25dcb71db7bd9cd0fca89519f6111d0b6ad65892cec4aecf0f9c3ac77cc3e389

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

893238e5c5a4a5af47929d6ac66c2837_JaffaCakes118.html
Size

198KB
MD5

893238e5c5a4a5af47929d6ac66c2837
SHA1

4f6c392bbfb9d8ad28ca3dd5008c8a3d5bcc69d9
SHA256

25dcb71db7bd9cd0fca89519f6111d0b6ad65892cec4aecf0f9c3ac77cc3e389
SHA512

e2d4408440b2bf8150845df8ea6d4165c62569c84e9f449377f0ee423313dc135b8251a94667a558fdff522162034cec3aaf9956c9da3088ffc816eb1179ebad
SSDEEP

3072:P89ZEFS6t9lE0EYnWL6bYDP4Xeduojn4HE:P8wFS6t9lE0EYo6bYUO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
3696	msedge.exe
3696	msedge.exe
2220	identity_helper.exe
2220	identity_helper.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 236	3696	msedge.exe	83
PID 3696 wrote to memory of 236	3696	msedge.exe	83
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 3768	3696	msedge.exe	84
PID 3696 wrote to memory of 1452	3696	msedge.exe	85
PID 3696 wrote to memory of 1452	3696	msedge.exe	85
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86
PID 3696 wrote to memory of 3840	3696	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\893238e5c5a4a5af47929d6ac66c2837_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe48be46f8,0x7ffe48be4708,0x7ffe48be4718
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16753198928358293688,13458185884483251349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a1a455f16188addffdba96e613cc608a

SHA1
b9b7eecbac888667a118c8d6bf46c1bfe35be50e

SHA256
4d0d046d0c180ee69cb8b87ee86ba9ff9bb2c8cec62c672f84399f870164afc9

SHA512
0b465f13e41cabcb5beca30f296b5869328fab28333e7d690f29f8b0792e0320fe19567b1379530242f36d6f8ed689d2d3c838069c5f8a015086f2502d640bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0d229d2cdb7fc117d6f965563632a56e

SHA1
acce532f6c5e1ee60b0a96f92b040fa31695cdf6

SHA256
ad38a3f3fe29517c77d83f66ed2f461fc730cd1401c86c609be082a32463ad2b

SHA512
b37ceac38aa1b02c7da7f5dd708ffe73019b73f65c9ae1b968f523fe19ef70cb5947b8ff9cf08a323a296d9a893cdf3fceae01536013302af4ad5f1d00536c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd9720027197c01c36b8c52c70a63c01

SHA1
d3aae934db208f68ac9b98b9c91650de94b851ca

SHA256
e7894aac01743ae197da3da1a7ff18708ce10789b4d3e931c8d0155f92b2fca2

SHA512
ead14fa427c0adae9ed09cfd1982c9bacf44a06fc02d7598b7f5f9dd7f6f6704f3ec4f7ddcd6eb6a1856dae4ddb1875da1744e4f4334fb79ec864f5014f5c6cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c024bf9c7c299d47913c9c4cb4ee8fe7

SHA1
02fa0a24aa2368bca663bd575069b02e1cebdb0c

SHA256
59bed9b5b9f5c9fb021b005e87ab75fd1de883e7baa961bdddfbbed601291a67

SHA512
65ebe0e53edff39f1d878421e550c2630eea3c48bf3c49b7f58d8d1c7f502f714e8275364a7a8e3f9a03dd52d8bc6dc535292d6bf1a0c3df3f9bc6cd40712bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d062819f88a6e3632c2c7cea450e6eac

SHA1
7caba7d4450c1426dbbe8ccb4166d60d15d37742

SHA256
02ff610403227f68cf05e44142c0a494609170587bbdc4371d83cfe4f4d48050

SHA512
a39bf205a364a7eb432b07e9985ea9db10f7923aa23067998564eb10066b901df90e269c28cd7d7e686f9bcb750d1e938e9ba500470396275f5e424a9dc09706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c24b44e6eb2df1a526636ee44ad782c8

SHA1
325b7a54f6d957bf67a910b896a497bfe8dbeb65

SHA256
3a8847eeef72c445378756c18578714021d0c4c451b002d842c013f8f4eae24b

SHA512
24cc7767da9fe7fa098ae9640eb42367b95d68ac03bdd67ae67be51954a2cf09f61cc0ae651bf539d845ff9fad00eda4f588e0ca9cb8a3717ab737f97680b2f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
67ec5e3c0c3e3bac307fc024e4e3e075

SHA1
6140f4035607501ce22a1b0ed77e4b29d8829470

SHA256
c82ecc1e855ec448aec0696da1fb26a2e26c7afdf127c858c7b4672951728f5a

SHA512
cf41405d178235e7fc6de910e0223777fb27f18d3d2ac99a666a17cd33b2d1ddd5bca1feb07346f22b4f25c57e06b60ae5a9614296f0251f3a5d63c7c2fc139f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
fc9006334ea1116a2eaa66e0b8b07c11

SHA1
d3adbe6d00fcb79bb2609a77ccb3b612705824cd

SHA256
8ca8090d11be50d9719087fc47e4612c2ed04822070368c68db9338dc6800aee

SHA512
a049c318ceae4ed56fee664f7c3f8eddbce1862dfa0916a827eb77c4257587811ba1ef8bda380d7e82f9973153482723e6be5fb778e2894dc914b05568f943a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578916.TMP

Filesize
538B

MD5
0c84be978bcfed8645f806fa70d827b4

SHA1
0036f1219c222db44d61f1915cf0b946d86dc5ca

SHA256
9d3d25cbce9307072bc51f3a50ef12daa5f9f0bb0425d4f5459f7a9c31574702

SHA512
774e68b6260d5db12fdbc52405e52c718cd8df9fa6674a3334244c849b46e8b16f9cf0bcf03e759d9cea26ffbcc1ab13439d79305d649f162dbf0693a835bdb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a64558c2-87ef-4d1c-bc87-2776df21e126.tmp

Filesize
538B

MD5
d5ded43f169493f4ba948c35cc8bbb86

SHA1
db7d2b82a0919101205a4afb0b1e80b49f05b19e

SHA256
6580210f6d3209f01e34b2aa4d39c2cfa952c8d2ef3ac93091d38532d0bdf2df

SHA512
8908b4e4f51660139b13d69dd76f62006b1f63896b30d10d5a5e6d4f8d73c4b0b20338fa8358b5f6de016d330282483ecbaeb346216c98bdec246568c7bc1917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8cefd48d89a0e34db2c4beb6822cdbd5

SHA1
54aa9a56ce1d825412c60dcac368f8d56529325a

SHA256
c7c891f73e557e1d4dc1db18793b00d509fd942040596526c9202c5439c5530e

SHA512
fa73f5a476a7cf5d284ab7f2f1328c596862947418200f484f4738b3f19100575b76f4de748be051efea64c69c5b255ec65a86407906232e455fb98d6ca41942

Download Submit