bc8941f9ceac8a9760be864d7ec0ce6fdaeb0e99c51f2107f64b66d9102e1231

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca0bce6a8618e8dbcad9dbf6d714708_JaffaCakes118.html
Size

57KB
MD5

2ca0bce6a8618e8dbcad9dbf6d714708
SHA1

9a97965b655bc84cb1f47c2378c8ed754b6ed78e
SHA256

bc8941f9ceac8a9760be864d7ec0ce6fdaeb0e99c51f2107f64b66d9102e1231
SHA512

ef2ca9c046a81298f3af71e91605b62b5887a70d1466a7b19bf67ca3e575b46b736943991a117b0feea10e4ca6db09f847b181287d46209fdede4b156df97367
SSDEEP

1536:ijEQvK8OPHdFAbo2vgyHJv0owbd6zKD6CDK2RVroDBwpDK2RVy:ijnOPHdFx2vgyHJutDK2RVroDBwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
3320	msedge.exe
3320	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4180	3320	msedge.exe	83
PID 3320 wrote to memory of 4180	3320	msedge.exe	83
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 3704	3320	msedge.exe	85
PID 3320 wrote to memory of 1976	3320	msedge.exe	86
PID 3320 wrote to memory of 1976	3320	msedge.exe	86
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87
PID 3320 wrote to memory of 1592	3320	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2ca0bce6a8618e8dbcad9dbf6d714708_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8b7646f8,0x7ffa8b764708,0x7ffa8b764718
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16754211917317051887,5483881332698692472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
b2010a364c2038affa776b492ee7611a

SHA1
fadcd088285116ef8fabf64cd2008a2837e0edf3

SHA256
f3fdb934d75694b5dc3401ce0353ff69e1db7b0cf3e05e34b6fdd18e0be2631a

SHA512
96771b843b128180cf5ef266011822aa8497a92283d1f1f9909602cddb0c4d37d5e149740f9651ea5c7752e8b55fe2a34edd04b898cf34fa667209db90d5059c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
166679198ce28be464f714aa58177c04

SHA1
03797bffeb818d99459f80ae1239ead4ecf6a777

SHA256
726680ce53f09e529cade9ed265f0c4a592aedf51e2d7fbddd2af2f7ade53e93

SHA512
442b30b58d35957fdbf1053be5ce7480d426e8614ee8d8607fffe0dc8fa502521f532ad64d02dcf812eb6101d495821e60ee6bf5d4110c01cd0a6316df6425f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2da73403c87cecc717c51fdb69472a7b

SHA1
b51e9ac67efcad54851dacfaa9405c4f2ed24462

SHA256
0d1df4a9cec37ad38f16269a7c8bf83da5d713c202676be19ce9a8e0c7eac4ce

SHA512
45786a4091e23b78783b06f5a77c9adfa6e8922ae986de2ed7499e1b1ca55f15fe9d8868a7cbc942b0abca55f4afbf65eb5ff9bc4bc567ab8b036b65e040e3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
748b640cbe782e891ffa40ef78fb945a

SHA1
6e88d1839764e2c5bf3dd0800d0f28165368e7a5

SHA256
c015fe73f47a6ea640ef9828e67bfeaa5c2002d8bcc8e476398e56e08dc4e09d

SHA512
03789104d28223b63767f6fd449096c46a3183ec056f7fe77b626c55c2d821cfeab412b6902ab1aeb8d7784731cc9adf55406c1a5ce768092f334889c6c516f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
3f6262601f52000f60005c043d97b075

SHA1
a35d666b04fadbe46856556bdfe0ef64a837e1f3

SHA256
0147a77b782b90b98479d2f0ab62a5536cecc68ada9bbce7c1653f75940ce358

SHA512
bc9e09ce741c39eff92bdfad9b527e8fc93e2133f1c51c7f2c2ff28317f0dd563f8ebe45afeb17d40bbd2119b81799645f09a7b3695f5c673acdb9e223ca0333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f165.TMP

Filesize
704B

MD5
934e35e0000acae0b62a35e216d342bf

SHA1
98ab7493d0a1dde7393cfe0a09cc64035061be81

SHA256
d11ec9477ba673414a5048866da8f9a7f751318b0a6704a9a1414c5995d4d623

SHA512
6c8ff1d88ab70f1383713fdb35d5b397291f165e736169425cd22cc16c3c3f15ebd5629d07b1eafbab14bf3f5cf94f58228603781c558b71596ad0ee4eb8d41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9660c782c7be3d09119e2823c4d54f8a

SHA1
a11a7fdf7f7c60d1b5d3075e758fc4b5d58a1be1

SHA256
cba67b38ed83b10f74d022183127087e6053cf44044dd790235968ac1836e374

SHA512
c05f737c5d27c82ee9a534214be90b3b22c23ccd38030de9dd6374033f4f64fcfe400f3a5b11844bddc4cef571dde2ebb80c66854d57ff5c692d6447d2153d94

Download Submit