3535efb8fef1251b384e8db2883469983ba083961b4c1b779938f61233d3b788

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaed1db29316b7760cfa34d645bb134a_JaffaCakes118.html
Size

55KB
MD5

eaed1db29316b7760cfa34d645bb134a
SHA1

024e07fba93bc49f266cbcda61dab427c6681dd2
SHA256

3535efb8fef1251b384e8db2883469983ba083961b4c1b779938f61233d3b788
SHA512

657b6283b05feb2c2923b5bbb5f039b5a2dc478bc8d5dc204f73713c39b9ae7c8b463fb956c4daad30545b191fa180b60801097720c02b993860b944be7e47b3
SSDEEP

1536:0OREe0xWEka5NHlf2WfmRQoBzZtkUuyMrXWViZrX02ln6:0cGWEnFf2FRQkzZt5YZPn6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
1300	msedge.exe
1300	msedge.exe
2488	identity_helper.exe
2488	identity_helper.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2312	1300	msedge.exe	84
PID 1300 wrote to memory of 2312	1300	msedge.exe	84
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 2068	1300	msedge.exe	85
PID 1300 wrote to memory of 4856	1300	msedge.exe	86
PID 1300 wrote to memory of 4856	1300	msedge.exe	86
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87
PID 1300 wrote to memory of 1068	1300	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaed1db29316b7760cfa34d645bb134a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd582646f8,0x7ffd58264708,0x7ffd58264718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17605730337053739657,8420365642754502241,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9402c8ef25a768107a526887f7a08fad

SHA1
79dcb4c9d87657037cdfd220fec38ffed3a687a5

SHA256
7f36af9fce477695da4f64b406c33afc484d504920b2ae2b86e22af837a88a18

SHA512
f27f713f2bc4c2d938998f0fabbab92d614ae1fbb98986b1bd80387b6479e7f76a160c8e53406a2c0c495e6e3d00a131ce8cd68106428c3279b02bdfa37271de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4fe599439c13066586a545336024fbcc

SHA1
d8a058e70a209ae14a5ccb58151648ffda881c64

SHA256
bee07befcf444984d042f38937428485a06ae402abc1ef3f99abbc63674e0b1a

SHA512
6408b3eb56ed217230e1cc1384155a325a6605f6bf7b63fba40f538a9c4d3ce807280b7f58e7fa843be1a6408794dd94837866aee2d42a56f06a0e34cd376374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
07ceca918e63d5f9b6c41f61d663eaa9

SHA1
2878dc44d131bf166aae66268cd296d857ceb6d2

SHA256
93edb5017c0d12280535051fdbd718f415a5ad39975bf34df8bbca837e853dc8

SHA512
a6d0f7c79a316e903739cd811ea2d7574648d299277bdb345b380c9336ff09e7b367d3c56172642d2560601d1e9974d9e59f9a5c1df9a1d3fec470d41bd22f19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3da828d1290eecb6fffb75e0a5b581ab

SHA1
0f8c99ba84b84d38152f72ffb1a7e954d8966a82

SHA256
bd70661713c0b89a3249be2f8c4aa5b98a962feb5a1604d3b73047a4f03a963d

SHA512
f531554ca9f74d681403059beeb65755624fad6c4f28a5b13fa792b823a4ea416d339121ade99681a14f53477aa565497453b344450e4e46d7ec8b14b032a1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5039dbbbcad201dcc40af139e8579526

SHA1
1131d44e90220cd2a4dcaa761093fcb94cdeb443

SHA256
78341341b31ae8f4168102575040d9f4a6416d536bb4c0bf3508961b71b130db

SHA512
a087190a75bc8d29046dec1c867db5b6faab8a577450c4dd2f87a5b8351e74772b4a54a14ae1672892d18d4df8f15534a13abb89df9d8a26ff1e86773f8bcf00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
220bdb07e595ffc9bed6e433efa554a3

SHA1
6328ed8d6975de279ca086af7c0132d565fafb9f

SHA256
c97335bde43cddabc3265950f992f451eeb3fe196b61027c159c1b118543102f

SHA512
e0ebb14b2deda14a01e180cc05610efaa4a59a69cd1828120071a790625d51201eeb674e9bfd9fbbf00e29413a6543c7ba4b232ef9a082b18df90783671017a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
d87afeeec24bfd3bf6201157e27d959a

SHA1
23e954320779bca3fdef44ea276356616676bd37

SHA256
8c50b15d8818a35f3f159c033565a46cfeca53edc0672b3c3169200b467609d3

SHA512
47aeba953bb8d074808203c931570821739b4515d8234ea0c655f78da7dfefe68c2f820dbc6b14f45e1f25b4059dcf9cb960630c05692e5c268c452e16cd34a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813d1.TMP

Filesize
201B

MD5
42a65794923a94e84db0b0dfc844a14b

SHA1
d6b587ba06d0075a9490bf35eaeb0867c06fcb69

SHA256
5e538f08eef166557d0fd0be3272bb6e777ccde4c685af246e931bc39fe96ab1

SHA512
fd1ec682b23cf115d9e8d8d6e4381d015063147b10e0eebd57d86ccf5b698c4bccb8ec4a52e0daab6b810975b798688236238970f73c9d346b2e8d13e38bee13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5bb6b240ea9d04c8bee21e8bb5af3370

SHA1
f678322ef98a85b92d49a87550029473b0813b36

SHA256
c338e4d5303725db841f573faa5018c9dbad3eb6c5d06e85d9cfe6109c64c285

SHA512
424a9b7280cd332c6eaeee464e4e7b697b843538305fe6d6a117a0b125436d11f104e574b744d515025fcd48a6e0a2a16e589c9ebcea14b370198e649f82456b

Download Submit