45af7a2250797b333a9d1950793fc5f48f2cb07bba93adbc93710151b22c4e03

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac9d89cd26c980ad8f16aae2cc316c73_JaffaCakes118.html
Size

62KB
MD5

ac9d89cd26c980ad8f16aae2cc316c73
SHA1

b323040dc825b3c02eab8aa6799beafe24ba5122
SHA256

45af7a2250797b333a9d1950793fc5f48f2cb07bba93adbc93710151b22c4e03
SHA512

bcf5ff4cb6aa89a77f772c439456d140fe49dfa01d41acfb005ee7e6657350abd6b8377dc9ea7b9904ff1498bb8ac52125e5ea42a0ae5cda4166ba40bb0a403f
SSDEEP

1536:6EIEKFd7jIDT7g1ORxiQjkN5WNsAN56NmCNAXN+KzZwzXGzxYzFYijLz7pASLa7o:HKFd7kT7g1O2LnpDLa7oJwqPb/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3268	msedge.exe
3268	msedge.exe
4508	identity_helper.exe
4508	identity_helper.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3032	3268	msedge.exe	86
PID 3268 wrote to memory of 3032	3268	msedge.exe	86
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 4436	3268	msedge.exe	87
PID 3268 wrote to memory of 3848	3268	msedge.exe	88
PID 3268 wrote to memory of 3848	3268	msedge.exe	88
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89
PID 3268 wrote to memory of 2632	3268	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ac9d89cd26c980ad8f16aae2cc316c73_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e8b446f8,0x7ff9e8b44708,0x7ff9e8b44718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1279557389654964110,16970793490479044476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
688B

MD5
be706d6c67988b544a13b5e980816a85

SHA1
9aa09f4d4c5edc5e744838393f916be6bea2d22f

SHA256
46b2c20cc1bfb93bcfd3661472c9fc427f39eae5f68416b4bdf859ccde36629d

SHA512
9714995bae1fbed2afecaf8580241cc7891febf4a109bc445d6d2f7c3848f0edad5bc164e06475afc06dd9f059f7426eb518c39ed33be66b6dfc0684c1224de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9081ebe0f5aba530c6c68e26b045f86

SHA1
3450d4189aa29eec292c971ca59a49bb22643390

SHA256
bfc67894d3f98e0ffd324df38fa0b081c2ccad6aa0dd94d0ada5f1929109cb13

SHA512
a9839e9767e03969d6d83fa894efcb060eae77708d1825161924071393ca3b7016ed6b362e35c1a49689123df206859f8862ee415fc1743e1a38f2ef332c7f39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb51c8967f7290e12a66d162e34440b7

SHA1
7bc85f61bc36c10ee18d719a0cefedd581045fb6

SHA256
3a2ab60a39030e71d2898240f6e0bcb4baa0691f36fbf5f1be797386114663dc

SHA512
2b294c0c6a8a04776cf01d0b5adc12c9858988c1cd9bf4f7cebc5e700b42a25472e9ee8424678c40cfd587750aee8f154ea3fc0f6d4d67fa230b4b904fffe9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d65b2b91f0b5f69808973354941c67b

SHA1
bcaea8d6d61332692723c10b3a78d478ab5000f6

SHA256
2a704ef51edf47d44fb7958038d27510cce2cdfe26b9cb9c8cb142fce6b139cc

SHA512
6937157c046b97d7bca6c252c7e880f55a311f9709c351ca09bf3bad66171d397f481f65d38297511166e51932382bea1dfe7849ee42d7a38a84d8ef3ef2b618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
24fb17b3f1f091ecd5107dce0c2ef07e

SHA1
cb8bdb626c7648e0317842992b7536b1382fbeb5

SHA256
5f635f47030e374c876006fbf489fe800121ee4882b610763e125ef6e27947ba

SHA512
661584b088778230f3e6e9ed63bf238c1721bd08df9ec5a8c9cd394a851552c983299ce4c2fa85a42548d41939a062fafdae48fda138be1cbf1299c6cf1c1036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
228d42e2bc1c8f23ab209468d6c1ad6f

SHA1
67b1dd0fdbab066e90cc7bfc393f241dbc858b76

SHA256
5150199c922e76de0cddae50daa8cfb220059fb71e1449d89b6425b22f4327a4

SHA512
d6e512d0806b45161a69685f03496b8a4d8f356a9bad3899ec6cbdf77760aeddc171634cf74eb08299f353f8f4e41bbf6d72a38d2870629b9bdfb892b3680e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
1a5c6a2929ae481b2cedd5058f7ea227

SHA1
1dccf1babe2188ce3a71d50f1efe090f7f8fa014

SHA256
0c63468dec87c8fd38922208c2bcd9878209702e522477d208b4e5881cb40d1f

SHA512
0b7af2fb128370df2f81ce029ddfb71e584d3f900df9e1aeea0f98f61a943d56e0edbc174338fffdf50b0220d1ff9574023aa495ccae7eff378c585c5e7d01d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a44591e1359d77eca822f45ba4608bff

SHA1
521c81e065e1f31f189407b11909dd517ad54f41

SHA256
13a742123df10672167de5119160395f11a1d74846ebfc98f0ff5695bc6342c5

SHA512
36d9fa3d59968c75efb9a8a18032ef5db61e3b54964358e3b38e805e5d61922222d82c458266cd5eb4d81049f56bbfb9bdc00880543c7eb8d6cc688f733fff46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
1fa6ed1503330d1ba3e64e0abb40b7d5

SHA1
079b144ee784719d185e163f52e87e19e0505ce9

SHA256
26ee6a0c5a08ecb518054744dd1423107a5e35406dcb173474cedd5bb3136231

SHA512
28a0b243118d2d3c23bb85e0e0a6dc2668c81d7c0b4f827cd2d6662e937b88bb685ee38cd0c40162aeff52ccfb09d1cb581a2411ed1e9dbce98112bb3b1ea76f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
118c91be2db6fceddf8be42dc2842743

SHA1
98d462d36b96ca5ba59fbfde6737b9342170896b

SHA256
2a3e0a1f6dd7651312e4d7bb647bbcc876b6ba0238419e040524848fbe661271

SHA512
128e8b4ae44b0badd8408adc3e32c765409b07baf26e5b1d6b52d9ebdb890010457518d9886cede5ec180f2f34650d9b670284e2f08dff377e74a45fcf847339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58144e.TMP

Filesize
371B

MD5
331409b8e1117dd3f42ca2ae4c9aefcf

SHA1
c16c0963ffcf2252b20f78ad9b0de509be12e09d

SHA256
aef59985af3c9a5bd3e9afe565115cd8934f20797d8ce884a830b5144a725324

SHA512
58c482f7cf7033fd054d7c6877879a6c207ce1e826cb7152a5938f142e780f0b96b06edb25e448b576bc05e5193c99f93e9b6029b1d1507e31e88bd4389a1c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8a28e4291e44b50e36159fdf5153b08

SHA1
3dd566cafcea79e0d1e2bb6c2704d483dbc4c860

SHA256
628bc487f99ccf97c5406032be71e5ee3a992e3f970ffc2ebac9be29a0277d1c

SHA512
7a8559b46fc17552d008478b6801a07371f1fb75e466dbbb2d26f5d30f2678b2c2cbf41c806584a6f411457ab13135c086a70060b9a847d213e4e75f0b806926

Download Submit