2439396f9d7b4d91e1852077fd38c604d39cd5559c20ec32d198d658598030c0

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5c51fde1e2005b5cff919da9b74556_JaffaCakes118.html
Size

148KB
MD5

0d5c51fde1e2005b5cff919da9b74556
SHA1

aac315beb5a2c158bf6dca1578aa23b727f351ad
SHA256

2439396f9d7b4d91e1852077fd38c604d39cd5559c20ec32d198d658598030c0
SHA512

db4fcdd67e7e20c43eaa92b63bf7d2afe609925a9b763c3943d7424b660f9cbba1d7b8dc1e0de87855516a68fc9af3e47bc2e8d0255f1e8f55b393306c9cf2d4
SSDEEP

3072:rOnSjXBWQTbkyBbT447wwN3J3SYzC8/0XmXscdChth8ZUZXkCEdtMC:KnSjXBWQTbkyBbT447wwNoMsc5e0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4112	msedge.exe
4112	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
884	identity_helper.exe
884	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1404	4112	msedge.exe	82
PID 4112 wrote to memory of 1404	4112	msedge.exe	82
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4992	4112	msedge.exe	83
PID 4112 wrote to memory of 4020	4112	msedge.exe	84
PID 4112 wrote to memory of 4020	4112	msedge.exe	84
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85
PID 4112 wrote to memory of 2892	4112	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d5c51fde1e2005b5cff919da9b74556_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f57d46f8,0x7ff9f57d4708,0x7ff9f57d4718
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7959972015473376508,11143869080779934634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e66c5220faf9421664b1c1aa98aeeef6

SHA1
3ae4ef6692f422e4bd6158d40327f85021210889

SHA256
9bfbfa1b13e29a8777225a355d1f641a0072d40b66eb50b2acda90c937369b67

SHA512
2cb2485c1d75a2995a2238164cd036ae027f5dd586a89540f52479c074c2e95c5f24f04ef0990e8f6fef0e301b86a6c36d6ba918a791977345329c5c3d74e77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a0eae204f6298acb6590a0be5eb94b5a

SHA1
e0a02b09701f8e7ed539ed5131d33dcb34871243

SHA256
1c9932dc4172ad9d6f5e5aff597deb21147027f4940f8b5c33bab829a9f6c834

SHA512
cc3f15ff78c604c3ccad5d2d68ebeee4c96420bfd959db8e33bd67296895f7a1fc8b7c5550d1725728ecf717b4b1ff96c7993675eaa9eff6be736ccee530319b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6c581181b3f3ab77cff77cf331c14f1f

SHA1
da8a48d4c0e9a516d47441e7788cd0cd4bca6836

SHA256
d28c553ff1628be25efc21517e9b0d8018132a19b29ec3df7e67869c0a0d2958

SHA512
e404988bd12a0eeee788f951bc96d62b71bbec2acb5397b56ee8f5245b52fa35c2e11a025021b996f28a539afe8aa936aa1cd2b8cb45d0ab75365e87c7a9d622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc1df544ff436cb061332108a0d3bb2d

SHA1
87b392a71ea0e91551b900d5248f7e1046f56de7

SHA256
ca8ab0f1681215c6d9d79016131945364dcd317492dda3503eb95a7283d9a4c1

SHA512
5697744e5514ca50e59d7155001fdf632e2bac1efa040cf88e285df88388203448f6a12fdf0439497f7544630eacf434b46b7841dc8dee03e6bd09f25acb15d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8561e5c0402967ab4e61951e01571302

SHA1
62a0767a72304e18ea53cfd73cde1bbabbb556df

SHA256
f4b97f53ab5de3df6b03ebf8bdaa59d2341a162547b30550b678c2e109fd1287

SHA512
46138190b06839db608bbcee518e3c31a8c56e98aea6d432b7c400ed88fa730c4a9c909e58fa12fa230f21046ac5b358713947b1a17b468f0d771563700dab68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
b3d3047ac4e44e288c1a1d0db398fd52

SHA1
8c3f863c84b82a419eb1a97fdc331d5f65bf8f97

SHA256
9e434bd2946760e41a83ea1a98dbff7be4a59f92945f726dd32b99b9300e1906

SHA512
7df01cb7cd0b507615ef7dee9c677e8ae1b1135a76cb9681963d06e8c38f697e0d3472b4a68576dda26da2e7bd953eb1166390ff4e9a387f0588f87665ba51a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586230.TMP

Filesize
203B

MD5
34f0fe340f4640743211e9a881a4b18c

SHA1
ee940ec27cbc70b419e1709c2d06c6848fa75859

SHA256
d38e13fdb5d24fc05a325eaf71b54c665b3e143aaddf0e1cbe7bdb2a0ada3925

SHA512
a280546417acd4df667cb5ac7b50f4735845bf20697ea5caf961ed8db50164e103df8089479b06c83d3a92097e7eb011629e83112d35fc38598d42eac0b9b812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e789731a-1a56-486c-a72d-692885d3498c.tmp

Filesize
6KB

MD5
9742f9f095b4bf50384a5e4911144379

SHA1
b35866f611a992cf3ca0566903367fc5d41dfd82

SHA256
a5b9f4c9a5215958bed4137a0a4cd7775db6b490c2de7197c35bf3fee71e0697

SHA512
bcb7ae3a95c5366b4cf16eeb4e6cd5d2bda4499df548ccaefcd4259a615e27274984fb52a666a1a98c7115bd2081568fe3fa5a2cb90374bbef7cbace37097303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
daf422b9a39f5e66bc09e99c87c3a1a4

SHA1
42707224535822cb67e25e5fe9177231bb78ff4f

SHA256
0e3a67a802622eeb5b08bc3ac122c3f4f22487598dc075be0ff1512ad3edc5d4

SHA512
e4a5fa32e83db15ccc4916628b7a7420515ba153e60a16ac2a8f3bda2fa166cd27059e2d27f3fe57ddbc8528cc1fb4887c31e46463741607828366335d370d2c

Download Submit