d1e287011bd1bbaf208743c3df37e443e5e340947117808a20c988eb8b41a8f5

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4279f295e3170f2597f0699a022a1d73_JaffaCakes118.html
Size

25KB
MD5

4279f295e3170f2597f0699a022a1d73
SHA1

dfff0c987bce517a15c1929da714a5ce481b0690
SHA256

d1e287011bd1bbaf208743c3df37e443e5e340947117808a20c988eb8b41a8f5
SHA512

d28d3924fe949c35b48996fc40ef09a0807f7e2b16f08836fe809f39dbe1b3012c5a8d7c9467c48e336aa7fc43d05899ee19e89e5f77b5e728ddb045d0f5defb
SSDEEP

384:cpqKDAovPn4CrdD/s0AnTgunZ8HIHyaH1BKrCeok/9z:8trVk9Tg8Z2kBFxklz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
652	msedge.exe
652	msedge.exe
1900	identity_helper.exe
1900	identity_helper.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2336	652	msedge.exe	82
PID 652 wrote to memory of 2336	652	msedge.exe	82
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 3776	652	msedge.exe	83
PID 652 wrote to memory of 4968	652	msedge.exe	84
PID 652 wrote to memory of 4968	652	msedge.exe	84
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85
PID 652 wrote to memory of 3084	652	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4279f295e3170f2597f0699a022a1d73_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c15146f8,0x7ff8c1514708,0x7ff8c1514718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
8d4ab40ab68181b85d31cf3ee41fad94

SHA1
29e9f5c7ef0e5e3a30645b03456fd268e90fcc74

SHA256
f906ebd2128d6f18a89065e22f4ad9bc9ffc398d421507e5b3956b15d0c1fcfc

SHA512
07df67ac9e96d4963ca5d00bd6fbb66f951c25b7588a12d6f9dead8b0bdd21be3f7f33b97c1ee4239187a7c1f288004bc37c67e1f16b4e8c244f6973415cf332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7424fe79b0c46fc4a9eba49c680e2c32

SHA1
796a7d2fd060e208b60f3285494adfbd25015b26

SHA256
65f264f6c5a51ee25ff19f27ab43d2ff650daa7fffeb50cf2d836aa2ab27bf33

SHA512
c95bb250ceecea804974ea793a0ed78d672bb803ff373c0b4857844a83195e8b1573149226d5d75a95285b516afc8ffa4b2c1367da76e78ee7405fe8cf05fa8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
94edd4cb1ed8bd71ea914edc1bc52b2f

SHA1
4d60b7d3857ed66507871efac02b6b65f30eada5

SHA256
99fab8fa33ebb937889316cf984d55f8341a2786df13c1c24648ded94f9c8103

SHA512
8e0e28cdcc1737ec2b2504a6ba72b4c8180a1afd4b4d249e33c96b31d2706002f9679ac439c1cb428c4508f485af8b2352877ef4f8ab206a2d094fdbcf564550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
094de655b46c5bf33506252f1f9519ed

SHA1
9ed494b8a4787266268ec6395e7e66b5788cafc2

SHA256
a0b62b379bbe3fe7ca1f62103c482a0bdf1f46e9771ecb1470dc5535e71b75e7

SHA512
fad8c4385f1c7e21e5a151091ec3f7c7170483e577cd4b3b808769527363d187438ac8f2b4b5a64622c7bc371aa24810d20d1dd9bb7c437536b13146ce77d260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
57f4d403fa2b52041059ced5f6d508e8

SHA1
96e3fd215bd3ec1e2f81f5f0e605b0cd49d2fc36

SHA256
2233ef7d5eecacd14112027d3c0d70c14bbfdfde6e7f01f6a8e4277289dee742

SHA512
ee4a6d2ed61e0737d85ee12362a21f875eb46709e2e6b0e148035cda4b4aeb641a72043c00ce5533e939b425124150597d773fe62e10801265c748f79342e1d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04b67a90f4646ab90d6def852da1c48f

SHA1
8c826d0df59734cba1de2efdabbbab78f3fbaad3

SHA256
78c78d14fc89ee909334b135c731a9763324d701a466fdede80bb33123ed072e

SHA512
676eaf90fe582494e1a86bb7a21bff6e21e5dd473479a2d4fb223eeb44d709104d70bbcc57035315dae83b96c954ee1208271c6f7b835d55db2398ce387fe5a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b035.TMP

Filesize
1KB

MD5
16e12bae119e961dd29993779894c0df

SHA1
5171afec3aa53fa881e7b67892b189a5cc070461

SHA256
4e7b5aa298747fc4a24bafce1e564bdb70b8559f4b73370987aa3d05e87ad28d

SHA512
cb13b64a99daa7f852329e000fbc84f399315d372d58b33b0640941ce8affda64a042fe1efd701d95d6f3b60fce3ffc4094825a96df99be3e5d9ef43d8bef5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b872ca55-16a7-48cd-a196-e4565e87d16d.tmp

Filesize
2KB

MD5
6a041946fc7cefa1421a299e4ca51f53

SHA1
c4a327a4fa4d333e1178cd7c289385c8309a1de9

SHA256
984e7c812c061d3f9cb4a72c2f2ad8729fe3d38346c31d75f6e361201b351890

SHA512
22a80c394c4f22e8496d45eaed3218cdad7ac45b05fb21bd31f8c7dd4542df1945c122a87dfc3c3c5c157dd8fbe3ebb197ab175be3a1a7fa7db60e30e9130059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c14239cedc250752032b0610705b434

SHA1
2537996d8727ba6bb990467962b2801a8720f525

SHA256
9751bce94cf7d8a2ae1ac57ede44c2aadb731789f84b876c6ab61201392d6412

SHA512
fb0fd8d7f891302155c334067800203f20de7c8cc2e442189957e052202b35bca3a691ec084d51f2430db05f052deefc9a3fbda8773c47677aa26755df652a21

Download Submit