33163a37efaa82d5a6dad6c074c28212e1844f7cb12212760ef02be679595a97

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc3f7a2b7961ad276555e1e494eaf917_JaffaCakes118.html
Size

149KB
MD5

fc3f7a2b7961ad276555e1e494eaf917
SHA1

a3d4e9c9aa7ea6488a7a96bafb5e23d73d08d124
SHA256

33163a37efaa82d5a6dad6c074c28212e1844f7cb12212760ef02be679595a97
SHA512

0152ee9651c0dcce8249d102afdbb056ea9e7ce87b20d70bde62b8039a7a0ee6fa000d27a38e5df49e6255cfd078a14d437294cb721880bc6f14f6c1c5c52860
SSDEEP

3072:VRgNiD4D3ZnW/8XsPhvyE2QqQbuybkXbkNPgUIjvpqT+7MR+8N:VRgNiD4D3ZnW/8XsP9yE2QdNPgUCvwTJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4948	msedge.exe
4948	msedge.exe
4996	identity_helper.exe
4996	identity_helper.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 752	4948	msedge.exe	84
PID 4948 wrote to memory of 752	4948	msedge.exe	84
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 2168	4948	msedge.exe	85
PID 4948 wrote to memory of 4844	4948	msedge.exe	86
PID 4948 wrote to memory of 4844	4948	msedge.exe	86
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87
PID 4948 wrote to memory of 4864	4948	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc3f7a2b7961ad276555e1e494eaf917_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffffb9046f8,0x7ffffb904708,0x7ffffb904718
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8388808385238336603,5147378709649962109,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00021e78-4a48-400a-a81b-393c2fa9d2e8.tmp

Filesize
1KB

MD5
4a9814ce3f80745b7a3ee0a142fe209b

SHA1
e497247e37a144c0f2c8ea4d3940eb3ea046e708

SHA256
e42fc0808121838577cb6666bb05a8cd95d95893a5d37d300a29a8b54176ae48

SHA512
0187981dcbba77f95c009c1d5c1ed3d53e816d3aa09c41aeaa2a6b5adf5545726c928e9e4cc5c19fb1904167555dccaa31bb380762e0adc4f1b61b800210b511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5abcdf03c8d355ebefbdbe3d39a574f0

SHA1
142526be288af0532e558e0a8e30bd250a6f2e80

SHA256
79af349ff619d8f6035c91e4c3dbd6d407957f0ab14cdccbd5e1bffd928a8e6a

SHA512
186ab939131b86fd32b11f2222a7d04e0bee162deaba0c9b69b926e6454b55e5d72dfc999d77f8ab9964aa896b1b4400a5a15e7d383ddb77800eeeaac76c02a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14a1dda39bdc44c2457019809d365bc5

SHA1
78527f55e7edf17a51f12b74c25c81bd710be831

SHA256
d26d40ec9c71a1b25e7004fdfa400ea5c68495516dede68c3231d08bc83e7d76

SHA512
0617b6b1c1acbdd9f7e4f66e3db404b3ce4fa61ff56c0d762788fa4a6ab4048d0e8dae381ec1f83018a861dd6709cb01c3d77c19a3a77fc20e2b6e1fa1072824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f19090b94f12f229c08fb3eafca38b4

SHA1
428dc32222d81476bdddeb7a082b7e384d204d96

SHA256
58fc7ee32922f1d130a413a1c8c0cc7b11d3946c51966ea6ec6262218c97d2d0

SHA512
4ecbe278cb3fede62b4820bd5badafe929a6d3df321e640bdcf79fd7bc31497bfb53b424fc16314b704b86a75ff93d7d7a32e2f0cf8c76d425abbac9954b4d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3271c6a530c6254508d8c526f7d4a5b8

SHA1
d53d90106f4d9f1ea77df4387fbc5b1d82eb4acd

SHA256
18e14d2515fc86a9742b5f834c0412b009c8902d8be4f67b26983b1f03f3052b

SHA512
3d53d91b77d36d08e50deb6b416b6b290b439b72be4d69ddc1ebb1f4085361ef0d34efce349377db0cd8ac889e2061964efacc07da48be1966c8cffec5963227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
c73e97939818500993f794a29af6fffc

SHA1
4cdf8b3a2c0a5ee70208498a34e04c5b31fbf5ae

SHA256
c7d5b25b9e2b31c335ed86251db88ce167870989d5a2f30cc29b2a19c8bd4dc0

SHA512
8a8df845027978a5cf7cea5848fe62049e3c5d26ad29f5a2f3bebed91b6c0e9303184ca6c861bc7a3c33eef44d9872fd91934330549dba6044068159a7e8f953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579366.TMP

Filesize
371B

MD5
83215e3dc0ef2ccbe42bb35b0c216119

SHA1
580bc9d7c75766b27ec8e2f02bf0be4ff617b913

SHA256
c90965f0808f5ff7f0152d1f9f963bbc8dc7bb5812c1432b8707f6c82e3c809d

SHA512
a3d7fadd3fa6c2940628f706e4469f140d15bc654bb2903ccc34c8ab15f92d174f39e7deb248b0abad386f30626fe705b6e1716c503abf657f11882c5737eb7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64e63fda3f3b10352f3f33f39d9f0faa

SHA1
f8bf6052cc6b11f0ef434144c63a4caf169685f5

SHA256
d4ca8bdddd8a4b94d78874136edc12acf3dc028528ef7a1c4d61cd293b8279b0

SHA512
e5751ef30f6218f6402745a2f74e82e3c6e5f28636399d5245b1092aeb7201931ad83e02a89a03a90df5fdb774fecd1b619a911731e0b3a3f37d90a16aa9cdd5

Download Submit