c8fed94d472e6b0c4ca11c4845e2dcecba3515a67e69d835536f6ba50274164d

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d36eb0e1fa0c78cff03fabe414cf2a0e_JaffaCakes118.html
Size

57KB
MD5

d36eb0e1fa0c78cff03fabe414cf2a0e
SHA1

bd32e6bb6d472cf0ef99d9df3c3da58952a10cd3
SHA256

c8fed94d472e6b0c4ca11c4845e2dcecba3515a67e69d835536f6ba50274164d
SHA512

ce40b24c0c5c74e08213088d1a5d47df95755ed7559d9d92f493ad1c3967ea4f09ef1f87f272fabd213de7ed4152ac4f368c7fa1de0f7ed87417e468374e2a49
SSDEEP

1536:ijEQvK8OPHdyAmo2vgyHJv0owbd6zKD6CDK2RVroD9wpDK2RVy:ijnOPHdyw2vgyHJutDK2RVroD9wpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
1648	msedge.exe
1648	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3404	1648	msedge.exe	83
PID 1648 wrote to memory of 3404	1648	msedge.exe	83
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4904	1648	msedge.exe	84
PID 1648 wrote to memory of 4200	1648	msedge.exe	85
PID 1648 wrote to memory of 4200	1648	msedge.exe	85
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86
PID 1648 wrote to memory of 1004	1648	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d36eb0e1fa0c78cff03fabe414cf2a0e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb974046f8,0x7ffb97404708,0x7ffb97404718
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4325723851032176488,5952416338385264255,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
6e3b0c960cca8875bdc2b6e709f2ef71

SHA1
2a2fe305901a8eac81ce3f2a1f7dc6b5ab033e67

SHA256
34658af27196f9d924f60b6f54a3643435d7f3a72755a2779f88896c196d7ce1

SHA512
bf06f85aee3b89b059aae0e6d6328e3b4e4bc132a631b004a0c0c5ecd06763d483e43dcd06da8e2e7c1c9e1acab1d851fb8a23d3f77b6394f93ec4c6b8488505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
4ebcc992bb1465132b8800ac0833dd47

SHA1
316cbb3e84898e99ba4a5f1c17a0074909061a62

SHA256
85c53ce53fe9b8d3a3548ef1040011cf83eaee4fd321f29027c7d87c50be893f

SHA512
95e0faac8ccfb5e30039d81f7b79a88915f754a98055b396d870d40b27b62019f42765a8c518eb74d89caa04c9bf1ca190074b5ae7f7ed21c17ad955e81472dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b2f0feff8d115ad963fe6ba19c74d8a5

SHA1
36ef6e19ce4f5ebb3df3b1b342955fa66be74467

SHA256
a1ebf2c2a72dd7e44bd6a343ad3c2fe7a9aa29dd345ce1ebf811ec57ca44be3a

SHA512
002cc492e6d44cc58cb9c091dac6562ac49e126dc0b97e5bc25dc2daafb36615e6ae33d46697d91bc80e8d34f6aeb96fb343020ea385a49182be880b47a17e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a88ef2882ba334b8f94416c4938e5e8f

SHA1
b21af324ee4ba55838fcac06f2a75c2c0109e992

SHA256
10c4edae4b3d976903a788c39b4b9118b01fc5178cd82dfda89e8bb98ce2aac2

SHA512
5f25f9b4a676cd95031a96e0f6e0ed9628943a86c13351b142641620d41e40f60194378ab83e45ddc9f02944420012f0c164381d8102df7343a500f19bf0c8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
7410adc2a17e510c722560e6f84ade9c

SHA1
4f446ecaabb4965ba896525264e34d4399bf0233

SHA256
c3e38e1ba2f8df28dbcf65a40a905aca2daf03d410f4cff516c406e810136593

SHA512
e267125f71c1b28eed82f98bfef99d92512ac504ca36d3c8e9ab54405185869931d5c27620c84b143fbd5b6687a896b1be3994e5353588b0a3c097ab9a5f5c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bb6b.TMP

Filesize
704B

MD5
f399a0ee67326fb1ae0f45c7d861fc05

SHA1
e4b194c1b22525e9f4e3d806e1c6a4a99d512ad0

SHA256
102dc6ff87e80055c5c5ebeb9f3d8959ca9baba2a61752e485381061adc8cb7e

SHA512
73071775a29b84c0f5cc90421456b26fcb56738c9ce39790420f537f95df092ae7da343aafa842738728850145acc75e742d957ede73063ad5811ac34ebf71df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8cd63a4-70e9-4139-ade8-fb8f57a6833b.tmp

Filesize
5KB

MD5
a9c86a7496776afdfe5d0988a863d79b

SHA1
8c4242924b920899c314c555ba06d418de9e5488

SHA256
0f41a83b5da7bf742b6b81fe69e80ff198e101dceada796d34009acff9f52c94

SHA512
34669c331105d98b14a8508545bcb783de57847c9b73e4e0c268523160ceb028820bc6c8e39c0f8f97a88514e61ce4dde9fe50bfd105f5c1fbe0260339322956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c002532aba2e0a27ab3907a983e7e9c

SHA1
9a0fbef74a1b3f9a5f65881daa872e18acfe08e9

SHA256
172408814fd3d9481e42b21a867578ea831796250f32a7763504d6934bf5b134

SHA512
06e114c28d9d7ca291c356e8bf5ad0f8c4be334771959cd750a5c3afad58f05a6f4c2b3f78723a16b3263402e50215e1c10332b805f820d792697b53d18193b0

Download Submit