71d891e810d4a3ab485ecdcecbf5343920dcb94ee832aaba928f18d53285bbf9e973385b61ff55e1b1a58857554bbf66c354cfc62463d0e
SSDEEP

1536:imkJWvKYPSKa6nxnzP2PIdlARVGyjKtKAiqNQ:imkJWyd6YPYlAfmtKAiGQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
2260	msedge.exe
2260	msedge.exe
5872	identity_helper.exe
5872	identity_helper.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	964	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	964	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1988	2260	msedge.exe	82
PID 2260 wrote to memory of 1988	2260	msedge.exe	82
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 3372	2260	msedge.exe	83
PID 2260 wrote to memory of 1288	2260	msedge.exe	84
PID 2260 wrote to memory of 1288	2260	msedge.exe	84
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85
PID 2260 wrote to memory of 876	2260	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\701954abde6b27138a944a66f558d24d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa604a46f8,0x7ffa604a4708,0x7ffa604a4718
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17572482966824914758,10856022414470514866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x3f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
05b19331ffcd6a76c1e665bfae6444c7

SHA1
612914b60c835ff1869175814a4cb3c7b24eab58

SHA256
d275a3cdfeb370fc7c3601132af0cbf2def5c0d33bc2f7c0865c66731aa391c5

SHA512
e9af0ef8d7286241e901f77a64d4389b0a06045a0874f78c3f57f3fad4a2ce6f0a2d722ad3f5785355ba8829c0b3e1405615e66ba25ce05d486edfa048cf456a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
faaa74cb188ca51db94a500cfcb26697

SHA1
61c8bdc7d3aed93de00c8d911275b7fa91a889a6

SHA256
4592a159aa649265d5dd9c555e720b134937593066a2e91703db8a57ef8f5d3a

SHA512
2d9a90d1764ec608be80a234b6ebd4696d58bdefe05920f03fb752970ec06c8582dd659b8d0827b2cd9348f2f291fedf3a09a2b3d50d675ba1f54e61ec2c9789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8fc61872baa0a7a8e5a3196c60190c9d

SHA1
c85c9a4218d2b4d31f31f50a9cc43da97f9300b2

SHA256
e14ab1c819bf50e0964ee5b397d5a4622687a30aa710c0efeb61e9300a5704fa

SHA512
713ee2b4e6847006b7e22955e33fb21a0691fff28c1aa12e9a1e670c175eb66813588887820f01b84f566d4431aae5228c51d717e07c12e282fc7572e4052828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
173d919751ceca9f79c5eedae5d372b6

SHA1
55e7b0f35747a34e75d6124dbc26e6d56fadd80b

SHA256
3b35c9bae3cd975303cc9e311e622e545e5f812a5d2fbe616f024e5fff274031

SHA512
da0783865faa32de12261296a2feeb6660c6477213a687a68b886571e150bbd0cf5c7a108a3a1f98d5f884bc4f64c9976d288582794594bc094cc5a4056b7a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f765ee11d8a2af66d36889d59d72108

SHA1
9709624a7c895513ddfbcab18b29ec820b703640

SHA256
4eb2bf367aebe7f2c4952085e8ff6c82dcc8c4f96b4842a563cbd50601265129

SHA512
a6fa30dfbcace8bda242c44ecc1351bfd70a386af35fd97c3cf0971ca803878059a338445c5ce15163c30826cd683dc9aa3a246ea8357a121c1e4a36d1caa521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e625c833314ebce68d4e4bc48ea745fd

SHA1
62dedecba998fa5c166ef8519db5ed3df7275a51

SHA256
691d7b54b5c52ccba582da91f15bd74dfdd7e605d196e1ab1b99869adf0dd878

SHA512
bf9d51bfc9e1137b4e265601c28223362562e05bf96b2b5d06eb5c44d3ab0de9b80164282cbd4f42ff93c7b9d34359dc31d005936e47875cc7f32f7f324463f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e1ff23b2d2deee218ad7ff9a1bb54f0d

SHA1
e5718bc87de2392ca335572cc55451cd3af8a39b

SHA256
25ade3ddc03d6c59743cbb7628ad2c2e0b58b01bc1579b9dff180c854494a068

SHA512
ebf84ab91c2e928611fd62c25f56beebd51dc41e53a6308f10416ba365095bd14057b6022af2fb2b36da3694eec4946454d9ca1958570b3d278a9d08e94e4d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48267d77fad6ddefe7c38235694b4f6e

SHA1
ca83673d4e8d212504b38ab36a1df1edc6c24a9c

SHA256
8921a80937abaf19fef0e6ea0f8c94d1d6f577c14dce13a271c52d3366b95590

SHA512
ffdaec372bbcb782580120b85bd727119ac8ee1d2f39040d28f5f8fe7690ce26fff97076c99721149e7cd45b8b686b368ce7561a45454816df9bf4538d81873c

Download Submit