e3c6e334d8859c5308037f5327c6dbdca0b6fb6081c60be73ffa2d8e6887e23f

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac62dedd7684fcabf5bcdec268ab5c6_JaffaCakes118.html
Size

75KB
MD5

eac62dedd7684fcabf5bcdec268ab5c6
SHA1

b4e4de9c7d89086db70db9bfabd93ac67e93fdbc
SHA256

e3c6e334d8859c5308037f5327c6dbdca0b6fb6081c60be73ffa2d8e6887e23f
SHA512

33abaacaf9703e0896f6d92aa95152270d5aaa611e4e0a9167cdc79d29c57149bd504377878b29a070fa214eb60e34bd0a08b0d8f44ba8c64f75cf724d10e4d9
SSDEEP

768:y8WtS6EJjFDAxIAXfRDP5BQuCax/vtvOlSfbUcFD+SDzDchN28+Br/icsEic:yVMpAxXfVBBLCcvtvzlAhN2VJ/i5EF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
2416	msedge.exe
2416	msedge.exe
4272	identity_helper.exe
4272	identity_helper.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2452	2416	msedge.exe	82
PID 2416 wrote to memory of 2452	2416	msedge.exe	82
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 3900	2416	msedge.exe	83
PID 2416 wrote to memory of 5100	2416	msedge.exe	84
PID 2416 wrote to memory of 5100	2416	msedge.exe	84
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85
PID 2416 wrote to memory of 464	2416	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac62dedd7684fcabf5bcdec268ab5c6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11936731146994291218,6575141188154693766,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x52c
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d1ae3709bf005afa98b1bf15ae2bcfbd

SHA1
a744e7bb9f1cf4fd26efd12c708bb08ceb8540a1

SHA256
a33c737d3ad1515077bc705d1323fd8badee2e689b20c141178d80b35ffee81a

SHA512
bad3671735c413f182d94aa4ef6fe173b9b10ea7ae2823d0e523005f16ec1d366fe33d3e234c1ae30bdedcf693e995a261e06564841bdf241d3ef8bb090b92ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9c00d12913cc720cb948ffae6e18b3ed

SHA1
088fca40e18e672c521badf6850478be77187dca

SHA256
b975b53e5eb02d27553719ecc11512f76043fd3d8fa2ab1b7b546aca5fcc440c

SHA512
9e5019f372e524ae044d30ba6706875df963eb4e073033a1b6575cdad955c31082b383022a99b3b3e7c2e6d2bcf18d5237f3a492e7761e10d1904dc496a0504a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cd59b45d45da3b193637abd6add3abce

SHA1
437c1d973c823b5ea04775b3e724e1a53b601f64

SHA256
007537e3d6760b12a724fb9bd2026b9c1a700e69e93f74ad73d9f741c1406f68

SHA512
efb783aad2b811ec2d2055dcafecfe6861b850694390c25a37f59978e4484b1cf2acaaff23f0908da13898ca0d684970c8053505efab94896f00643683603789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4493a4a4ddbdd4791b64079cbd1df733

SHA1
b231733dbaa5c835cb53b1e3ffcb88b56ab2e13e

SHA256
e3ba095726e3057955974fdfb9720f3599e773b7f3e0dff18abb0f189e2e3d48

SHA512
44ef91d875a495c11610d4688b501ca717d12d575ed90e6e03b5a2100aee936e3d5acc919af3c20e6a1d161d9158e4f5974098ff44b4af013d256a1bc992b121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
488fe90034cf797eb868879654cee6d6

SHA1
8108b03811d1edec4382ee5f0771a444759c6738

SHA256
0b8da5a4068108c4cf5597e5527c1d697ebcb558c3a3156a17b2779a296f8d29

SHA512
959a3fb46c84c1ded5bd66d8d69184cbd0f05cb6456b67d7311e733c6d2f02e2874a5d4452b95aaaeed8d2de06d109aca15818a5bcd46ad3429b6a3ba47a42bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
731a2125680f65b8dce638b0144d88e9

SHA1
1ec46207629e74dff589b11607431bd4c3a13925

SHA256
c644ef5c945a4cddbc67ffe6e066e4ece6bfaea1444deb36c95f6ba7ea63ad80

SHA512
84fbb576d8e82ff722038e80c15f8c43c758d2e0ff56944138ccbd954c3724c38186f045e1be7601c2ece577aafed6f6b6376937a067b9d708a82b3d4157e8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b4381c87608b903a074a1688dab344a3

SHA1
a21c099f15a05b87803ca1dd6f0bcd41544b802b

SHA256
0a2a833f3169f537b31cbb4d510b6d833beaa5933f690db6cdff3bccb8a1c833

SHA512
ed6e78445174ed9d4c22dfd1401df169775c20953f8c57a5f41cca9e18e9a79946144c8ccba26e5bd8a7e0f304c15bcb4ffd0bf1d71ebff791424e7bcb0ffc21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
63f1c56e65c8afbcae1bb7514c71e4b4

SHA1
ae35345c08f2e1c3857bc9eb85067261349cf45f

SHA256
8560ca8e4a61dab1fd5a46e1343b1db4ca5278f94b0f766923caad703b9fc1eb

SHA512
56a2ad54085b4ca42c5fd3fb414a258a11e0725960c3b1302ecd1c38dbc9bd5754fce69dfcb75acd820f3a3d2cb6f8f50009243e2e66b5e3f82fbacb86cf6e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5814bc.TMP

Filesize
1KB

MD5
4ae9b76af73592eeca6d18ddddc439a7

SHA1
60c191305cbf341f28637360d77058282ed6e791

SHA256
c7c9f8d52a39d9caff40c9e2a85e7b08b8ad7833079cc3dbc43172b77381f839

SHA512
43bcf8c24622805aee16d6d7652376304d9d67e0f827fa19d3d9a6ccc1b5388d001442ec0b9f055b82125cdff9dae719cbf4978490fdabd74ddf7045f09a45e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f488de7fb6acc5f7c03f85ad1a17305b

SHA1
453b987ff03f5a95646143df03fb9f9ade4d2345

SHA256
7a86809fe830e8e03db503a2fe77b3f06145728994bce5435e412571522fdcf3

SHA512
0241dfb5b41f3b28b0051e36413a6b1548637eb3a571d2f571ce5249c06c921b70b59b0fb269499151568830e1291bddbe112478d0ae852028f2920f0f698313

Download Submit