2e8fc95cd550cc06fc072775b22199f86bec3ad167878b6b70a189ef4b9e553f

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd6ae22b5039921edbf974dc3c095eb5_JaffaCakes118.html
Size

57KB
MD5

bd6ae22b5039921edbf974dc3c095eb5
SHA1

41f24e346a535716028890571c05f437f6a9eccf
SHA256

2e8fc95cd550cc06fc072775b22199f86bec3ad167878b6b70a189ef4b9e553f
SHA512

ba55d43a6995fc5e3e7f69a74a0bd7315be630bab6e7af10bb06eaa69e0301f01c65e609822e266ff46d022cca4ab95c0c83b178c71330a2f28ff0fe7efaab8b
SSDEEP

1536:ijEQvK8OPHdsA3o2vgyHJv0owbd6zKD6CDK2RVroFVwpDK2RVy:ijnOPHdsL2vgyHJutDK2RVroFVwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1736	msedge.exe
1736	msedge.exe
1744	identity_helper.exe
1744	identity_helper.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2500	1736	msedge.exe	86
PID 1736 wrote to memory of 2500	1736	msedge.exe	86
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 2924	1736	msedge.exe	87
PID 1736 wrote to memory of 1396	1736	msedge.exe	88
PID 1736 wrote to memory of 1396	1736	msedge.exe	88
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89
PID 1736 wrote to memory of 4408	1736	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd6ae22b5039921edbf974dc3c095eb5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xb4,0xe0,0x104,0x40,0x108,0x7ffaae9546f8,0x7ffaae954708,0x7ffaae954718
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,1822115613924801235,13686722557365688793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
a35e787ccc254026da98ccaed4f81a80

SHA1
e389372176eb15fa0cc03a43ea0c993f21cc2765

SHA256
d350cb4a63e7a3a5b014d2f6f46ddbdf6f63582f481f987e15fe782927385f37

SHA512
b687a5e2700726bc96ce54ffe9e735fe6ce1a59830467f00220b87a3107516bf3da471ed8bdbc71549e025b8344cd5117a9f292d53c0e504669a49b990366f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f5494b51c3bcd0cfaeaca81c8b99264d

SHA1
4fb8792aab00256ee14c63519ac130b60af3f853

SHA256
83a141a4f6fdf66b535c0478acd00d2e500624d2fdb7b281de4344e3fe43c8a9

SHA512
0b8570019f75a4ac5307c1523e19e87554e85ba5d6cb94d98f98474baee935ed320c0a97ddb632b66b560f2c38bbb5b76c1cf3e7b2f569164e1a76b708ec1bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68a16eeb6eeaef299bbfa7ac641cfccd

SHA1
9275c3a13b4960fb1c703f875304cf1859037429

SHA256
2d4722717a0ba7708bd0089a2175c8da134c09bbf12d72105c17bf6d2d17c45a

SHA512
d64c5cb753f50101ff6a112df18890b92e6979f658d198f2a20a5fa3e43429ec0d60674b60576de229065f9bb4a1a53dc9bee1df021d02eba2940e56cdab9a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
775cb5cf520062574a4ff3efa9754a76

SHA1
c07f364dd450322ab0aa1ae439e9d122b7ce1a21

SHA256
1e5af185b9743197fe208bcddbdfc5731bc3e45118e56d86af754704a58ebc16

SHA512
e19aa9f3bc3ddde159db9d03065740677d6d8b82aa6b6e1ecb41eb69b7e6b651f449435611f702c4404d99d636fe1d4d77e799c812999bd6e75c71fbaa0886c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
808e3e5ae733210a70cbea3f17c05162

SHA1
1c0b96077944e9b05c74357952f7afaed61b2ab8

SHA256
889a536cdb3984e595348b82cd767ab3108dc715dad9d4468ddf1d9cf01681a0

SHA512
f8783adea92064d4f6c45805d2893ccd5b8b9b5e87270b717e9c7bd64cc656144c3e0f3723fbc4c9bc27e91caf33b6d26e069885b3311cb059776cb6b7a9e490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58266f.TMP

Filesize
871B

MD5
fd56bba5b906c19799260d2f40e07f48

SHA1
4a5dde484c9e043620fe0978b672a6e17f81208f

SHA256
547a0d02bab40f7c74c64893e1c21d6c0aff8cd81504a6209554b6157d907f1c

SHA512
523232be486e2f6c86bc380bc846490bf4fdb206d2e9e874b02ed24904b57903eb0d95b269f308ecc0841c101a2929457bf51a399342132194b8e20a5506bc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f0db5d6ba90f05e4f1a2dd4fd583a08

SHA1
c299f5af7551ee9755072eb4d068bf1ed14ae8a0

SHA256
50cba258af696e4d3b58e3b691a53a16e3f5fff5c871b514471f5f262106fa9e

SHA512
268bde454e95b380c821d537b5bdc90117c8b60937390035be5218987e213b8e602025bf328167c0676b8d0093994065a66694875f8285e681b70132ad1f78ce

Download Submit