89f954ba7e5a50cf1dc439481523348eda5b49c4004ec1ac0ee695f869cbf9dc

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dff2456ebcdf073b4b5bb5b1c2827699_JaffaCakes118.html
Size

46KB
MD5

dff2456ebcdf073b4b5bb5b1c2827699
SHA1

6f901d8768d4bd729fe2405e8ec234d29fe905bd
SHA256

89f954ba7e5a50cf1dc439481523348eda5b49c4004ec1ac0ee695f869cbf9dc
SHA512

276a6631e662234e1cbf8cb522e4e64e0567603e75f1bb7b4626af6403511c99929b04f5a36037cda4468829e6a617b080c42a77529ebbdbb4b6240dbaf4c1c8
SSDEEP

768:8uIRH6PFD03X7alXlZJFGEWsCch+jV1Xdr+dUpNeDE9Rjx8Z:sRCFCcXv3GEVCZV1Xdr++pNokjx8Z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{4EE56374-8869-4681-962E-2B29306CD84B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
952	msedge.exe
952	msedge.exe
4308	msedge.exe
4308	msedge.exe
3024	identity_helper.exe
3024	identity_helper.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4616	952	msedge.exe	83
PID 952 wrote to memory of 4616	952	msedge.exe	83
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 2440	952	msedge.exe	84
PID 952 wrote to memory of 4600	952	msedge.exe	85
PID 952 wrote to memory of 4600	952	msedge.exe	85
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86
PID 952 wrote to memory of 5108	952	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dff2456ebcdf073b4b5bb5b1c2827699_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeab346f8,0x7ffdeab34708,0x7ffdeab34718
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1300 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2905803223035356389,16994081771569224903,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bf5c292ec8652cc8e5d27cc76e497485

SHA1
52bc0730d8d033707dd93d0823e0c8fbed4c1c0f

SHA256
ceed55e65fac108f56a190eccab8bf8a642cb70d446fcc99461c8af401ccb8c0

SHA512
e901d783b047328f2f3a44f8b8c25f4973aa4ebbf83a5e0d54ef67bfaf89a2bafd59d8e1e12407f4c0d295387c3c5d8c2a91f57a1c10c2237729674d4ce75221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
3254789074c95dba44989f9a84ed52b8

SHA1
3bd034755cea78dd0758da3fe27deb93587d1f0a

SHA256
81c8ae9a35118276f875509e2c4e84c4b7e445c0fdd82ef325457d2a86778e3c

SHA512
cdb1d5159e875c55a6e08048b28b8041cb50c4054ab2431ea980aacc3b3b89a544b1af3aaa432efc90da5658f6e2e532b14d2d0e535ef336fadf0a99d3e6e352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5127de3936fc2dd411a17ee25920f8ac

SHA1
c0015bac84eadf62739aca782d4694dc4edfce10

SHA256
2cca0de4bfc2e0dab1172b6590f0f9e7f15f17a71e7f0f4bb94706d32abb6dbc

SHA512
4144550731d2358f10956d69c1682f0cd21e367ca776769b43be4a107128dabe2b7aadc4d732e79af899b5a80404a7c0a5e492da37e333112af131f5365c18d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49306dcebcb9388912b4a4728a587ddd

SHA1
4dd1048d55c9e04fc6efc4fcbe435b678abf96cf

SHA256
154dfa8c73c27f6a0f77b5428da7aa9059b68b80b0cc1ddfcfc5410a40d95a0d

SHA512
7f950c3c702cb00961c29383b0031018223a6463d411a90d79e7076ee809c33717aaef8d9b29d9b162891a7304d1f147fbeb7547c283c9dce372ed39a0958381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f49c4a02ee0211a327339b39456ccf3e

SHA1
69e43ecd1e80a1dc4dc62c290e1a9ab74009dc51

SHA256
92d962e0ff8fe61af84c9b55d648fc57e133802f31bfef06149f060e5b5e4ed9

SHA512
ff8430779a0f7330c1a28ac02d9af7414e8bf8de24952a432789c75a4222041850fc0a83f00d68f5a30a45420dcda2cbaf00bc854d12b328c55c3e582a4b1824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
496bdbf7feabe557bf54fe313ad0cc39

SHA1
b27f5c5b9b1b7e5389bd139868a244657a4925ec

SHA256
6dab8ce86e6fa85cb7f9501310770a2ec3af918f2d53bad8ce3f6358784571ff

SHA512
04d08d5a81d2cea84b5ea708a589e3cd989492b0e6f74608d95fd7136dbbdeeda3c69b723399197b4b67b3c7317245fa95fa6416aeced6a8b1444c93cc5b09a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f2bc.TMP

Filesize
539B

MD5
cd46eac409a5ad949ff56f7a07392ace

SHA1
0beb3875865963ec79b8d78d31da4f6a47dfe07c

SHA256
b9cab50a2b92d0d1a6fde1ba3104d55a4e8ff58bd4f5499b880a2f0e8080d0ee

SHA512
c97bbf810d0daa9332600c8d6d6ccfe0838b8a50efb46cd77edb34f3d579c8395465756e4a9f6f16491e84cecfaee8e64a075a9a805737072dbb2a923ed17e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57a822e141fb262e4a5874ee4e9185cc

SHA1
d3945274e40685fbdb12bb3c6a03f16eebc5de11

SHA256
a8cb714c550ac4b5a08804e9aee700937fc5557ac0c00105d15edadcb06f7c54

SHA512
8b60394c891312537c1b156c1f231323265d1db7ba97c5b1842b3a69de74fdbbe5b6497f1100407e01c6bf9055ffacf67418df51d1f3fb1457034532064cda02

Download Submit