3e771eff56e5d4b3eeab548da3ac1cbaac246c29181c23c0e77f63a25ea5ffc5

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe49ae43f9d68eb72224698c053428df_JaffaCakes118.html
Size

52KB
MD5

fe49ae43f9d68eb72224698c053428df
SHA1

768dff0dced94317d1532dd291dc2540a491b542
SHA256

3e771eff56e5d4b3eeab548da3ac1cbaac246c29181c23c0e77f63a25ea5ffc5
SHA512

71aaeaa315aaf0027b6fb4b5c6d901303a3a2ad8fbd480ece06170a9508b23a9357617a6a1537941a818cde0efe6b6623deaca92c09eb79f1c89a248a3c0fa9e
SSDEEP

1536:KPMs9u1P05b0zyVzaZETYZz7kAGm9OtQt1n1CUVUYYed:PaIyVzaZwYZnkvm9OtQt11CUVUYYed

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2012	msedge.exe
2012	msedge.exe
2516	identity_helper.exe
2516	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1892	2012	msedge.exe	82
PID 2012 wrote to memory of 1892	2012	msedge.exe	82
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2848	2012	msedge.exe	83
PID 2012 wrote to memory of 2036	2012	msedge.exe	84
PID 2012 wrote to memory of 2036	2012	msedge.exe	84
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85
PID 2012 wrote to memory of 4884	2012	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe49ae43f9d68eb72224698c053428df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffa0b4346f8,0x7ffa0b434708,0x7ffa0b434718
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3528278803184232162,5321150698095875892,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
30KB

MD5
f2be449dd17a5df18ced888f92a37ee2

SHA1
fab90de098ea436527255a2ffde6af791ef8b363

SHA256
ef3b0f0c463bc637a83409c7f4c03967f52036227900949a1a94b6123e00d997

SHA512
af20b4f32bb0ca0dd947bb65f3e0faa0555f85109748d84b31dfefe32cb267e298bd8f8887e113a6cdf4181e5c833fc2b9b2cf110425a36b1fbe3284befb23f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
485c3f905309a226d2b2f6deb35b138d

SHA1
4ad20a2ad0ba53759dcd040c2ab096f5e3fb5430

SHA256
4e838e1b2b6146d895707e6be6f39bb69f425acdc3a05dc1364a72b1269c305d

SHA512
6babfda79c678cafbc659e5b93a3dde4293e74ef5680008777b0cefba4898a3c10f49e486e2d5ee6db81483dc21be54f50a26344d78173ec511ef63c6afae24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
b442659c1cb22936b72a160a361b3b8b

SHA1
34947c4a9483deef0b636f8da88a19ae566d0cb3

SHA256
2070b6721bc196183a9045e503cd8cf31bf268f083b6f8de1a78abb7c0ce013b

SHA512
143179b77dff2ce5dc111af78d4d5a3f1f4c0a3d091391b0c3a871782fe09d6d2362966235fb6da1f76ec2cd17f7ff71cad877b89ae263a1794035e05f24e268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dc4dfd5d43ae1df18bb8f6d9153462ce

SHA1
fd9e1c84ef857a260e10bf4593e9d607df65435c

SHA256
2de8424b1f61fc1522abcb83834fa4e255c9cea407da144a6f6c2a9f93b9ea94

SHA512
43a6d81ff0af6610d542207a80e8d425f611a27d9170644374724e525f01c8e4484c4231f20b420a980c12cb2b0dbafb6916a00168526a7e2e8ec438ced464aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0abf31ba4a1807c23addeaf84cb3424

SHA1
cf8324622409cedaef8d619d7b70ea8cd3c4ff5c

SHA256
4624915243767e5d403413e5d9dd0c41257a8fe578fdb042345a4f6d56219b5e

SHA512
14117fab13b67bb2c4b6c59a56c06eb75a64e4324c9902dd9274272330e1a121d9ee0a4138e48f3705a409eb6ce9482a04982081ea77e38886e5f3829398f95e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da493675ee611b29663ebff670ee614b

