1305615a65634fa7d4c74c67dab9830b6075e8d04f8cbc919b960358134eec52

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7b4a1843884afd410f56b73f3bacb6_JaffaCakes118.html
Size

74KB
MD5

ea7b4a1843884afd410f56b73f3bacb6
SHA1

00ed08b75f34a62af9c20a4bd4f44e6dc2642170
SHA256

1305615a65634fa7d4c74c67dab9830b6075e8d04f8cbc919b960358134eec52
SHA512

48331e9266297e3fe2014574ee065e87d821909c4be878998f0f75bb2f988dec09d1de49ee22ae9fa59b85b3d8dc596dda245eb59ee71d6c2614c5f56e2a49fe
SSDEEP

768:yDts6EJjFDAxIAXfRDP5BQuCax/YkoUgFD+TvBDchN28+DL/icsEic:yDupAxXfVBBLCbZCvChN2VX/i5EF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
4816	msedge.exe
4816	msedge.exe
216	identity_helper.exe
216	identity_helper.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3976	4816	msedge.exe	82
PID 4816 wrote to memory of 3976	4816	msedge.exe	82
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 640	4816	msedge.exe	83
PID 4816 wrote to memory of 2112	4816	msedge.exe	84
PID 4816 wrote to memory of 2112	4816	msedge.exe	84
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85
PID 4816 wrote to memory of 732	4816	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea7b4a1843884afd410f56b73f3bacb6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c4146f8,0x7ffe3c414708,0x7ffe3c414718
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1284 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6895156775470712500,15008633372842316163,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b0 0x4a4
1⤵
PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
feca78ad40118249c877d869a4ea871c

SHA1
731812636dd72e41362d13c8e1fb6f921da6725b

SHA256
47527f63d3b349724279b230e20b4feaec09ce872d8e5f52e2cfbfb58d92f822

SHA512
b99a7d2289e19e09be4480be8c73098169ad332bd7394f5bc3710a1093ef84ec7826880839e0b3a55767b06748c3a0fd84afae6f21973997ff31094aa3ab3987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
20114d46e5b41deaa8e0364cdfcf6c43

SHA1
1bbb1a2938f21308e985b386309132356ccd386a

SHA256
3be6038605fa00987df6e881548e2b5b0511e8eb92f47d43b74dbee66584708d

SHA512
1a4c86a6e43605ae5f7da18389dbfd4664117de7a9fbedc38b578e01a364dc86abd415029e95a11dc0e5d0403921a5fdd98624d078f61bcc91ffe1182ab1c09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
52e5ca8547683ff76a106cc343598ce0

SHA1
2b8d63e0bf247f3d1dca24359cf43c2d5778e362

SHA256
0c71bb2318aeae380ad36e29588431b0bea071be61045a89cf6c2fa9a514432b

SHA512
7c31641aa5c44ef489dde24364436f096bbdecf6d0efd0a792315526cfa803b5a3ba7f3340fa481861b00aa2876e98c0131b46062886b46b3d5a9b7883197f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc789460ed954375814eaf1fb2f55bac

SHA1
838d2e717e55bcdc2d93e8794be7c8a71d5e1cf8

SHA256
d11bd2c9c4d8dc09d30679a7fbbd54d4e330e70c7ba8048198d7b34c54633038

SHA512
c5d5c8d5ea844aa9c52f73ff210f1fbe158ecfb62412d9956bc757bdb48993550bcd3b63fd2ef2f36daea9a01e0894dee96bf801e22647e93457b00e03654633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c898f21aee7ccbded9ffa65b53d8cb4f

SHA1
24413a268168f3414f30bf705bc703eb7a624a67

SHA256
252ee8231bff7636e117c6976851fa7839e34cf6a2ad8a4b0480ec89124e982b

SHA512
7d0d5fec9a3384645b63cea2655499c572fd0bb7f151f0128e424ccaf98c506907807d8033e7529f35b458aa520c98f471083f0390694ca951022a7a1f906564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c2573d51997aeaabd40725cdf2b1aae

SHA1
ef6a851f3cc37a25fa268047bae3549217215501

SHA256
e5ccfd93b868476cf7b122490f0ed3ad33bcd642f44c3168bf31a03d7d19d728

SHA512
95763faad71786b9fe663d4eb3945a466f7f76cfd214a1fb729688ef1b5394ce68c06054993c93fcbb393f303316f01b1e5cdb2d70b69faa9e2b8a864b64594f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
63a6041276e195f5d7cd608eeef434c5

SHA1
8e372b27fcd222bc73cda59ba50a05a08248a7d9

SHA256
63a32799e95e65ed9f6fa4860eaa63ff36099138142867b77867cbb968f82b70

SHA512
fb057212917bdd56db59e0669321902d52763f610bbb702f34d5b66fae0fdb745c99cdccb275b11c94569dbf7daa29c8f60037076e3252a2e49d4f438960970b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
283c3a4f126fc8f4e198c5c6a07280e7

SHA1
091542b1b0d89bd326174459b807a791b402e65e

SHA256
0776577960b0845a3d388304819e566010473654820bf5ccd1ae55af3d8e2164

SHA512
e14c14e6fff1bf7cea5d6972a322e9dd3c666bd1884cffe8883ed92b52c7c98e3e8e4fa6a395129cb718d7d6d07793634c1ce5a84b86d189a84f5bf7fa4abd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58297c.TMP

Filesize
1KB

MD5
9f29dc056e97637d7d8fc67ae5e87f92

SHA1
93e7c67daf9e5c66a4a2292fb3cdc4e62b543682

SHA256
e65bce288aa9aba60806b8c42aaff523280cd9c230180b54b93947bbf856ee00

SHA512
275338d9f896e3cbd021094f045cc60b12c3239dbc10e2f6235a6c1b681ff272378a3824c05ec7c57089ee9e9dadce3aa32889bc3b8aef3b241efaf2be1f3773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32398acdd16efa9f3a870dfb54e5af64

SHA1
2193ed5ee8d16df9e44d1be3c57155d71a5b418f

SHA256
8cc60e70783be17ea824b86d977ca7756154061d8e0d8dedb5afdcdcd6b8d108

SHA512
a0e26d6baddec62453db4bba78e7e607b86de8fced7f2de4cd0343991d23266f116d6eb681eb4f240c29fcd1e42cb6ecf307c605ef0078c3cd66a13e99e9042e

Download Submit