810fa8bbf1fa51b91ef7a62485c5e5a29c2f74b717a3c4b6e79edb8b74622392

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e5e890fc1799d3e9b57fd0d72e0e1e4_JaffaCakes118.html
Size

77KB
MD5

5e5e890fc1799d3e9b57fd0d72e0e1e4
SHA1

424d18ca8c845184a88c561bc011c82f58690904
SHA256

810fa8bbf1fa51b91ef7a62485c5e5a29c2f74b717a3c4b6e79edb8b74622392
SHA512

4323ad5ea6d3c5fe148e965331e11b6e4bd4541fd52cf75fabad1cce2cb6a7d588b1c4c075f30604690984f13ff12d67cf8e921f941b90b477aa8c869fa9341a
SSDEEP

768:k+amUtC6EJjFDAxIAXfRDP5BQuCax9Dme5K7U5FD+vXRDchN28+Br/icsEic:tsMpAxXfVBBLCeqBCDhN2VJ/i5EF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
212	msedge.exe
212	msedge.exe
2900	identity_helper.exe
2900	identity_helper.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 224	212	msedge.exe	83
PID 212 wrote to memory of 224	212	msedge.exe	83
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 4792	212	msedge.exe	84
PID 212 wrote to memory of 2012	212	msedge.exe	85
PID 212 wrote to memory of 2012	212	msedge.exe	85
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86
PID 212 wrote to memory of 1856	212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5e5e890fc1799d3e9b57fd0d72e0e1e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d4718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8300373139021675920,7430846326725171961,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480 0x404
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\098b1938-dfa7-4f11-b1f4-85d3298ccafb.tmp

Filesize
5KB

MD5
7995c59859ed40ac1004b3bd2dee32e2

SHA1
529064b35d66a0b704b4095fabfd79b7ec2d97c9

SHA256
da2b80a943ea26f3733264d13a30fe08985263a50806581868b506284bb35ae7

SHA512
a1549d4c5ed8503aaca856f80e664253936ef778c6fc4008c47b3364ad76a04903f24874ec53a3b59ffcaf480cc1ee212adc3bbea2f38a265bb8debdc41bea43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
146c43b279dafdbd917e64d5292205b6

SHA1
1709caa97908ca86464e759e4fe3df9f883dc47a

SHA256
3b9364c33461bcdd84bef4a5e5707758d26effd32e3257fe7c4ef5dddca9e490

SHA512
8bd582b28b93618d06a56599bee82498f2a4f744e43e617bee50c34126c3d302cbc812a24574c7b3e5f14c6e05f6f72c605feec0f1f07875acca2d41e62bf532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4715da06a7182f965e3b49a1ab985469

SHA1
8f8bb552d59b90d256ca059b8b8855602da5f006

SHA256
8507499bb5468c125d8664122218a5af5037a282031ebd17197cabb26680dff0

SHA512
f6cb49f7d6e59e974cd4017cf885a55ab1c936b94716901952c167d94acb1fe3b6e2c69d7232c075a4b72e12fabcf8680cb9e87f47cf29d5321036cbc694eb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
aa4c85aca249a8302d6d1dc999fc95e1

SHA1
28de582a15c5222a09203e97f76aa72de6a58047

SHA256
61f319c2e43b87270fa6cab0590311871b8328182057664a27c7c1d0477ccbfc

SHA512
ce8e6c9f4585c868ec6aff5397358a653a6f99d17cf9ce9f333e7f7f7125010b523fe863fe3486c74e687beb859d9501f6d473d3f59dc83011646d7f251986ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0bef8e24ed3c64fc2310a67e724d39f4

SHA1
bd43cca6181d3a4be7d876293d6817509372efd3

SHA256
9fd10551dc821e14279fd809abc6b6e169ae3c8b3e35f032f66c8c1ebd4770fb

SHA512
a787745f89c99b2c3a0845504ce672391f667db30d85799e96c0aa8d9af34e7c7cb14bf32894f0dc51bb25dc683f6379f16baf28e72a4b5f8e0ed04ebe36a5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf69e6335d2c8bf34f7145b38b290106

SHA1
6d77a70b16941f2808d7c86695c04d4e64f07c45

SHA256
814ad3eb6af67b4f39481807ff5c99f7a3b152d6b5142a52da890eb388d7f844

SHA512
9a9d1ec0da00f53774dc5361420221b4807469d3bc75d2a41f11d36a933241bf5aff2528fc56580d44af33b19cbb1694d3a3e1e813ce50f4f93fc6511bd6e0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
80e8f0ccf50d97479f50261348f18b3a

SHA1
35a4cc4e22071b0d10d5958187a3b1b75c955c0c

SHA256
6edf89b4d5f578d8d54d8aa59edd10e61426d0bc34eb5ebef1ab67fdb5c70def

SHA512
7116cb0bdd2f7c82f52df101ad299b6e8a2cd06c2850936fff6c51ae3ba3e8f2e1d1800b2daadd50f138a1619d4afa23664aa31b9df12168daa20881bbca22ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825b3.TMP

Filesize
2KB

MD5
f7d86c0b7b7942e5517e1acad3eae635

SHA1
d40ee3b0fbb112c8f2e4f23f794bf77409aa8c2b

SHA256
e33f4cac3d053eebfaf4d854841b890ba0faf03367f397aca2230b5a471cc0a9

SHA512
7423ec4b2a6e88f4dd193bb5dd907c709ecfadd2cf63f3454e878f18c3664682baf23132cc24ab116a07a2b59986e7d0789f10c85eb4f152d5d068060cb12b09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a7fe18a27799a4a77dfad9c67c1a55af

SHA1
b7819c5b6c3b6104bcff8880a9ea6ce583da4661

SHA256
ce8e8c972aa11ed355a8216dffeaa9f3db720d5fe9ecf24f75b90937cdc0b4fb

SHA512
01753e80733a4e2643c9c23f9793e194392aa92d7f2c089263a269ce65a77a6e7f258ff07b0e0226bbc697aeea3c0509647d9397d0e171413d6173020d11f186

Download Submit