a9cebccb57ca6451beb1d26f3c7f79d988b485ace08ea1303c5a9a2df659ac4d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d67ce18cad86a41253144ad770b30b1c_JaffaCakes118.html
Size

43KB
MD5

d67ce18cad86a41253144ad770b30b1c
SHA1

ff4786ba8f2e1e3da8ff67f36ec76642bb42260a
SHA256

a9cebccb57ca6451beb1d26f3c7f79d988b485ace08ea1303c5a9a2df659ac4d
SHA512

3a5fd32b680bf13358b9380e66ba591248886fc4887b80dda8e79a3b0b7d76e62a0edfa199cb86acb291f3f2494db7d3ff18ac7bf9f1a0a5d064ba4941e8b836
SSDEEP

768:E9jQJc5fmJQ4TL2VlHOKLQDyt5OsiCqZJfRhNZrQd4W3FG:S0Jc5fmJQ4TCVlHOK75OsiCORprQdhc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1184	msedge.exe
1184	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1276	1184	msedge.exe	83
PID 1184 wrote to memory of 1276	1184	msedge.exe	83
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 2156	1184	msedge.exe	84
PID 1184 wrote to memory of 1984	1184	msedge.exe	85
PID 1184 wrote to memory of 1984	1184	msedge.exe	85
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86
PID 1184 wrote to memory of 4788	1184	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d67ce18cad86a41253144ad770b30b1c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f4718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2832 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10049211619985625142,10041258467347879042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
17eb4d7f671e6a66ff4bc9c4a036c50b

SHA1
1635ef69b62bc4eb097bdd51f44f86a5005abbf6

SHA256
968edb234f7cd4043e3175200b8a7723303a700bbe79485edf6b0e2f48c7058c

SHA512
c1a8dd889babb3495affdd0185933292c8ef834c53a1aed4c165421400ba1ed3fc4c6bc09d75ba8c2040a32c9cfcfd863fa8baba22dcd21589bb93ddfaa6ed77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5031a529c0fb77720c36e06200de56d1

SHA1
8de55cdc5e6104b492a1ff72790a698b926fee4e

SHA256
d31f0038dc0554352b86e0a560816a1ca6b4155b7d1f96a212d2fb057cf1ac9d

SHA512
5451a15c5167ee29c1fd06c4c90d8d794bcd874eb31fe2daed07d7de8354a001188410c52d6b8ed8590b1b015a757c0cbc03a75c357a0ae25e7c3578a76fc332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a51f6841b76521d535218482065e6a5

SHA1
6f998248ebff6f0f1cbb0e383c07a4f2b29f5b09

SHA256
a78601e628f56fcde9588a4c14c8089c77e6b3f9cd7cabaf75babbf5b31818ad

SHA512
03e7b25284474519940090ce174f1bd382b506408661052e4a09c0b0dcc810bd5f5dc76b0eef611df049da6c994efd07b9612730407ac083df20032ddcdd820c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
05791a0763d49432118fff97aa248e59

SHA1
78f2599bccf067c9186a8b0e9ed96ff8a5858cef

SHA256
a4c7fe09af47a2a5b64a6f3a3d2e1046ed9df5085a6e84c6cc26b32fb2690c10

SHA512
dce0fc36257e9a8d9fde467a35ec4d1f8eb35cba200f46ce1f965e63d072692acf2fd0a7189cf1bd7f879f9bbcd38c3b659062b5a4a7fa7d18eefb8c69a40e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
41d64cb216bc140664b474660d0e0c40

SHA1
054eb52a75feabf485da84f156caad0bbd84d105

SHA256
a3e80ebb27e60d307f3e24acf3906c1c97d147ab576909f294003bc524c443d2

SHA512
d9407a181b376fb261cf6925877c02801f3e3da0b9c0b1f7fcbf7ae76d506aaa5e0eba33d3df6e0f8b326e9efe39ab408179461272c9fc5f33ed640bf5aae330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f47a75b4a1e1970bed7e90ff62a02c74

SHA1
a6807ebea9d40781b61537e346fa6630486c7221

SHA256
8ab5f1e06f7458c703f9633be6d7b0023e26fe1f91d132a6cbbee9018dbaa3fb

SHA512
9961436a194e320021b9b9ad52e671a3e378f1533da6334f3de7e52fa3100b75e5a8d7de1a08f172ddab123aa9b612a98a4570ac546197fd8aeb1c4d846f4e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5835c1.TMP

Filesize
1KB

MD5
52e862df1c2e28a6be32602f6a4ced67

SHA1
c0c402775f060a1fcd6bdbed5d6f8a54cdc7926c

SHA256
c2851df6c6ad3fc759cea0ad6901090d53a89506f508bd387e65781e769ebcba

SHA512
075ec1b2d5b3d021eb1b2b7840395209269ab2f1c327da7c57e5bc1983772e92f921fe54b0aad1b36c87a3fc20827418e3bd73b2c51278766ba6abfbcdea1b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2eb3018e4694b2fd28ff93230c825f5f

SHA1
6d7846ee9d4150dad9577a12ae127daab3aa83d3

SHA256
fd3deebd3d711eb34f1a4834ddaab383042ddc5c224376a1204ddf5c5df76576

SHA512
0a1479eebb06b67fad06f44f9a2cbf74c4eaa0a8bb4eb12ba444c2a2dfe0fc0dd86ef82777a466931d194c56ae02bffc5c33dd056d9048b050ba2fad88b545fc

Download Submit