a30d0ba1a11fd9c1b2013de68d3b48921d30e250e01449ee86e68707b09de9ba

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c8ac263d8f4b90d621cfd6ff6014e7d_JaffaCakes118.html
Size

44KB
MD5

8c8ac263d8f4b90d621cfd6ff6014e7d
SHA1

ba0b85b5e485125604246efdc28d36d65e2c8b4c
SHA256

a30d0ba1a11fd9c1b2013de68d3b48921d30e250e01449ee86e68707b09de9ba
SHA512

204a98b6b236f06af51f05ac742aa31f24d6804e5dcc6d8821bd4ea6b4efc651fd1bd70cd1312ed54ed25430718f309c4fbe1fec118c19e524decf522a6fdcb6
SSDEEP

768:6dL+elNxwL1VAUBV2L5TzDQWB1Uf84I7pRNDQWAO4Bdy1jFcAtl3dayzjy7PCRM:6dL+elNxO1VAGV2L5TzDQW0f84INRNDS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
388	msedge.exe
388	msedge.exe
2308	identity_helper.exe
2308	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3480	388	msedge.exe	83
PID 388 wrote to memory of 3480	388	msedge.exe	83
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 5064	388	msedge.exe	84
PID 388 wrote to memory of 4380	388	msedge.exe	85
PID 388 wrote to memory of 4380	388	msedge.exe	85
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86
PID 388 wrote to memory of 2904	388	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c8ac263d8f4b90d621cfd6ff6014e7d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7806454508354389369,11144605192494712875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
3f85e8568aafee733667e9c679353e10

SHA1
8c878e552864e10b45acbf2c96f748d3cdb46ad5

SHA256
6563ea487a53b3a869e0266c476a423db029d1e21c4c4f44ed5e2a64ad9672db

SHA512
f4fd24791b064c475bed768f4a8a0cb0ae626631fd758276434d54b36df41027c2e7a2ddc6dd74471f0ae40ffcae49b8f19909b59bd17edf9a943a7fe499b801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5c181c733f6ac415431cf3eac5ead3b4

SHA1
60e010decf17574aa9dc8cf2ef53280f9788d589

SHA256
2fe377bc546daf78d0f5fee1576e00072a743e25e8cec479c7dd179d05da648a

SHA512
8089bd98c5387719e6b3db37c4bbb93a24fc592a5984ea0b261bfd3bcbfaeb8f9b0164924c78bbf189c692e5b9e77443bd9b1a2641908e7f75685fbba92c770b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6a21560aaf1d9c446e36201a1b48f861

SHA1
986dd2172c79ae9f58ad71c93d27086e46414c49

SHA256
ea6a6d49e1df289a79db0f3d4952aa44a3b7b33add83764a4f2bd39b655b5933

SHA512
9e96a9ad840cf29ba91bf3ee092f61b01fc53e3b8bddbfe7c5dbe8c1ba867bbf897b1022b023747a25ed961003d5f96c4e87e00a1de56e568578cf7c3fe09855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35a57e9d5e68c344f68925b9d78aa4ce

SHA1
0914e6a5178c469599a7ffdef86476416e6a0124

SHA256
2c2eeee6e60492a57b0ef4ee7e2ebd2e60c76a28a1abd85f60d5bb94715153bc

SHA512
915d11bc30de1f071c3e4a336c34314107060c69106d0fc083b4bb3d2b5e48324ebef3f30e4c96c6748dd0c91f90f575a6c5c60e94081ca337dff6023d7d7bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c58d575d2ddb19b482118728cfb1333c

SHA1
f25e939570d1f9be8ce8808c7d7a628498bbd6c5

SHA256
a4d66d6bb3fee94f1231b581572f0dcb963b5452f14098a04c980d8e3103561f

SHA512
22265464c9d4b718ad0c457e83a6982bfcbd4822fcb10ae098ea8f67450ac7b80434e5436e8605720d89204222085e9599813317b6ef6f71021245fc158a4ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12b3e4766f3d9950d450f0537d355239

SHA1
d2ddd64850bf5abddce906ae4f30ca8e18b8b5e2

SHA256
8d440700d303542973b229558559317e6d411a8b70cdbcb63f11532d52b1ae40

SHA512
1e11ad140658cf722fb41f8369c5ae3b9dd8fb984ec390228cf934cdf7f1fd12f2e4fe5e95e3c2958858d432e5059533b972f52de1d608a7533d9328dd3fe0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
e1d85fe88f1343974e2ba182fd6c18ff

SHA1
f70de8853b18c05fc110fe4c1177f08a02f34c42

SHA256
da632ae5676cb921bae55d52fff483ae575edaf41fd72623d57c0a88d482b68e

SHA512
e3923b28cbbea43d25fbc450d367f586452d58905adf22aaed5dbd004d83a2cb938dcb697051b6954bdefdcc4a722827c1730e67bdafe4c8f5d0dd8f50a135ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e6c6.TMP

Filesize
538B

MD5
7bcb47b4160919b78fc432d3e4521035

SHA1
c8629fd5dd159b8e38075ecddf5677d27717d78a

SHA256
e1372b7e482785bddd1a474c2c17bb8c4a4e32900eec22eec91f82a36618b0d7

SHA512
5ddd3d4253bf28e465222b1c0cab6d772cc778277cb6e19729e94c528ebee02c046d38f4aced0dfde599cd9119efcb19c19f9f7ce67824dd521bfb6a7b2a81b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac7faa20-a2cf-4470-b26f-18f0a205f059.tmp

Filesize
5KB

MD5
741fae83af4cad119019a8231e15165e

SHA1
5ef38fce5102cec084c666c74de50b746a2ce8c1

SHA256
f59ce076d3863d7ef740ea413a350643716acea5d740226e63947e8e49943db8

SHA512
3866a793b46cd5b12e52d8497d33326c88c759733dcf876a6e0d40052449fbd0c751744684f96bfa015026ed3dcd52c77522422cd20b5e364009cc49fed74198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
986e5d7aea7e4056ef78f356611fdd65

SHA1
4b4181ed68288a31f8312a8c50c3c241d9ec5dee

SHA256
054a5b7ec9bd9b7edd2a0c8c6cfd196518aa2f96559d0417620b448aeb449c13

SHA512
8383d1fbc50f1661629569ee84424740c5e469a089c63fd6a6a77976aae7ad196e116b625a593d51c6e6d82fb6017f8910527cda97ff51d0543f8210f00b2d52

Download Submit