d60d745b118507a926f2afaf7cebd813151043dbc7b5d69b739ac41c088c9985

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeabf30dbdddd9dd32e0ddfe36f9a75a_JaffaCakes118.html
Size

57KB
MD5

aeabf30dbdddd9dd32e0ddfe36f9a75a
SHA1

40eca7fc6981b4d51aad6595a18d4052c844b1cc
SHA256

d60d745b118507a926f2afaf7cebd813151043dbc7b5d69b739ac41c088c9985
SHA512

d942ea55301a0a815578ded42782c52076e08eaf8586cb25f52ecf58f6bc7cd19126898b277e14a08bb4afffa7c978ebc44a32b32ca1b7b60df9d2ab9cef3646
SSDEEP

1536:gQZBCCOdp0IxCkowEfWfxfcfQfTfcfLfjf6fef1fhfHf8fkf1fPf5f9f2fRcfefX:gk2/0Ixae5UIrEz7ym9pP08NHRFOSW15

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
4356	msedge.exe
4356	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3240	4356	msedge.exe	84
PID 4356 wrote to memory of 3240	4356	msedge.exe	84
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3484	4356	msedge.exe	85
PID 4356 wrote to memory of 3020	4356	msedge.exe	86
PID 4356 wrote to memory of 3020	4356	msedge.exe	86
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87
PID 4356 wrote to memory of 1676	4356	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aeabf30dbdddd9dd32e0ddfe36f9a75a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3b0a46f8,0x7fff3b0a4708,0x7fff3b0a4718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15414498487229083328,13258632557887280655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
54629176475c97e0c0bf38925799c412

SHA1
86d4f79b366aa2e39c97e1329f0300d3615e88e0

SHA256
08815a05eacfd14d37af1bb308cfd7c95355c74680b83c036fcf14c3454b4b66

SHA512
02a80a9afc0a656279d0cc3b32153cc01bd98c12d8c7ca62b7aa12d002a5a761c27a81af825c0b6760f581ddd2adfcde1829be6e9903765a63ea5664c1488097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
876abc0262ffeff5f41262e4541a115f

SHA1
a8d6044586ae99ee1a47020ae3b2147981bd1420

SHA256
c00ba137dafc96f777728c3ac8a5089223ce366e764ebdb39b8525712b66e484

SHA512
dfce69e5416d2faf125252103cb4a4e855de84c59b5b2dc651f4c7c3c088a2a4f4548daf234710dd2c51c34dde75ee7bf2606cf2f305ec1ee3b7faf8daa10836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3de5e0cfa9544551ffe5ac7fb04dd33d

SHA1
1be1aeb5ec5fd7b79c4499c2d1be37644b58b5fa

SHA256
7808bb443bb6028f4011ba306b6669878edeea38bf3d1c9bb266c21688f0536f

SHA512
ffbec31cc1a56d8a290ac730c551987149a0605fe9c4b6979448ca91bb17f9e44ac4cc8c27b79f120e75c6fb7ed00066dd049566c757571756d3514d256109ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f181342dbc03f0848fe1309cc1cff44d

SHA1
e02086e2352e7f77a4bab31561137c9bed6c9aec

SHA256
ca81ccb30be1429fccf13d5aeead9cc33c3dd4088c2fe9da82533fe2fc468dde

SHA512
406e871f9ef9ab5467530b7c7f8e480714884e802d09646ddabd6cf1efa0b501c4adfa190cdafab947a5b397707c1b82a049a695ac58f84aa59d93bc62797513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d427a44edaea4e667c113b54fa6fe63d

SHA1
4d17469b14a66de90f86d7e25fecbc250359685b

SHA256
5d313553ab6893d8843437bebbb3cf1f22fca3dc9a12b54f9de4140ef47d4ca4

SHA512
1b193582b4edb1c105dce342ca7604678f98b8b7ae57321be0a95c91568328dff75e5dbdfdd1159e221b37a387cb4ef25eaf32c139ecaa5cc17edddb552bc225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
c9ceb3d8240b144a56e7d8fe29505015

SHA1
a241c6e74bb83afd12d78543fa9f7cfe8d27722e

SHA256
a34dc225a93212c08e049ac6f3112e57c4a748ef084dedba90f995632dbee47a

SHA512
e1e3c0d47371871e6b58324e3b00f10e35f6b21250e20a026f9d35e65d159c06668829cbdb40e95db2de7e789d048f9fe97d21a003d947a66d51b70d7a768ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587971.TMP

Filesize
370B

MD5
078f8226bdfa061606558b537aca6d99

SHA1
15f2c6aab210d59905e823edfd56b730390b0187

SHA256
9a36fd5ad4f4f7f16d9da049df65822836c1c15cec8ef0a78b1b88d203f5d786

SHA512
b691b8311fb63f294f459b9a32ad16c77d5e7712d0c4829f6914bbbc6e2939fc94aa3c1d51cecbcb574b3f3f1acd1ede7381d03000fad10d7dc17856320d538e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d1ade660110aa2515ef68798ab467234

SHA1
b26f8f466a8daa5fa91e648b03a7a40d2e320c7a

SHA256
896df103c1632ece0629dd90ae6c34b5c23b682ec6cb36f031f79d335bbfd9dc

SHA512
e7d9ce8096c0afd08ee15d1d347bce8e7e82e2cb96b3e7ce920a2bb8660787387a2b4bc107f5bccb96ada2f90d552b4cded834213a62e4bda726796f3204bf9a

Download Submit