01946b0a2f0f69d058ec3c98035c1d43503c6dcdfe2917f6d9c879433fee1bbd

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c54e04b13c45011d0646fb3d93aeecb_JaffaCakes118.html
Size

17KB
MD5

7c54e04b13c45011d0646fb3d93aeecb
SHA1

31fa6b707e5e5f23d5a5fbd757ed6d8cdbefb008
SHA256

01946b0a2f0f69d058ec3c98035c1d43503c6dcdfe2917f6d9c879433fee1bbd
SHA512

7dbd45b251973b53ade69c1bd70899d6abeac9317c62113214aa250f9362100d510bc8478abf6652caf18a29b788dfa0f09ca469cb6f67bcd415fdac9d385045
SSDEEP

384:HydPVkAy2ZmccKLG9QS41OUwq/HMzSUwqpO/zV5n3yF7x:EVny2ZFpLG9Q3OUsCzV5niFd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{FE6E4F50-F6F8-44E9-8BCB-823337203585}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
3804	msedge.exe
3804	msedge.exe
3592	msedge.exe
3592	msedge.exe
1348	identity_helper.exe
1348	identity_helper.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1216	3804	msedge.exe	81
PID 3804 wrote to memory of 1216	3804	msedge.exe	81
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 208	3804	msedge.exe	82
PID 3804 wrote to memory of 640	3804	msedge.exe	83
PID 3804 wrote to memory of 640	3804	msedge.exe	83
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84
PID 3804 wrote to memory of 3452	3804	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c54e04b13c45011d0646fb3d93aeecb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa604a46f8,0x7ffa604a4708,0x7ffa604a4718
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3268430950105231313,7514992236825919402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9707b193aa2456f63f025c0a7eeef721

SHA1
073a4f49791f3232176835e6262749c98fc93788

SHA256
79e8b51a65f08f27f34c06072575eb40d334a45dc95460fc1e30308ef2f37f0c

SHA512
a54b1021dcfaa75abd25e8164bc0868bbd348cc8af8947e8a2c054b306012f1060a4f61e5cf45d3b933a089302390f55bf00b749967d0a654cb231e39e02a036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
6db5810a6872ece16f0f079f42708555

SHA1
566ef40aa4744a1b123149e872543f40d4e18ee8

SHA256
eef4fa620d20d81348106fc05333288abd651575fd9f7ca3979587512098f867

SHA512
633a404536f38d2f2c9a8d0bb6f188e8749af4b6c25af6320648958136fa2c84f6637d9fca727f1f264aae9c1132d4fcba5619bb05c6fc0d86f5d582562f8ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
03a435926079289b989370903a8b0441

SHA1
f568cf2c935b567ebef944535dd470202c374625

SHA256
e85af52a82bd46d38dd243b15eff62316565164878acf72fec76367dd9cddf1c

SHA512
42aabfe06beaf0fbc28fdd8c1773393dc098e9359da7a137d3b428c05afcafdda2dafcae006f91cb60c7e499c061a0e5e9af6608a133f240474fad41bdd14c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
37eaea2dd7082c621caa80459818ddc4

SHA1
9c5f4d53d98d524439354e2fd11bf864af0b241a

SHA256
05c4644c872be25e89b4ee6cc3aae430ffacac0b63fab6c62267199b0facaa4d

SHA512
2b408abbdc56ea74a034ebf8e5168046e24e3bc384a059ef058a2e86a76b29f9fcc7facf9c218257dd65821e6d8b465c501d6d177ee7de33f908cd95168a31c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5ee39066860e72ea3ef031102e7b34e

SHA1
f5f930eb43c53c8c0eb3f3fe9fa7951d3f43dec4

SHA256
6756a40d2da83110f0dce8a2fd3136f640dba7ebfc8d9240e46bd2176642139a

SHA512
7cbc008cc2c222e2ad530fdda09779817c0431acda07ec5557bbbd6cc1c5b5ea9a68798b2f97e90075522ace6ceba23c43fc7091c9af264f42dafb3ff3f32586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
52e53dcc1349b43600a5f1e4dec94c52

SHA1
0e5ff321da16787fa78759118f5b60d21c815236

SHA256
1557725671f9484db4e9c4b8b4cb93093ace7a2496638ef56818fa0f76857c18

SHA512
9a9968afabed234b4b638cf8f77df79624405e458c7859e97706718977580bae03ca479c0b62e2124422c2034ecaf242950435588a7960422a7548914c16e1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579fca.TMP

Filesize
3KB

MD5
ba9bcb8f87bc6ff078359fec14b45b35

SHA1
6f4ab0398917246baecdbc8ad048d0d220a004b5

SHA256
98665ba51593665e0c048644d2db00c8edcbb056c952257c2270cf0ad7519021

SHA512
403c5176c6390baae7bd44822a7d7547d5ec40a5b01105edaa294b03ba2e8eb7216246eabad66e4353dd91551896bdb1202fb8031e32286f228836a286fe90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e42d5d41f594cb1361d6fbc2abf7fbce

SHA1
11baf5ae7c8698ae839c39d5623a02e9c559bde3

SHA256
2b4b81778423fb0d7f31a8653c786155cea2a8f74274e69d203ae6a78960dd74

SHA512
57edc78fdd7934bb1a90f0bb37de77980d0c7c7adc89872ce162754d9805750658932b6f61051f8de873f168b54bb5320dd7df0dc550e884f167dbf40b754332

Download Submit