d77b705f05394c53feceeed67067f884924caa04cc801fce5c22893fb44e6424

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ee8a0160776008fb24e1c6e7ee51198_JaffaCakes118.html
Size

63KB
MD5

0ee8a0160776008fb24e1c6e7ee51198
SHA1

644c21449e1116a65e3675340d75f44035eab5de
SHA256

d77b705f05394c53feceeed67067f884924caa04cc801fce5c22893fb44e6424
SHA512

53b589faa31cae92d05954b79adc61ba048afe0cd42a9bbb0dce93bea5ffbc2c9340e4249df7df441078e565b05b6ab5bdf35ae07ff08b2502662856aba7770f
SSDEEP

768:wSDdjPx5oUJp4/tf1h/kYvX8l3/Za96EPlYlcnIKRhAQHnZeiK192SwuaOufv1:FJoU4zS896EPlYldliK1taOkv1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3632	msedge.exe
3632	msedge.exe
2452	identity_helper.exe
2452	identity_helper.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1812	3632	msedge.exe	81
PID 3632 wrote to memory of 1812	3632	msedge.exe	81
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 4128	3632	msedge.exe	82
PID 3632 wrote to memory of 3848	3632	msedge.exe	83
PID 3632 wrote to memory of 3848	3632	msedge.exe	83
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84
PID 3632 wrote to memory of 4784	3632	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0ee8a0160776008fb24e1c6e7ee51198_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95fc646f8,0x7ff95fc64708,0x7ff95fc64718
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,3335822618942515713,5291368583379775901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
110799a0d9e3948697e509a3667af3e4

SHA1
e74a2048994f97e3d6e68f35644b7c0a81a91356

SHA256
8a76b2d93927b852edf9830c5e4430138aa707f2ea875608bebc748bdc977ed6

SHA512
a5e25614a6cb550e7309b4b913f916bc6c196888362c226dee75dd3f08d4f72a8a5568f91a512c1f7111b11bc4c57033999d038a46469be85bc90cb81bd2a5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
367ce4d26f276b24005457ebddfd8644

SHA1
46ef6804affea93840466a05e36b474c2d6a56de

SHA256
91e91ba6527308cb5d3414d2230f6f0cc0f83675dd429197c0c52fa992d16fe1

SHA512
08fc3782c0601260024f19461338f8ddbb3e79558c6860c3c177afa2d46b7aa3eec042e2d744df0bb3c9773d29bc070d5522bd15288d150560ecf18c5479f1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
86394f3dcfe69fcd698ecbd8b5b17684

SHA1
3eb1ad34a7c13fe11da724eb1fd75b65624bdf4d

SHA256
415e80c14ff8ffe6bd69db87db0017461ba36dc9dd6ed66045e871aa7ddddff8

SHA512
4b8e76cf7101ab6280be41b4c21faf45784518ab5d532b0c5e84ade6a7af127b6750aadf23310e2be565aa309b69bcf46c8e9c36ecbcec96bc7deec565a6d9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e697ce077b579cfa205c09cbac376a4

SHA1
f26f4eb7dfee451f0cb8b9619734494709d82c84

SHA256
40790271faba7333549bdf1fcd0df0b2dbef238be0fcea660c87bb96d0df648e

SHA512
62a37ba114f1fdff0392a3f2a951c7756b29fb3cce7f16be2b3c80ff53d0aa7aaa44a24e565cd5080093a3248758a714993ef8079429994f8454959a558e76af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8a09a227b935792f197c1b251ae99479

SHA1
915eaf3ce417b0067e58524ae848448be6d6d6f1

SHA256
b8a0ca0d0ad16fdd24665f4f78b5fd8d0129e3d8d1b875348fe445fbbe3611b0

SHA512
80976584edd3df4f7c13c3191704da428931915d6c752a5772da466b22ed9fd92d9e14fdf003b823c23db1cc1a234faf5a92b22cac4f0ae9083160748d017465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c287ecdb-d3aa-401e-b25a-7835e7690ac3.tmp

Filesize
7KB

MD5
217196e9e083595f3cac6aed49ebb95f

SHA1
2691b55c7f44af0ceaab6e3dadbcebab460bfa06

SHA256
d0357fd1d515ffee1f4783a4726d151e242bdb723af6f29a26610be72ad830a3

SHA512
c0694edfbea793801a49ccddaa4fea35612cc4fa022b31c88ebcc04c0ba73ff31c91fb2e90c0f65e5e17805a4cccf622e6e191937f627a391ca07239f015597b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b61cab32f32cf99e630ba7a0a6b14d09

SHA1
3457d895dfe2168cbbb0162801b5ee79aa7b0a23

SHA256
e5f70c14e0e04353ea22e70d048778ac25a336e93206a7c3940460ef72eacb58

SHA512
36f3dcbe2e47cdef27c505020a1189b332063cdc4b74aae1b978fb4af6ba5224983507da252cc796ce2aa3f4b49884f20af77bcd0c668f8de622c64f334314af

Download Submit