372f4062902a8c10c96fc29d4648160563f8c16e3ed3d6c136b6e44931b88028

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 09:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

945598b51473556f0bdf108d14327eb4_JaffaCakes118.html
Size

66KB
MD5

945598b51473556f0bdf108d14327eb4
SHA1

52811bb3369656ba6ab2dbbf7962c5461e24cc84
SHA256

372f4062902a8c10c96fc29d4648160563f8c16e3ed3d6c136b6e44931b88028
SHA512

969c632508d2dbc15d85d9773548636c997bae04dd1b831f35bb6bc5f96fc9f114f82ac4ff531b7e433849069dd91379773062b20a243006b2235bff6accbdfa
SSDEEP

768:acN1sd3E5Fxt5tMVpVF1R5Nthp1VeU53eHgvONlwHnMZWmOkaDLYjoITaTnUkZrx:acN1sd3VX5bONl2MZWmOkGLYjMTRpx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
444	msedge.exe
444	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
524	identity_helper.exe
524	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 3024	444	msedge.exe	83
PID 444 wrote to memory of 3024	444	msedge.exe	83
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 3252	444	msedge.exe	84
PID 444 wrote to memory of 1704	444	msedge.exe	85
PID 444 wrote to memory of 1704	444	msedge.exe	85
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86
PID 444 wrote to memory of 4560	444	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\945598b51473556f0bdf108d14327eb4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc284846f8,0x7ffc28484708,0x7ffc28484718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2291188669587500108,6768324539884238097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
5691137d0c41a6f4e7979117457e51db

SHA1
20079e39339fce636f979f4c3e196f8e5ac6c72d

SHA256
a757e366b1b6c77d4bd8357d06b13733fd4d07c8a790a343aa59eb6116894dfa

SHA512
13b0a11d9eefd793cad735bac398b12ab1b0b52f28a2d30da46f3574b8282161239773b62d3694487de559f22db9f98e0528bc4fac96a17b60646cc759665537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6a4756b9236f93b23657f6e433cead12

SHA1
4e7e64dcd395cc54b502df5cb178ecf3ec851916

SHA256
a10d8710c5647da07ef0f8f759e1220e61ecfb85d2c4c0a05dffb956dbcd0335

SHA512
496900cc578f038c65e77c3eb0e8294683731ebb098e6a8d93ab905d67824e6ef8e7af3281b4af5314b02685979a4e1505e37516ab6c73ba5fb12f567ab556f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a94e1eb7b12f3783fed74592034e17cf

SHA1
cddde2cc85dc30421e5168f71d067539491a53a5

SHA256
164ea38f3f18a5cd638aa11db7f8a293cb3bac3ddece93057860c5dad6fd018d

SHA512
1f56d2c61f70a209b97fddc6cadeb9f0c78ca2830a5b863b5a9aeb0e14963c100e7ffcd6db371b7e66324e772973826e347350465c751083ae386753f47472e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1f4acb102a3f823f7194ba5fcbff1a1

SHA1
9f9ec0faf3ed4da14d9ae35239db2b0ffebc3275

SHA256
014eaa03272d3ad9c1b8bf996170d4d9c97baefb47946b5c460c4d2d7d20baef

SHA512
67fd4bf8cc8c21d98f4fd8544b7dbb580ca92cbff6cb890c8a1427d9be0b18793aab6d5a033c9a752660c29cb198f344497ae7419cfa352ded8e93e427ec2d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2548e8e14063e9d4abcf3ef541941a4

SHA1
10e7d8524abd357623ad43b0012eae119e340370

SHA256
8b72d5c30cc87caea145386ad1c20652c08be8d4523a9c9454203a6e94e22651

SHA512
b561f696e3a93781db962614cbeefc54f3388b33196fc6d454d7801a566da0889b9d15070b26ee33dbbb6f6b931c1293ac09336c30a587961362607c3f9cff88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fca2edb651fd4b004bfa1ef2632949ec

SHA1
c2dea17ca004c138292aaffca101cadf92dcd282

SHA256
60b6947d4a8b2953a863237e9eef037ab28d42cd97e402576f71b710bff5246b

SHA512
8bbb6c5810c7d6be793a600ce9af473fc2903c911d5e6e0c55cd8d6b742e7760311567b9217643b105306eb91e8ec4bcc2f9ad3c79ba95a233bd991b3e896d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3ad3903d6baef5ca59116b253187f35

SHA1
3ae597b447e539f47f6dd94d090a7ddfeeae6a9b

SHA256
3d6bac3038eebdd1ada816e9d0a5a92fc710ad19d91e3c5dda99322e9b9e9250

SHA512
ad953ece63a270ddfef7e14ce0bc2dafc6f8ef182586ac27798402393dbe0fa3abe96bc56fbd0273f60a6e07729d0aed19befbfb1872be1f52f00d443a809ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb23cfe1085ef6a2e3a5ea28b910f2f6

SHA1
147a1012e3963e76169eddef1d53288e4d020b16

SHA256
24495277480a73e133e3a11f4007f51d38c3409a580919a6366a57b7ae3c3a96

SHA512
6ef80c8623c797a01ddd0ad68d8abcd4b102d2bafadc1ebe574e937dbcd85cf2b4421e617392abbc766f32041531dd37c313c9534e9ee79243a58e28f3a33ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823df.TMP

Filesize
203B

MD5
53a8309e1b13f0515d09c96e922c4c4a

SHA1
4f6190a9e25fd47e56d33f1c6d956a8c4f426012

SHA256
58bb6cef83408defe172e22f0560489f2971b7a752a6d97dcda8c62730cfa033

SHA512
b624eb103fd26798ae4c5ca95ba8886963f6bbb77f71e2b50167092260483a19e41e6ba0dbf6e6c96fae751a176f8ec47cc2784c3caf47d81b5431f77b075da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46939a8273b090c6cf06fb61897ed67e

SHA1
a78c10770d78f30c751b6518ee0c070a7cc1e8eb

SHA256
cad3ad50cdd9917c716e8f2114af1be38d9e3bd5718f54d230dc01dbc23b7bda

SHA512
eb978e1203885244acd4300277751aec8cf73620d93647b92b9978422ec6015043f2baf1d492a2266419b8269b1ceca2dcbed4f76ee7ad8c557a1f7d401f5e31

Download Submit