4652b2beb050f29ff1fb1204c45cbb1d929faefc4227c5c6178ab05f6dc2f178

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd499ea2b76477c9182ee7355bc0602f_JaffaCakes118.html
Size

57KB
MD5

bd499ea2b76477c9182ee7355bc0602f
SHA1

a542ab867db0ed85bd49b0d94aaff1569b153eef
SHA256

4652b2beb050f29ff1fb1204c45cbb1d929faefc4227c5c6178ab05f6dc2f178
SHA512

534684a23f532d528ed0ca71e828f658c003d6353c3f41ad9777da94b39ce45cbf9f221df88350af67219157b0a917c14008d971e3e6f7dc53278ca7d0db66ec
SSDEEP

1536:ijEQvK8OPHdsAXo2vgyHJv0owbd6zKD6CDK2RVrovswpDK2RVy:ijnOPHdsB2vgyHJutDK2RVrovswpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
4948	msedge.exe
4948	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3672	4948	msedge.exe	86
PID 4948 wrote to memory of 3672	4948	msedge.exe	86
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 4224	4948	msedge.exe	87
PID 4948 wrote to memory of 760	4948	msedge.exe	88
PID 4948 wrote to memory of 760	4948	msedge.exe	88
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89
PID 4948 wrote to memory of 1004	4948	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd499ea2b76477c9182ee7355bc0602f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c1846f8,0x7ff80c184708,0x7ff80c184718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6714121092121441677,17054942520314734469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c82894d-86b3-403b-ae83-e5e2a3a4c166.tmp

Filesize
6KB

MD5
4c43170ca9f50624eed8f47f1dd5e93f

SHA1
cf97744b65049e2dcca4d786ad61f3a06ca129e3

SHA256
9aa1b47de900a654d6e2550f10eb1d438d68dfc2cdd9f89d26f06cd33cff0275

SHA512
28f7dec9459d2037702b657da2b3f9955f2850c18544c693a7ad9e94d4d89ebac8dccd9f241092d9d32ad64541805f3289350dacae986b0efdbac1f5968cfba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
00c4777c6d26b5e1a71f6f3ab6365007

SHA1
8e52e6f3e337736eb19316864ba7f7957c0d9f20

SHA256
7d97667d906653e53f50056c9054063b7544fd6f918f61632c5887b7bab88f7f

SHA512
05bb74a9b60fe547238ee7c4db65ac3c2a4fa382179e56c795f4d5dd249aed21c74f229303eeb3075b95e6bd7a2792a2aaf242aaefea8c6d0697afeb7dfcbd1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
02a632cbf8428763e75679dbabddc354

SHA1
8b090b286a52d82ba6509e5cdcc8a035ddb583bc

SHA256
fe420ad45a829fa222f1802d3388adf73e1f2c8888663f67bf3836dfe06a406e

SHA512
8bb1a3085e4aadc80ec0a4d985bdead4a0a2321c7fc1734b41f190f515d43b17630d146583d7979c3d13830ae4f6960bc5200b362ac8ebe89dec6ae9f1da5420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0f1afd8da81f31d4237f4c057b5fa6e

SHA1
61784c237154808b5c47fd92424afe714b3c6a0b

SHA256
509bf604a3ef1e3be1691728d2cefcc3d096ddae7f4ae39657be387ae5bd66a0

SHA512
d5d67f906f174e7818da8dfb45097beeefa8e290dddc93c125c6fc27fd05544cc0c937f02ecd0aaa827eba1639c377d969abb708882094f8fe570c2acc90fd2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b21959bcad0a00be1bc687eb138d1244

SHA1
8ebc30a3dd40d9ac469b8758b7a834e0f7db0b84

SHA256
dd3846001ba9e2d3262a8707749da81d125ba16796ce0465c372b9e2f533c8c6

SHA512
59fa59b2fdf70b68a25a2c0a60fb7507bd5018019a2b07bd091be77363277e214aa976c259541472a76730d28f23463249acb148e3620d6a63c663cfaf0e279d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
0a4f96529820abf5229978c42e513ce4

SHA1
2101ebe98961cade8dd5ff9d74f8e0087a21b60b

SHA256
2124e33cfc7fa44e80280127243185f6a37c7233c24b2deb70c1693e75bcbb61

SHA512
66db2cded13861609645c4212568a74af0b77236d9aef8faf586c9959827fd80d7f606a3ccdfb2c851ff5e157ef22bc1e37b81522226c1a158c0d87aa34a6af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e251.TMP

Filesize
871B

MD5
583fe2d687c5794e1bda23011addc541

SHA1
c56c63e67de3845281872485fb5b1e09c81b16ba

SHA256
7dd3091fb2ccf5f3a2dd500d09d242619af6729dbabc1ff362ef8973f49b1a66

SHA512
c322b970611e7e430be9cf5585f79b36953bb3e19083c20abb7bdb1ef61fc9e87b5086fe55207133ff0b8f9d7ef7eef4ef1b7b1e94f62d8a7059564d3aaae21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e205ae2b846c101393d5c3c37aa7d92d

SHA1
3333c14d07cc2d9a7d965cb7cc9528a4411ddf6a

SHA256
fb2f322445d4e1171eb72c789573236cb99bbcbc830c5ccd2c0b37095c02f49d

SHA512
0699ef285217ae544822fc1d9f295c7cb76a21f2371d4f40b657fac8df6703ce774c3c8db5c765f14e3c4a9628ef7b4c4f7be8e7b7257ba4edd8bb1ca158b625

Download Submit