2d6dfbbc420ab926fca4e1e81f247dbb0347f91ad6b5705c8a505d40b711d55d

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9592f736ac7517918bdda88bc52121a8_JaffaCakes118.html
Size

346KB
MD5

9592f736ac7517918bdda88bc52121a8
SHA1

e9d7bf76d4148515eedd195b4400a38702c1a745
SHA256

2d6dfbbc420ab926fca4e1e81f247dbb0347f91ad6b5705c8a505d40b711d55d
SHA512

cfffc9e0273cad5dea3e7b34441e41071fdfded1359144cca8a4d99bfdcb68ee4d3600855be470724c96fdafd3280f03e09a860e33d33136fe7d42c85fbb4d43
SSDEEP

3072:H2+TL26u36DqhitVjc8cUxV0HIQqiHkueFMg:5y369tVbT0HIQqGk7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
3204	msedge.exe
3204	msedge.exe
2112	identity_helper.exe
2112	identity_helper.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 3728	3204	msedge.exe	82
PID 3204 wrote to memory of 3728	3204	msedge.exe	82
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 4408	3204	msedge.exe	83
PID 3204 wrote to memory of 2888	3204	msedge.exe	84
PID 3204 wrote to memory of 2888	3204	msedge.exe	84
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85
PID 3204 wrote to memory of 3716	3204	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9592f736ac7517918bdda88bc52121a8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1376 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15338361504484141103,3625196766202646451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
adb01730aab7774e216c8489c8824c64

SHA1
fb4588b657b3ff6f3e484636f0b71b2e980b1ea2

SHA256
49979987583d654abb6815a41eac77f3467b3efadf92e84c6bebe651e5dda857

SHA512
23c5e981b7a4b8e68adb8bbd54ed1d9245f260ecd3ce1c262c9a43eb274c9a5375d30f8adbe38c766cffda603dd540bee4c56099f3f8a1d80b002dff8da68394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3899db7d7d0a396558ce111a2ff25fbc

SHA1
12aa249a52e88d0fd2d9f085ef48d404c1d5cdad

SHA256
50bf49bb4f445806b80ad9453da4a83010b431b330c663ded45a20ab5e592340

SHA512
2dca2d74ada8770b68f0242b2010360e4c9a2f7e3a2df0f672f6b9259050ac6768683dc8e45344e8eee311b6075ec6c816c643592d022e4dcbda9efff50d02f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b898ba4b8e5974d89b6e709c004d690

SHA1
3afa650062e39cfff557d16cd0d9a947c6035dcc

SHA256
dfc638af4de82118a13965b60507d8cf740e2dd3ea72c543dd452668f830f2bb

SHA512
1999e2f6cbe671bfdba25e107ba9aaf9b68ab8dd1093435914711a61ccd49b7a2f59ccde7c5e66bf397c61982c07979842ef015b73f64abdf61eb42a06f681ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b135fe98fb1a7beea8a12b2a16892401

SHA1
b84a7814937fa9f02a93a04466000ef239136c52

SHA256
8b69a021aed554c98ec9140b254e1ee8efef23795a480f3e7241231b4c1e545f

SHA512
dd0dd389752c6f058476b7b37fadc6ba1e0b8128c54d507178eb7f33847ad6b2b2d473cec7fe73acf00870f7d6492ea4ddde083b8ab2aace5aac3bf6de589efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0aaf8ad992ac00c8c502f9e81b1c6a32

SHA1
e98329deed028fd6489aae00ba98a83b64fbee8c

SHA256
b868b2c3eb8382cd85c895a604a350ca8e1f4d9bd29df37e1c9adf25cba7181b

SHA512
af1fd65db1a2263183b960f4b43415227871478a77073e044c01ad3d911724279af37bc5d140d4fb1420759096db7d641c86c17c5f2fb0d4e1e8ed2b7345a27f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
ae88ea9ed708d526b771125d659c17c7

SHA1
f7f86e481ffb1425470eae425839a9527f55d022

SHA256
7251ab6d029132246b3f35d05eb420ffcd5d6a68a7f4c916b7354e6110df7621

SHA512
720900f6b50023692a1a9eefe0eb59c8ea0c8e44c25d9cd4a69c4b3daf515c0afdad0426903623dc7131ac2d36723ba65f683366b5c16041a77a0f129e4a3b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
e5eb4b677a8c2390dc27dd885029dfd3

SHA1
8b97cd68f86ea20a3f9010a62937b0ec20ceb4c7

SHA256
8467bc6b3191b8c717cb553308ec091237103a5c0ce627a7c919ded550d43cd4

SHA512
a59ced1442128c38d3862d2ce9837af8cb8aa2bce53c0ffb1b4b9d6c70273492f628863d586a224e934f0a24a4c2144f51d69a2b7e1af88f21c7f76d59f3213d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
b95ccd3e43c5464c1fa9758516fafe19

SHA1
404b4a6705ea39a4ee67c15defdb5184e0dd0bdc

SHA256
6e1faa0304c73112dce1bbfed8cc05b902441a51870b5ded6e52a32e450eab0a

SHA512
b10676595aa16e8dca3d8cc96ff26a5b3ec0a1647a703029814f1bb389ab5a617aa55c471c1130570e816dd1e5490a557c40863e18eca2c5db3197a5ca353558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57af89.TMP

Filesize
372B

MD5
c4aab2314c581a803d85c57bca29748e

SHA1
93de47530dc007888c6287b4dc0c3b3f7aef92e0

SHA256
75b17f193e00fcca5b0d08ca6a4e0b9449aaf4cdcf815ad7266ba571952f9916

SHA512
0106b8dd16b49a98411d5a174cac62f5b5563ac57d93ec5955c78406aee9dac3cfcaeaa5d6212ad8b9673d4cb4db026cb9a42e7d7efc009a51f0253493a190b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
415e04b755ae783a18b5474065da5414

SHA1
8d74d715e75dff626f42ac5c6524025945940380

SHA256
924030672ea94b4c6b16d0ecbba4a7b8ae7dacf7f4e3fbce9a80ff25693faec9

SHA512
04c05e13a9e1b2d4edca5e61c2030da8e028cce7a105b29c5e6fa052fad7cd700ca23e1abb4d130eb860ece612736711ad79b17da6a828c5ca8e23dbf910ddd3

Download Submit