75320bd4c7ad690dce4680841a4b484ccdc743d7601958ed58de1fde92e983cb

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81ded80609827be55b48e381453e839a_JaffaCakes118.html
Size

3KB
MD5

81ded80609827be55b48e381453e839a
SHA1

6745f20f0ab6e597cc3180d53ee6fb910fe5a614
SHA256

75320bd4c7ad690dce4680841a4b484ccdc743d7601958ed58de1fde92e983cb
SHA512

ca114846076658995e9257af185b31e8752689189679903f9655ba9c870d3f5b2ed40251f0999fe15ff8e15a2d8b540a27b885b482244dde7a70c9dba27ace20

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
2648	msedge.exe
2648	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2928	2648	msedge.exe	81
PID 2648 wrote to memory of 2928	2648	msedge.exe	81
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 4092	2648	msedge.exe	82
PID 2648 wrote to memory of 1248	2648	msedge.exe	83
PID 2648 wrote to memory of 1248	2648	msedge.exe	83
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84
PID 2648 wrote to memory of 3116	2648	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81ded80609827be55b48e381453e839a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb55f646f8,0x7ffb55f64708,0x7ffb55f64718
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11069565241357611168,9214727578219601629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2283d130aedb7fd4008d22a5fafd6ba9

SHA1
ab89c70d0f4dbcc2fb3c08c9bc6922f49fd73b8c

SHA256
537ea70281a2c61a64b3cf5611d1727b38a3a66c64722c4cc03991d3522c95c3

SHA512
de1b926642d290092c119e3a5e6feca80a8cca4e7d036ed09ae8e2e10562b577b40c872cdfd891830b69985de0209fe52180ae0124872a1e562744fbaaf1c0aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
c30fc1a061813d131099f0c69c4dd45e

SHA1
1877710cc3566cc5b1b8f2a39943e0da58a71b2c

SHA256
db769c7593103a7c4eac712da75cfa2cf94e25627e37fb03c7ba86f04aac6415

SHA512
91fab9e7dbdadb74dd82f85ee69a45d51ecde103c0014c58b38111ec3130ec76019ed9ad698d6649f660db2789ba06221ab6c6cd80319c94fa6b3d678a0f27ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
444B

MD5
cac3738603b2fcb3df3aa5dfb5e42705

SHA1
d5448cc67e3023c99e811466894bc71ed04c87b1

SHA256
b54839928e35d7d2d31f6b0e6923174299bfe9e90688ac4808467395cdca45cb

SHA512
d67c1648de4bfa3e71c46a54bedc222e6e85374e1a8e3dc953c6a28f20d3c49e411729ea2e16deaa5755b0ef76f7cd83ee8dd6556e0bbeb223dc484b4a533f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
475B

MD5
2440071d8d0c2da8a6cf70f322126b3f

SHA1
aae765b41ef7d2e894a738ae278f61a39ebaf33a

SHA256
659f2d71057cca88e459127c207a5c5b2368d8cd05c01458ae1f3e9d016844e5

SHA512
606eccb1fcfae6189f3e9a33266df71b94e45925667689c1dee3ee892af9fe8cad154b973bd156a5042a101dbf2e1bc5f822f668355ab883c224366abbfc2274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b84701d6038a2b70b2011f9ea13dc7c5

SHA1
e5a82203498205382b6d8bb7dde6a19442b6c3cd

SHA256
a5b0c4193d3d0b31321250310dd083c6834ef7faa36194efc498f8f06cc9ceff

SHA512
380c4d350ea085d0c4d628e8134e175e59ec6208a416305af15296d5b76cfec5c9c892378fa90ae53dd1fc7f414acdd2ad668c7b998f99de0e24a91a3379b622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cce988a74244a12a12bfbd023e9dd840

SHA1
9e9ebdfc0b7c788704fcd76abc6f867eaa477acc

SHA256
f6ba13e14c5abe6867df6538f1177708ea7d5fbf92e1fb19402a2deb94823482

SHA512
d49640b5f8780318c58167122f4fd04569484d13fa3e110ba5e0d806b5e7ca498db0d3935af9593822b0c526c8aba82957a0594888b24fff2cc55397ff4a91a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b30b3f0ccb16c68c38255aed6374089

SHA1
440c103d7fa034a459ca377b692c7e86a963f1e6

SHA256
4bef16b334c715845ce61bf89d39485f223420b6f668c3b4ac2db12a236b101b

SHA512
205ddd03d2e937fd406b8bc2a110387171a8acb50043fc52df3fac896782bdda0c0e50791927d30f379b0e776e6339e0eba0e248a48b21b5a700067f95b896fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2535065809effd24ff69dff222ac8af8

SHA1
2398d21dcb217a4d314a5aa9abebba72e5d2b62f

SHA256
ee31acd01f2cd7c174222f5b8de1a5c070a577ffe50b8bad06b9efb86fe6115b

SHA512
4f94ecb89340d333f55b75592ec888584e6fa5538d67e59153723c5018ff9561230c38127db2a97857b6b696a51813786e81da1f5ac6682db98a613d0a3489cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4a5.TMP

Filesize
371B

MD5
5ac714092397473b59fc30807ee73c11

SHA1
77649546873cd6fcbbeeb119062a0cd920e50d9e

SHA256
ea3da3373ce599a9ee0dc6eb73c41529f79b0d17a1094ad5833b14647efb6f7c

SHA512
c25dafb8ef2766ee6663961a3dabb2318ec195251dacf082fae977c0037b3f4bf3fea05450573659ba2fb870edacdcd4495ab1a35284338599fa60ee2d84dfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5a22668d6fc448f82457c056cf622ee5

SHA1
33f06c948143b61c2bea16c178a839a95b5f5ec4

SHA256
b3cf275de66e647d7afe70c5b3ce21b92a1c984e1cdb69364ee3ca0952ca07ce

SHA512
ef94b097b01543b78fd0bb365a99de7c1bdb6b7f8fd2536f7b93073bbf427cfa2cfe3d054af01e63652c448f1dbe5320896c91055842a923207a5b538c80d3b1

Download Submit