a802fde0408e17df5345b98b913034f291b6d50402d7673996ff3aa6744fb376

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2d70cd034c4034e5e26bedc7f822a5f_JaffaCakes118.html
Size

162KB
MD5

d2d70cd034c4034e5e26bedc7f822a5f
SHA1

0631520b63d2efd034060d64288e7c4a810d8460
SHA256

a802fde0408e17df5345b98b913034f291b6d50402d7673996ff3aa6744fb376
SHA512

d4ca144f9015b4d749ec49990a400959dba51c57dd3b97a2ee876871cf8ba2b592a96f28bcd46bfb8e59132d75371b5f0efcf6c7dc32016c4672a1fb4ce119a5
SSDEEP

3072:UwbmcAHHUQgfKgu74oFK5bHdiC/Cq7UKW9DomfGFjLt2jdpCIQKtWlkeNVMs8sMm:UwiDC/Cq7U7omfGFSpCKyhK2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
372	msedge.exe
372	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 3464	372	msedge.exe	83
PID 372 wrote to memory of 3464	372	msedge.exe	83
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 2908	372	msedge.exe	84
PID 372 wrote to memory of 1252	372	msedge.exe	85
PID 372 wrote to memory of 1252	372	msedge.exe	85
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86
PID 372 wrote to memory of 2296	372	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2d70cd034c4034e5e26bedc7f822a5f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7cdf46f8,0x7fff7cdf4708,0x7fff7cdf4718
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5144968722684508919,12899618613354420392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d9ea61b7dba9cbedb6ff64c48f58cc48

SHA1
05e822520712d8eb5a1c752f0da5e0250b2339b2

SHA256
de191568ee2624d95f920b0fbe58411aa064efc2fa94ad94624a5e6e570db5f4

SHA512
5058d682687722de9298fe2add5316a3eb84675dd8f2046c10727f90174d11365588b3f496bb10999a2c89c230a31e3adb5414208645158c3471c937d76a2d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bfcac76a77ecbd07ebfe86b1df69444f

SHA1
f96a9c0e1677b4d8ff852e8e6e20f9366f5e7ba7

SHA256
e5c88d77caf882fb4f77ae5fcd557757aeda97bd691e115fb9f6ffba13a51556

SHA512
43ba74b33ae7abf0b00b9cac84ed946b3f1d267d59a84d89280c622bc9d3e44f2660b067fbc3a743dc65ca0f467ff2abc07a5110b2d1e98c23e3ea6b1ab7cd11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7cc503469ebc8caa77cfbe41b75d68d

SHA1
9c674486b2afe6f10135477f1ba4c4ba87d46e71

SHA256
b73bb938e421556988bbcf41bb7b8f3058699c13f6bd68925f1be9c69814edfc

SHA512
61af391bd2c7ea0bf1298868ab6d94b41f06f53161d7494c094f2b542d1b25a9edeae170cd74854b82318e0e281a4d63e7bdc8bd41b610d1d14fbe492a4da022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c4a5cad6fe246ad54b3963aad279229

SHA1
2ac4fd4bd83443dd6ee1ff920af5834e9d0cb564

SHA256
b671f7dd5ce2edfac329870ecbb63a81c6b9f2c4287c4f8c0a58b742f5e04201

SHA512
f5b263fe4bd3cce2a4ba946cd0c20714c8d110db5b41273ce5d3248630d797ba4e748c4daa1450776584d91af8cd0546fe9496ec8a05882282381ba4e6557e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c7d2df78a49c08d919d83b1a20cd6af

SHA1
e988f306a6c2bc2882f1bcda49c879b4d8d1bd87

SHA256
fd73fbc8da8b2510b445632100582734ad82dd8ab852f1569c9f91d445293309

SHA512
2c987599e4fc5075c301b230f42a6528aaca89035491085f369695429b27693a5db4dda9eaf89b86bee22b9cd9a4495fb9fa2653b3927832ed974a9c5c764c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
8acd7d2c47d7b8d18aae0ba8c978a91d

SHA1
8c09e4f387e5629099d16e8a1f6a500092b28c2f

SHA256
a066d428687a560bd797fc0b634fe4cecaf1ff68e7f64253e8df479dd8bd71fd

SHA512
1607f38cc995cbd53c5fe206f342c8871ff3a2d817de80f4963740470e05041366e581ed2a7630ec391c476cecc88e719ccf58d68d4243f9e4c2b1534b288b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580b36.TMP

Filesize
201B

MD5
ada1c28a0779873087e92253a118b0fa

SHA1
b7dd75bcf9a40b1ed1ac87b364bc9e488de231bd

SHA256
e7cba55e93986aed639f553da2a3777472909b20946f7203204c6e1a385512b2

SHA512
fd9688fe55c1d0ac2ed292c24972bba172ab36de9fa1596d20758933942a82b1bc91ececa39a0f29d77bc0d36a82c0c25119b4d000d82f12adabb2462fda793f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1eadd0daf6d89c04a7f0b54d7faa0396

SHA1
fe7279fb56c1631d09d998e1eb64ce8dda06612d

SHA256
e873510f8a7bb11c9a9c4710b38cebd813d32239aea8710ee072309f6ac99eb2

SHA512
c8333436f35eef86ec3d75ff7de1c6b7be70adf06edcf685b3e55cc8b6d81261f9b1996184fda64d17d356b3b341feb8576da069d04cc548b5fc679f89983d8b

Download Submit