321f3f9d76a199173cfd9df422bbc6ad6669a08b0ae3a26e9004cd837a0b599a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0fd7bdfcb667b77c472bf576f8b191f_JaffaCakes118.html
Size

43KB
MD5

d0fd7bdfcb667b77c472bf576f8b191f
SHA1

e9b6db3b503c9a9bbdaea4c678d789d226b57e0e
SHA256

321f3f9d76a199173cfd9df422bbc6ad6669a08b0ae3a26e9004cd837a0b599a
SHA512

9f9bf5516e5a32ad51110fa98cc9a240ae51807f06ee4b49a9b14eb3735326fc94e3436a57f2577df4aedc7d7afced6fad2c5caaf6b888419e6e4252e2255982
SSDEEP

384:kh67jk+zm2Qx7G1j3kOysNUZyktzTGMbX/fcsMdas6FckFBlvE/y38uwBnjB57ly:U674+zm2Q6i8Vr2JG9hG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3124	msedge.exe
3124	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2564	3124	msedge.exe	83
PID 3124 wrote to memory of 2564	3124	msedge.exe	83
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 4272	3124	msedge.exe	84
PID 3124 wrote to memory of 3984	3124	msedge.exe	85
PID 3124 wrote to memory of 3984	3124	msedge.exe	85
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86
PID 3124 wrote to memory of 4872	3124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0fd7bdfcb667b77c472bf576f8b191f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,13235432425524297138,5798894322494240859,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1ea3142548bfe421c07a1eae6bf22ecc

SHA1
119c3d18191cac4c5b7b301fa96da2e898d40da2

SHA256
c8f2ed113263dab429d3840d6646bae1513d43b4f3b78d39e15e6c2ee4379dae

SHA512
9b8e64cf47504a91e49477965da583f655085e5974acace46c1236b0bdcf2d21d87c278c91f88bf1c6f6084903fe5c17a8f0a1511140e7a486dda0e9bea22064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
48f0aa5aab7e6bf97cea2377c0ddd86b

SHA1
f6848406d245665e0be25ff029ebbfedd27a7ca9

SHA256
2d89f888035ce08283feca1b6f5b970187995673ed13ef8bd57c5ca8b07c64fa

SHA512
3cb8d252493d18e6d15ddcecf931aac4b870d1b0c3d90bb5b077b1f49ac7b646c168377b38c628b631f67098efc3f1215d584c8abb1ba724a0951e492a4d718c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ce860ae8f46736e649f31d05f67d53bb

SHA1
3e412eef884e09d4846d9f3018724285c0cab0bf

SHA256
1f75ce68e0c72c25cea007374b3ff8f3c21157d9061bfc3465724c58f32c0b72

SHA512
0b8dfd10416350d4e1425ed7d0a986f5f8dd4d6212346cfdd418473c1d3711af483a8eca503673e483625d210181f54c09ebdb8573f9db94fce5f2477f402d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee7e212ec1a918917d7e8b886608032c

SHA1
df20057f8b10e48ea68abf5cdae54ed2445b4302

SHA256
49d83f5e243ce89b3ae82afef64d52b12357f387bb1180457a1e9d8dd3a51ffc

SHA512
53f6bf930b1fda4552f51d1f0c9e49cd0ebed7577127b54d6ed63a95b0ead57c46ff41c8e6387e9c4db0a707a58ecb4b115fd07b4d34aebb379ce0a64b7101c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9412e1e5c127140a5d1d350e946814c1

SHA1
8e5519298b90d69a26ce9af145534a9101b9cacf

SHA256
a07c94533a759309bdde1a0bc5363fb9143db14cb138dae87a090c67aa4667ef

SHA512
ded1a3e3a01d44fee3f068182156626be475339b7b8e91ef6b6879ae32839215870d273dd70b732bfab5ca4b6fc2fd103075ab18fb2da13abb2a26c1442b4a33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c9a31de296f1cf4820791fcd973f0f5

SHA1
793b13d85e20361121f01f838b07a859f56b80c8

SHA256
9c51a302f2e5feb9b9d3e63c672afb64b98a8593daa2504c21ec97c6a7837109

SHA512
643ee086483c0c57513957874c0c4fd004a9c3ccce13b2ce308fa0ae17fcd9e11b802ae2481d0a1e08b3f8975ac990d19667117c876d1ec728bb2c8f0b798a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
c6ce83335de2ea4b46d7073328fac825

SHA1
ba99588967c8f7cb90e8af18719a23ff75eebccf

SHA256
ed03dbb13b8ddb44b94ee27436235784c1e67d49f28dc57eb8826dd053d46af2

SHA512
bd7247b3a3391d15cbd4ef91bcd501d4b49d8ed5c80137d279299dc0bc11fe608a492e045adf470e179b86f6ea803673751cf5ef159b16c998120567b24a58a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589b31.TMP

Filesize
537B

MD5
c560a7e69494905bba9cdb5fbbdce675

SHA1
1ee0ed1db40b80516b38699fe95033fd5b2d4d8e

SHA256
a79a56c7d9186b78c6ea0de0800fe3b1309614c3a7e5e06c24ee7515d956479b

SHA512
a59401a7ca5e7dc3a6f9a3313aa268b24be202a627a15a00bf09364b193679cb4ce3967fd576cd1428ee9ab6c617012083532f4788ef11fb74e5becd8ae3119b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
757e36ea75a347766a3e6a3736e1ce7f

SHA1
e624306d8232d37ff3457ac96fa662b3288ecfa7

SHA256
bc303f01a9428d9d399f317abac6423bdf59100b52df04ded5f105d775ed392a

SHA512
d332549d895f31e4aa9807bb98ef6e8a5857ab9d320f4b75fe49c64cd362362a91f35463bdeafb69de9cbe625318211f68b39f355d991d322561edb582dd1557

Download Submit