9a26172f8a83d3dfdd24a852637b5c72168e455b3c1f0bf9b1afc20ddfaf884b

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4256cbb0cf0332a2703df09cac6c272a_JaffaCakes118.html
Size

35KB
MD5

4256cbb0cf0332a2703df09cac6c272a
SHA1

9f606702fa93f9e49d07cee83d6526714188261f
SHA256

9a26172f8a83d3dfdd24a852637b5c72168e455b3c1f0bf9b1afc20ddfaf884b
SHA512

75f3ea49bd7c397dfa6546cb7b800f3030b3b3ccf3d86ae96378de52e66bda51e500d5d65ef99fb9c88e48dcd4daaf31b33c3ad50496f6592005f82a9929f593
SSDEEP

768:jlQl/YCZwFTo2YJU6hpAUSv7ZSFqekzLsAqS529xoxgnlI/ytQuv9:jlQl/YCZww3hpAUSv7kUzzLsAqSM9xo2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3404	msedge.exe
3404	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4228	3404	msedge.exe	82
PID 3404 wrote to memory of 4228	3404	msedge.exe	82
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 5100	3404	msedge.exe	83
PID 3404 wrote to memory of 3024	3404	msedge.exe	84
PID 3404 wrote to memory of 3024	3404	msedge.exe	84
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85
PID 3404 wrote to memory of 3680	3404	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4256cbb0cf0332a2703df09cac6c272a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6b1346f8,0x7ffe6b134708,0x7ffe6b134718
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17284684110939816220,9130812528004959162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9823034a5a316e6d56621a39298ad3d0

SHA1
93ce3106edd7a8db3d8648410c29dce8fada5d4f

SHA256
674f9f4817237cb1bffd5d8bb139c3ce16ecde5f8dac14ee045643751b21ab1a

SHA512
9859b1cc83f7ddcf9111d8bd4ff7ba02db0da1adc7148b882e105f34dc173c3980c93695c378259a19c5269ecddea92ded388d17af1ec44adf9f22c1ee5abe10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
bc2c89900911c8e326b84736b30e11cb

SHA1
406c7844114f7ac44ba226530e724173c28edd78

SHA256
09e979b4f5096f21a73ad1ff0bc19a9761ab384151440e8c222d0bfa4a5bd42c

SHA512
b4d5c95f0852f9935900c0f63a7f4410af29ed3461c281c57dc6ad7599d39c5d3ed0b82e8bd3c514101e3ca66344ed1294eedf1780c0917919599d075898b73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45f798cfc843b1d5d43d4d0aba4945b5

SHA1
bc081e7e9b0920353d7e446ad9ad74c82082287a

SHA256
5a66e8dcae842dd729178f89db7e90638d98272333f564fc8904dbef1afe65b2

SHA512
7fa3a5dafa7f0f5f376c60a44e2e080589464c73bd32ae1e0e360e46b489bf559920dec2800793bf4df5ab8c410ee37f5ce448154b485d7ce31ddfb500d5434d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b850eac13b15d0cb4e81204e36d1c8aa

SHA1
1adda0c2a924f3f8303733b5328ee35edbb49e96

SHA256
ea8da0570054c584aaa934f56884fc462bf0c5d34e436d96562730f33fd88638

SHA512
cffd447f9ebb3df1dd4d1ea10312932385efd6b5fb9c1f1b66c3e6b751dcc4d097556be6e3066797fb3a83a6f8dc0e4210ad72aa8b4bf9c12a3f774fdfe63aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88c04595bdabf7733bc7407ae66425f4

SHA1
87c0d9e478435a1df88417a2b573c5acdbb1f3a0

SHA256
1d91bfc55314e6e1562464a8c1360b385e0d5e70515b1a549fb49d8c6ee07cfa

SHA512
82ce16b7ca3e5861f46e167a49cb91e9ac9823b039abefa9bc04dc47416eea40ea59329075e063639d03596dfd7a24685100f1e92e64ed452bdc936fe9110f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
29bdaf131cb814275852823c1ac06ccf

SHA1
907411cf9e11e740a2cb12ad0f874bbfabc8c793

SHA256
d60f081de5a5ea82aa8ac7857b68aa95d141e8d5255b0d117a8a1af331796aee

SHA512
a5c9ff7f19ca72ef9da404da6ebfc35056df064a1bbe574ec679078e8fc64187172f392bbe13d5be93477bd9c33ba8fa07993f78f1f8f184ba337ff709d09d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9c64d5bf9d9fa630020fae0207b27e5

SHA1
98365fc783b4b8e97bfc8bc2bd97372ecf42f1e4

SHA256
a8f563dded9bf8a7b3c08fb4d4acecbbe3dcc27bfd18bba49006786d04fcfd0e

SHA512
d0b75706541179a074c8897b21f50fcd4d2ad8a883c15a948261ff518f6c6639d46a99e9c0cb4560bd0ec166c6b571c8e87fdc11b8a7dc7467e0ba563ae9dc27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
dd8a971af3a822eba6bfd20bd87f1959

SHA1
b2db959eb24e1c3b7658bd9f3136c3e40f8dbfbe

SHA256
9c8ff0b365b6f2eb55455a47e613d877ad7d83d38fd2706eef48cabf5a563178

SHA512
8c09db9cecfbec0e6f84e904c8d29660103faa2524035fa4f3423f438ea33fd9da2f2416597aa95fd08d5014f8e1b8c454866185a8b35573b372e25152496a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c786.TMP

Filesize
538B

MD5
dc0cf0f3046c13191052f7c7ef4acac4

SHA1
b8aaec3141270759e68f873197cb437b9f255b05

SHA256
71782b93e0eb7e2ef60a625f865272e5372a664b6fb088ebec895bae20f4b24c

SHA512
6997091ba985195bd7678e7360b7f13220c9208eb2af134005d239330adcd5c5c94d3914e486afa95f4fdbde5520078eb3b4973f6194d77a6cbdc14e79e08e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc483ad0897902de38b3249915875f78

SHA1
c663f5fd14a9c26711bfd3b4df5a353592a936fd

SHA256
a348275097f27858962e64f2458bd978ea3a959183adf83122be811b76030623

SHA512
ca6d616f5e7a62618c1fd44c6cec45f90addcf35346957e14efe98f3f4ee35c25d38648879d0c39f4857aefb5732f22b0d2e7146a713d0528d06aab2ab7dddbc

Download Submit