d091f11ca2d0ac2f5c858c63ad5e1fcc27141611a5e3fdafd7bdb01a4bc61bda

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4efd82454b8243563eaa6f731377f4f1_JaffaCakes118.html
Size

22KB
MD5

4efd82454b8243563eaa6f731377f4f1
SHA1

81e1933629d306ca7384f9a288f7c2c9357a5d93
SHA256

d091f11ca2d0ac2f5c858c63ad5e1fcc27141611a5e3fdafd7bdb01a4bc61bda
SHA512

cfbf64f25f79f04dddabce024c12f3bc939e00b26baebc32765d308edb45107c542e76ba25496b8a9960ff8d4d6b474ee33791cbeb192d7781057dbf17adedc6
SSDEEP

384:B67OsJS4jarEviMBe28xcn1kPPF8/JdtElo+6X18DO:BLgarEviMkdG1kXF8/LtzX18DO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{5A8505EB-B8D5-48DC-96C8-E3561E785828}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
372	msedge.exe
372	msedge.exe
2496	msedge.exe
2496	msedge.exe
3328	identity_helper.exe
3328	identity_helper.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 548	372	msedge.exe	83
PID 372 wrote to memory of 548	372	msedge.exe	83
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 1064	372	msedge.exe	84
PID 372 wrote to memory of 4484	372	msedge.exe	85
PID 372 wrote to memory of 4484	372	msedge.exe	85
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86
PID 372 wrote to memory of 884	372	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4efd82454b8243563eaa6f731377f4f1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4439164066549273036,17867835180806130412,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
847B

MD5
03feab170908a5f1eeeb1834578402aa

SHA1
760dfc30ce0e32aff1f9f44dbd4fd6c94f5abe98

SHA256
a26f486c4d118f69d3c6fbaec13ff7265e31d986a7408110d85d3af12625ba01

SHA512
9dfae1a4a1b1316bad0df9426a9712ec373fcf6cb55ecadaea1f7143296f8ed6a9478dcd23f919e45133bf2f5a3dfae8a6841c91e99adfd84b08b894913eeb83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f1eb53247052ea0ba336bea8cc1ab9d

SHA1
c50af8c83a91db94c2a88fa6255815c1e92a2873

SHA256
7288892c3e80a15f1bc2e46aacaea0ce2a96fe730b10df57390f2707303e59f5

SHA512
6e358d981d0c9e53ef3da14c9e623c29e3e3f9f4b94c7aa96933d2883ab104e7905873b6146261624d5e6b977c31271ab5a4eac176701cb8b518ded179989df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4dc9bd6a8316b66c2f27c75e897f66a7

SHA1
bda13ec459518560df7b269cee40de147c28939e

SHA256
d37d0eea15461c4b60b6085b099694d53680d1068ff5b6f7925f33515b5d0c7e

SHA512
b0d1d67aaa15889bd2dcf37af1db44a9aa6f85cf3472c14c80227ef5beb84f1999c8d9ac74f34c6983816c5669f9fb715056555a45452056d9f880bf772a5a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17d9ab5f484b55b55b397f08243b675c

SHA1
ffda74b6c8955aeed961eda905177b25caffc46e

SHA256
35eacfbf41f58877c76baeaca443da435366dc5a77719db3bf96ced4405b4742

SHA512
1b822ae69843d326080ee86dfcc9348395dc002adf3d7aee8a3ca20370f37ab5c683f991ce001b18d4ac4d8a9905a17dd67eceb2f16fa4563d88df86182cd3c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d2b19cf15a234193ea02ae4313ae891

SHA1
900bdb747c8e7352e3ed1acff79cc8b1d6ee29c3

SHA256
0ec6913704638c8c76c996f903feadc7891a9236bf20376259b75583e5436be6

SHA512
79168ddc0d847c89923a48116712f3c43df884a692aa92b8252dadac0e037294a2ef01838c8f57ac4f5fe44a13863ebe5fb96935c6bb8dc10d57a0f15db01f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ea5b08b44a99efdd4afe9177e8721ee

SHA1
fc2dd8814c0fe8394525e2e0a6d73dc9d80940fa

SHA256
8728ab149f66c6c47e14a8ed708f51b3f3e5454763f93f8959079f899da80516

SHA512
1cb895865d901c7b6f5bf0f1e2014269a6a15b17830cbe95654ece73bb24a6e4bf8b40d64dd29b7396885ab9e643a0807fb8ce388115737e4f5185dc7fdf5d26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bc6a782f62ab070f34e8df441e139dec

SHA1
ffd4746a82393209591f52fb6d3cb6eee5903cbc

SHA256
dfa324b8f38c01a1fdd983dda4d875069e25309dd2b9a28d3a74ba8616656660

SHA512
ac700e2f90ac7c6fc3043e158116ac502fb6443d285047bdc22b9603c8fbdebc11542dd57075bff74c3928edb6ad60d30b4a73c405fbcf221925ff1b3b0b1501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583023.TMP

Filesize
372B

MD5
e30ab6a05a134dbcc52a82e552cef589

SHA1
ea91398f9f7ee3a65462aede112ddcabb4b96689

SHA256
bf397065c4987e21b53aa8de7740f24edbe2efcad79b028d16f8d81b76533c61

SHA512
737f078e1fbfd7abcaee679bdc9f1847a41bb27f45d7919db72849f1ed3c41244e149201a1296b0149bb5de72b6ccb5aec5639aaa56be5957fff71c19be7c26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b1fcb2d907e52c0b74c8ead18e62a10

SHA1
616ef68a00556a262732f7765a22c39bedf96207

SHA256
72e25202bf51a77b3731f507074b417f752e670b01170db750b4ed0ea063f846

SHA512
4b12eeb9ed3069eeafbc1d24b5026d241b82a170457cf68fce7c909d599ff358817a62b932120489efd689c43496593c925ec87a001ee323885b69ebb916abd7

Download Submit