5a08d58deb69498fc0d00067428651a517947ce5c6840fb1afb4955c329def81

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

746ac2b0ba9ac9664bc6d5df83645c7b_JaffaCakes118.html
Size

48KB
MD5

746ac2b0ba9ac9664bc6d5df83645c7b
SHA1

ae423e3a7c3d5916ed72f91af86c8333c0e67aae
SHA256

5a08d58deb69498fc0d00067428651a517947ce5c6840fb1afb4955c329def81
SHA512

06cb7217136b7bff7041dd28b0dc46bdd2c4a84ae0187548a5dbd163b40476f5ca5f25549658db246961523441cd22ac5710e1c035d7cf76058b8b2e92c1650c
SSDEEP

1536:OtQiqTY/29eskNwX/BXvYeA/dz/TIXUsUE:OSrTs29H5ghd7TIXUBE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
2624	msedge.exe
2624	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1976	2624	msedge.exe	84
PID 2624 wrote to memory of 1976	2624	msedge.exe	84
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 5112	2624	msedge.exe	85
PID 2624 wrote to memory of 1168	2624	msedge.exe	86
PID 2624 wrote to memory of 1168	2624	msedge.exe	86
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87
PID 2624 wrote to memory of 4468	2624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\746ac2b0ba9ac9664bc6d5df83645c7b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c0e46f8,0x7ffa5c0e4708,0x7ffa5c0e4718
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2467780100123140034,7766512669323661915,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
49e47fceee430667391799f9aec6c243

SHA1
15b4724c86fdfb6a492b1a0ae77318547b63f937

SHA256
c9e89d234ceecc964e424401d3317851b30dab86b2e5b088a6b5d6af4b8be136

SHA512
e7835c62fc96785943d09ebfbd89643da13eb54ad99c13337684da93d33c45ae7e9386f5d9b75d8adf6da077107fc4c74011fc803eeb6631b44e0d1bd994385d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3dda61cfa14d279ac9121d9d5343ada8

SHA1
e7f4db8e6ef8d23f0433091fc2a2ed96bee81d08

SHA256
23ee3695e116d175fc56f609b0c87e9c4123ebbe4c0875d342fbd1216338fa90

SHA512
067f71e03bace8d21e6dca85194e33b33422f0b2b609f40c7414e58ead615e9a56cb22b5bc498e2a5e5d3cf80824d0f5d02b9e3339d0ea73a92ffe004a2cb6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ebbe77b6e0d28238c182f912f224104

SHA1
052a90dd8c965c8e1c55cf4d994c0167136460ab

SHA256
edf9093b24c4660e401d2ea012cc3e1c7d88cf5a88076d2747794212fbfea100

SHA512
4b1b4c8f1d32a07ca2d4d735d1c017aa4c00504540c0da30ba0aea322b7b3a5ee32d9bd90a08a1deed4f0118e119f6db325df1d08ab94817e5946bc2ff6385d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b89512e101d6269b9d84b60bf6b72a72

SHA1
a9cbc3717459dfcfe5b17e53c56acb67222dce78

SHA256
1ffab2d40a33f7fc4508eda3272b8e853d49c2e21b4e5d06f565ef27ede51e6f

SHA512
41edb21d5b2afaa0b17bd5abde92990e826a32941a4dd4dc3f13f457749d3e690b9973e6071085bc5b8cf3d324808a869a6a54d5459387a8a39b029ef0e398cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
0c14e4bf9d9f4c1ca18c5383cf98c979

SHA1
eb0f13493c69eda9f73728668775cfe98468a4b4

SHA256
758d38c3acf73484ab41bf3f63deecb8f975b39ebfcac83a37d8454868291b38

SHA512
0fe2f085505bc5304335807be6991d6124f9b63ec41c4e765264b3907853bba686470fa8a526fdb6dd65dd7d418cbbb709592c24ac5b1f3547278936a082b32d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ccf5.TMP

Filesize
372B

MD5
f9755ae260cb4abf8ba14afdbdcaa3a6

SHA1
0a4cce3e549b8d2d3463d67d2b77e174cf39be9b

SHA256
1461a36fe5d21409267a0047d09556bfea150d9e21c76173dd724b68a21ba28e

SHA512
f03178aa58d41fb4d3675715878a331dc424c60cfc0924e855615cc76eaa6ee45442e9461a349147b643878281fbce63525046615b90d1482f4d6112afddb982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9a415e94051b8384d47cec3745c740b

SHA1
6315ed3f4524be8786db0a238ea0e077ee620f14

SHA256
b49817f1f8c759c3fee227e3e5aa474a1e00ac403b5e9b577ed45b953f9799e0

SHA512
8c6e6f760f6cebac0cd3dae6a10e583aead24a5a8273cab526b8dfad08e43c361b51007e517ff415c8128d89d821b6686c9d51238adadd70a2857b0151e6d767

Download Submit