86618c190a0ffa91959f28dc5553b057c563197aa9beeb30d3d8551fb126c589

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159e99aa15e71242f1629d01a7e60090_JaffaCakes118.html
Size

19KB
MD5

159e99aa15e71242f1629d01a7e60090
SHA1

648fd16a01d7d19f8f7439ebf977b55c2887f58d
SHA256

86618c190a0ffa91959f28dc5553b057c563197aa9beeb30d3d8551fb126c589
SHA512

cb1e9d3dc5fefec9679a9c9d197c63ffc55755db169bf7fc190519ed9eb1d3cdc026ce07a833d2810e621bbbea4f55af5e28dfbaab593b5d7c035effe0e1c7f2
SSDEEP

384:9pf2TdyjC5K1ZDUFIezbG9J24e/Te+dWx:9pf2TdAC58RUuibNZ6+dWx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{4DC706CC-2E59-4E82-964C-8E97A7D60527}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
1864	msedge.exe
1864	msedge.exe
3976	msedge.exe
3976	msedge.exe
3488	identity_helper.exe
3488	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4196	1864	msedge.exe	83
PID 1864 wrote to memory of 4196	1864	msedge.exe	83
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 2720	1864	msedge.exe	84
PID 1864 wrote to memory of 4332	1864	msedge.exe	85
PID 1864 wrote to memory of 4332	1864	msedge.exe	85
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86
PID 1864 wrote to memory of 4824	1864	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\159e99aa15e71242f1629d01a7e60090_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b7554718
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,519996212290717408,4970546599699576505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1930efa4a82cef6c92dfee84e4af867f

SHA1
5fea1162c36b000c972d3976dbe10d9193cecc75

SHA256
73a784f1e2574b267490d8734a8ef82c8a3869dca1081c5d8b1eed0c51b373c7

SHA512
0ee765c3d0be64192344676382d2374a79e7c9d80adef36250423db9bd873e84e3b703642e005262ed68f4a37931fc739d43014f7a37a297d0e364db971cd62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
600B

MD5
60f250cce09bc2fdf07c91d540a46333

SHA1
a15aa5301b0b92df3d0a1417eb45130e6f0ac4a4

SHA256
7434cd9b36936416236138ce8cc26ed2a33c13fa745731f59117375cffad3806

SHA512
d539379618c16df6b9b707a664324c93c0365a2f54428e250774d4ee67cd1a4dc580c6a0af1763db0e67e5cd5c2207024fcc4058a3ba03a7600057be911d3d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8a91184ada620af927c892afea960a1

SHA1
0ba12c8152f3cf0942a5184d0016110d1c72a69b

SHA256
9edbe95ef61e22faf54200b3ab17d1aa604ba2ba4af08960b350c8ce43fc14ea

SHA512
2ba8031e5cbf8d69aa3d59c501a8a7f13891827594896d520efe77fa6ec74d365cc33c55dd3fed8eb7c2f2664c96707c3d1ed599a356814cdd2d497ddf2f27f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e90ca2e520332dee0d89e951e0d8f3d3

SHA1
48de1ebf09b7479b6accb8d0a35569b8f79b8bb8

SHA256
6b00b40d24a0f58e3a0d06602f616ae886d48964a4032df6aa9792e63fdc3a56

SHA512
fa2249b039e1b4b514a2afff2e845fa2cf4115faaded45f43878f88fec47d439d0ef6f72e0e8550afa8f4874b7c9a1a8802048bbe3f09f3eb4833b4016965fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
bf0fe8268a37140ad3b47db74b6c3d25

SHA1
f579fe46c8e679adf74460b168db739a38e094b2

SHA256
d591ab9f7fa736c3d84b95fcf5acf15f6f1d0615ed53e8673bc545baeaa6b743

SHA512
64bcc0661b7c0ed171ff0f2b8f394cc5f0c6c0861125802bd8829164f524a82f9225c83fa3b9f23437ff75e7b34f038924388b481bfcf1cf2ce567138bfad5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817e8.TMP

Filesize
204B

MD5
7ed80b7004b79f0bef46b69ed16d7171

SHA1
0c58b41678347211805456556a94cca19c300436

SHA256
f8f1bd1c462f47df08c1e9f6372af41445018be48d0d585242ba79f82e4dd1b3

SHA512
d53b51b8b94bd565c34027b32158cfd7ea836b96a5b2300f36f93a4f21fa6fe49967159170f9fd3d55e099eb275d79bf96c1845e40b8cb1a6c6e253a9b77495b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3791f09-ade2-4421-a9cd-ed037bbb9de6.tmp

Filesize
6KB

MD5
6f428cc19dc9a99f763e76d3d2541f96

SHA1
eb3bb0ef42806ca3961e6c37f41fe438f0398780

SHA256
85cafc7a34a75737398821f4557bab447891287cab706592cb6275654b565a96

SHA512
0585751d40fd1a2542aad0bfe22a71cac145aa97466909ad9219555357fd758f6650e684b1be77250709ed2af4c7f758d9ac97a207131f09b3191e65e96931c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70ed9daed0196e17be1a5321c984f132

SHA1
c0c480b273381d1894f3a6b4cbe037a88dbb09d2

SHA256
873e7d63a53c0a47284f7a1c845868655b63eebab53a298b4496cb6c93507aff

SHA512
eb17cd743f81793f01bf92e7424bf8b99f8477340309cf2b6c5f61365ddbc16460954dc07a391010497c63a8d5fe63a51c31fd9075635a9d49ab70f467e9d15d

Download Submit