47e775492561192e77fcd3e38afdd6c96421512d8181a660afa2ad08117af989

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead3e8e10fa5e6d9ecd47b7852e5d632_JaffaCakes118.html
Size

74KB
MD5

ead3e8e10fa5e6d9ecd47b7852e5d632
SHA1

67c9ab13d419b8dd42fdd1d45ff5b16817a17530
SHA256

47e775492561192e77fcd3e38afdd6c96421512d8181a660afa2ad08117af989
SHA512

67fce32d46f1f17684cb8b5f54245e6ec495549968995e0034b4605d09bd4523b490d6fe1a297348e8dac73262a1abc83b64bb450585615be24f0ac2ab51ec8e
SSDEEP

1536:aKStpAxXfVBBLC0RBHCRHi2hN2Cvv/i5EF:aKvXfVBBeOUhN2Cvv/L

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4736	msedge.exe
4736	msedge.exe
1736	identity_helper.exe
1736	identity_helper.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2784	4736	msedge.exe	82
PID 4736 wrote to memory of 2784	4736	msedge.exe	82
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 676	4736	msedge.exe	83
PID 4736 wrote to memory of 4912	4736	msedge.exe	84
PID 4736 wrote to memory of 4912	4736	msedge.exe	84
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85
PID 4736 wrote to memory of 4280	4736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ead3e8e10fa5e6d9ecd47b7852e5d632_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650446f8,0x7ff865044708,0x7ff865044718
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4168 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10186194582307644043,1663177731949676039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x44c
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
7dcfb7808607960b4b360089c19f4c76

SHA1
c121e1262decf51c623fb66a21e73b941d5a39fa

SHA256
001b21745c82ab76db388a4f592f9f5c9a0e36bbf64844b0680ff30b5cf735e2

SHA512
552cb46e28d5e3f23a9ca30ec0e73646f330a13882737dc7a4a82f83fb8985dbd49e0ca54ad642ce63abf4033df1ac8b34196ae31644a49692f742e8a0c9cedf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2c05fdcabff3b9d45b99c2df6f56bb8f

SHA1
eb324058ec6ae27e2e67402552ae65ab2e705e50

SHA256
e6404163f60d496a17099985fd87477f886ec809ac7e34de1a04208c70895074

SHA512
ec924deb777546a5505c8bceac6f682da644ca5be774bca26963d8954c91545d82e93e6fafe6b1eefdf5f33686047994a22ab12b1aa9454637f8fbae04aef602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
203a0854851ba00a62193931ad47609c

SHA1
31525a9eafc7df0610699a939afbe87a8e91cdda

SHA256
6768cacc630c59c2edae278bf3fc7049a010db129491bfd3051e03a616bdfd94

SHA512
41ccac8f9bdefa0c32b8a874e37dcb40088dfd1aafc68843e9b607f1803d5397e281506cfb5bc3f08b597310892b7eef57065cd1f58a71e01bb81b5f2be19d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b7ae68aa106f87802e5dc9caa0eacae

SHA1
ce5f6c64425d5291dfacd434dc8f0bc5c22be866

SHA256
6dae5af23bded916d40f730160328cfcf2b81571321b44e868403468117f7914

SHA512
f306114513d7e1ae259303f2f292ae2011683b9bf4d3ad7e8a49ccead2ebbf4d3d0acbdaf6580fa33c666c6894fb407e495fccb37cfa908442c4510f6c2fb83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a107fe0dcdc4af65474344a859827af0

SHA1
57a49520842382ee77985ca7e75d23c1a46bb0aa

SHA256
f92b514d7907567933a474436ddbacace55a16657b50c89bd7942c9e4326d83b

SHA512
a59281717a1bce1b484891e4e544bc29eb83f90e397f2e946ae99b1d925db1e06717e3a33d570430ccd0d4b5ebf1c39fbb6e264f442ef62755d56d5d4db141e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
be68b8f663c30b89de188f1b545242bb

SHA1
6766633c0af393f4c2956a93abc936be2f97f8de

SHA256
9e5f4802adb1c65bc8d441c76c34551a3e3534998307d1bc7c77b2e33161127d

SHA512
09f8700d1dcd960f591573d63e19b94c81dc67f97d0982d9c49bad7682bb689c55e94de5b58a0a3e16014f6d7de75141338c644c4641c21129338b630139ca14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f34b71269d56bf43aac6d2a73b28ceb6

SHA1
1e0230326f6f95c04261500d5d1161eed313cdd6

SHA256
c0b5b2108d9c13c94835a5224f78de3216cb0e574bf3d7949751f8132b4e9640

SHA512
0b41ec8c1d1780fe3ff5fd733ca5e43d4b6b3c75c5ee84e9ff61b13c5d6f77215e789f98bbb3e25129f44f2f0921b483c89717147068f706b6b38f13956a3999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583ad2.TMP

Filesize
1KB

MD5
e8d1b697ca1a49a614169f9a7bf86132

SHA1
aa2b096f826f50ea07dfaa5e8efa81d7a2d8865c

SHA256
3e6aae0b25bb46070b0113acef385937f897896d25f309d96d6f1bd164b8e33e

SHA512
b7e162cd9566dc3a5bc0f8dae92eda499c88f06d97448c307c64942df40f24fe8da1b1346c13a4c4dff3054768c94dc35428145bad6026a19c1b5339b814da81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
732d3e462676b3758aa6aac784d8cb18

SHA1
e53d41006b3faef73eabfcfd473b26a559c515a7

SHA256
acdbbd07ce67e09ed4e4cb98eabf4cbeee05160e8200808573ffec1ef3d54767

SHA512
d5f5fe1c4fec31a6ebe6178888680d78bcf904a74795efa6b3e3bb1ffc9267b975fa7e2675bb64946bf4415b082e108c7239709f33d0ac6904f0a18e5a164b0f

Download Submit