c17285eec4787ee07b0f5f942f12349bd5ca85705feddcd18afa74f986d3479d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab88a7ccfe6b17a13fe1f69bb5c52f0f_JaffaCakes118.html
Size

57KB
MD5

ab88a7ccfe6b17a13fe1f69bb5c52f0f
SHA1

3799935d58b39bd90497e4dd8e313bb1b2363904
SHA256

c17285eec4787ee07b0f5f942f12349bd5ca85705feddcd18afa74f986d3479d
SHA512

dfd88148616ae8e303cc97bba13edc6425c9d1dd703ee5f04beb9a7c9c48e9bc72ea6d1a0d7e18b27b6637836821b947ddc8ae1747a4e08866f27497ed3fcb08
SSDEEP

1536:ijEQvK8OPHdyAco2vgyHJv0owbd6zKD6CDK2RVro5/wpDK2RVy:ijnOPHdy+2vgyHJutDK2RVro5/wpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
3272	msedge.exe
3272	msedge.exe
1100	identity_helper.exe
1100	identity_helper.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 2636	3272	msedge.exe	84
PID 3272 wrote to memory of 2636	3272	msedge.exe	84
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 412	3272	msedge.exe	85
PID 3272 wrote to memory of 1928	3272	msedge.exe	86
PID 3272 wrote to memory of 1928	3272	msedge.exe	86
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87
PID 3272 wrote to memory of 3376	3272	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab88a7ccfe6b17a13fe1f69bb5c52f0f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c8c046f8,0x7ff9c8c04708,0x7ff9c8c04718
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17815861817675923457,4102870052282764047,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
01e16a60a7051cc0652513e77a2b8cb3

SHA1
d04c08b279b9ef8b1e8dc9b7b4396dbaba2d96ae

SHA256
44280cff0a908454602c78180d1720680d83ed23245b1f6e6ec65889551f42df

SHA512
31919e7c0884d48b21bead79cc5e7fa27abbcd6b96a8b0f0a3b751f130c543786830ed745d20f4b1a0a9fa467da599f84076cca2e33057d5f6e1ddd3449149b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bc94f0afb3136f7d79fbc6dbe404d9c9

SHA1
2dd2a8c6c01439e0342a914222153f83eb298e62

SHA256
b27f5076e185222abea068e6abb6d74c326c5cdfb2abcec2047a33fd2c26941b

SHA512
4294e8ac0438ca05895ec376b8c4b1ccfe64414417af69fb51347b3f46d8a7a9b1a4d934d417013bd28c44437da9fa257d79e37560a83cd33032161e6f79a228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9430a264024b3132f83ea129573055f4

SHA1
f6bf2a9d5acaca519a2e760e9808270263cc46da

SHA256
12252c658581736c2c77f88428c2c69b10b1acd5b7e92cdbbfb4ce070204705b

SHA512
f6e4c9617a0feb6e2ca98fe4ce4b0432eb2e45865375c4340d3e8d13db1b1704684ee7cdea1d0917cfc4d1436f8473b1206d9785a8e4e1ff87e6dafceb681bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7a1dc8f-a0e9-4a81-a468-133641bb3c95.tmp

Filesize
5KB

MD5
4c244e72698d6089a82ed517b60c02ad

SHA1
e863f90e019989841dd57754eed8874f2450f0cc

SHA256
a7ae2324927a0732d3dcb2adbb6f33008c101077f14f69f620f94bd2a0a77d7e

SHA512
b31956b295d082329ac8c8b15c601a00220d3d9800ed322fc137f5806b7d7b4a683c9c51cc819d3f2a05b4dc655a9140e8dad5f33b348bc9a06f1a3484c00238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c04ead2a4ac00e3891f4d3933ce87a9e

SHA1
56fb3feb7eab6bda2166a2af304e24ceec8737c2

SHA256
231a55872a8403256025694532c6da56970bab57c949db0f85d5c09a656ace5d

SHA512
1682d8848f4fafc66ef27efb86d409bc742b443b259369e06818da71b4a98d1bb28840a43370227bb86ecc5161c9c3e99d5b6818b086b0a7c7b900d84e10a616

Download Submit