SHA1
8b5471da2b26a27c27ea7ad8af0b7f1dd699203f

SHA256
6e47148209e1653a2ca05625306682e0901596fb6c21c6bee6d344e214598336

SHA512
51289bc8dda3cac6d055a5e34f30b50ce8bb51325b4e1beaf6824f840ccaf155fdec9f36b6c348b7960d60af6c9467c8042a5d96d9660a4ed5e22ef8de9f34c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7089d61d748ca25ba641c9353c9dee4

SHA1
130a627410c068fb208df47877de5c97027bde58

SHA256
5c73c1ba493610dc4cb8061a346e949fe16b9ac4bfdfe9424c1de7e468ec240c

SHA512
b3eb3f30a6dca49d1699ba44a6877a3a8709d155444cb810be4522abe36dc5676a97cab5e2b9ee1b505acfef0346221bf25e55a69a6430fa3cdf8ed0bf2c8183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1843a817e9b67ec3ca4eed0f2191a46d

SHA1
e6584b6c46a0bb398ac5a6fc7b9d0388f793b253

SHA256
5276dec04ba146a35426c408cabc57d0cd03a0540498d796a008e6781e051839

SHA512
713cc9ed3886b0a09e39f860ffda40c1e178de030b8e7b5e9150dcdbfd2aae02d7cd9ed14687a225f17cd67f332cd4cf791e34dc48ffd2122b819cab8e2c58b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4a9ef7de2b40e8ae681ded1ccf90da5

SHA1
a4e5dcd3c272cd00275de2097ff770a39cf3ace7

SHA256
cea4bacadca2129be447cd42fd4449c8268efe67017c39324eb1bab9faefc16e

SHA512
61cc6797dba06fa74f4cc338da9171ff398d0e675448d8cf0bb8d49dee68efb97c412a96a095a8d25a9bdfb3fceadba18010748f1d58dc61e823e72a34250f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad36d5eacb27bec25845aeff4e8b299f

SHA1
f0c794746d7b81a00d455bb9ed4c770847f9f302

SHA256
f8c2b0497932eca301db584b8083ddf64c4f8f2f743dc900038bdd5b8bf9e814

SHA512
02393b7696eb0f0382cffa2401aa18a9b18f7eef596d6bdf7d031e58b6c79492624d8088f911de23c13057560375c31d936d150280cedebd33796348a54741b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
291b6b33a558a9d05ed9ff4d72f1e788

SHA1
92f34880761b2cbc31d923b91e81b3c29fbd029d

SHA256
40b9bef262d057fefd050c9ff66c802386681687bdd3ee024a85ec82591a4dc0

SHA512
0eb027da1cd96f8625e21db2b7e174a3e548d98588991570caab3ebd1da33c8e4bfceedec7b97bc5242e08a6aacddd4f4dca82a64c3b72bb732d368243628b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a071.TMP

Filesize
371B

MD5
d0514f52905b93e72fc22f29fc5cb119

SHA1
6016177ef434155f55877b5e8247ef4386598567

SHA256
ad8602cb40c8d7a0904fe859abc279805310bb8e8075a0bcb30676aea419f072

SHA512
08fffd1f23d8aa39ee914a25ba8ad454b4550674a520057d56c6f5fb1d11a830c7e48e61c825b6101b327d8f47b183a1132af2d809d831cf05b2ea9ead8b807b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce9e25164a26b0f509ef831b9291e8e5

SHA1
938b17dd5fad0855463811399f234042944b117e

SHA256
19a2c273039099d4b348ddebcd3868b1902af033d5a9e0d5186f1938bac95822

SHA512
dc9bbe11d8ae56d565286069ff109965e6e91f3d8b745541e66b6a693436cee3ad840ee505a9586dbdf95bd44744f3112efd5f01c45cdc08a0211acb0289b0a0

Download Submit