f910828ed6707ae7d69dea50b116e2421fe60a9a2d8e94d2d2b2d0de8daa56e5

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d122077727926eba848c5b3399069469_JaffaCakes118.html
Size

130KB
MD5

d122077727926eba848c5b3399069469
SHA1

f76e37495e6653c16ec39975d5d044cde6f25180
SHA256

f910828ed6707ae7d69dea50b116e2421fe60a9a2d8e94d2d2b2d0de8daa56e5
SHA512

62c53dca6710ddbadc1302362497f499f3a915a1520c3324fdba8dc2a31e4aca30e5d632adb36521da854c647983f84e634a8f4a37a74f0422ccfd051406865d
SSDEEP

3072:D45idprA/9/JtgHtlNbN8hutKUWmEtEMT/r0/3Nka4tq0ym+Tea/LaJuZtz5zVhA:DPdprA/9/JtgHtlhZWHT/r0/3Nka4tqs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
4284	msedge.exe
4284	msedge.exe
444	identity_helper.exe
444	identity_helper.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1916	4284	msedge.exe	83
PID 4284 wrote to memory of 1916	4284	msedge.exe	83
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 2652	4284	msedge.exe	84
PID 4284 wrote to memory of 3680	4284	msedge.exe	85
PID 4284 wrote to memory of 3680	4284	msedge.exe	85
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86
PID 4284 wrote to memory of 5112	4284	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d122077727926eba848c5b3399069469_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6cbf46f8,0x7ffb6cbf4708,0x7ffb6cbf4718
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12950397416324462646,8500963647937094666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6480 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
e0f230b5a9c1ee1084a7d00a218e152a

SHA1
b259c75f081d554dde882e7ea474beb615777458

SHA256
8948621247115f0d261137865cfda0bd9820ae1ee0947f11aaa1e7c79ab7d60e

SHA512
8ca86b5ea87e6a5f77f15b5da3dfb68ce76f2d1c679b2254c0900a8c6e1794ab9d5727912e329f95b0ecf468789431805e76c10a55b38a33ed75e493bb851336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a914d6f1a93d6f9e3ed50473870a2798

SHA1
4377cbe6ad95a217674c524f8b5e72df21db322d

SHA256
f120f1867e0d4ce9dc1003b69ba6d12575133a04d354eda7b67c262474fa4a5e

SHA512
de65b6dee95d2562294f7a66eb9508a766bb9c05fae01b45fd3f36fb6d3226aab739b169d98760ca40b45b83a86fb62bc6e06faa637c15601e496da6ccea09c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43fb3b693cc132425bc23330ef369cca

SHA1
d762c86f7befabb9de3e8887546c1a34694ca383

SHA256
38acf79ab9b4807b8b1c8cd534759d67fd6bbde6edd0e304818fca785b74bfcb

SHA512
147437b6d87a6d30ebef7c710d57dffc35244dd672a295c51f10420f23ef398e4d7418b19fee88db0b0617657e9010b8266dd4ed930a7bdac76c15ea27a5e75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5fc20631c84eabba2dbcbab3d121e5e

SHA1
39be0186bdfac53623c211aa4c2b8ced7830ac92

SHA256
da07b676c27e3e3483f7fd9ac5adfdaaf1f569eba1e9290066ddbcc9893e6767

SHA512
472d83082c49019be15d5b34a4878165397359063956ccb19d904483deef0d88bb394d054baee97c72f655f90ecced310d2fad4aaff12bd566cad7e350f9fd22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f24d86d0ddb1733e9f67997f66b054c0

SHA1
e324ba59131283da56bb8e89fcac8802940aee41

SHA256
f025f070278f36a999046935296deab8b5ebd41ce1499acad11c8f2193f30d7b

SHA512
4c9c85a4b5ac7c9fd99eafecb32dac5b3c1d65c873bab60e34f376f529356e72b73c93e289af836eae495d06675dce4ec93be466a48c27ea9d659f846f1918dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e324cb5449e83e105d7cfb4bebb6d205

SHA1
47ee8447e4c8d7451abf86b301854069eae30510

SHA256
82e7fa6e0a62726b052e1d6c085b7e6ff71ab103d62c39333913d08443026fee

SHA512
9009cc31db600b8c31d952d0f6035fc2398e5a317bef0726a7b3f096bbb487c857d607987e15e8a17d99d411920ca51465df9e9f050c9824d7b522c6b2e8fb4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580b36.TMP

Filesize
203B

MD5
61e882d721a7ccaf4fc0ec902150ade8

SHA1
72e4227b9d52a4826a35c49cd1d251c33c05b1d5

SHA256
4557abdce3ddeb64dace70f08a769c332f4c57621d25c760872b3138dcd3efa1

SHA512
adbc9e654bc96081d3f972a771cf2a05232a7b917ae69867aa2b53031f333055d1a28fa3fc7a5b692a688ac1d06c927227cfa3db460978c329cba3d651c6ed48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6a5500a2aa770172ccd39948b3f6b578

SHA1
f4ed92cdfe5e7ee2949d44e7c0eb832768af407a

SHA256
519c167d0f31591891ccb6ed241ccba6c2f236b212f70143ba3d53bc9afaa5b2

SHA512
a1f43bc39476b16f98733f3458d707689967ef9c6cf77d5490bf8ad82d4fdb4fad01e23f051d2bc1f5d25edb1bc5bc64f3e260a05f0f107a33b85b180e675a7a

Download Submit