e7f610f01e54266ff5a4f896f0c199b230510fdae01688dd088b382c3c487acf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe54c6c478288acde5f52d1ea2ed1e7d_JaffaCakes118.html
Size

114KB
MD5

fe54c6c478288acde5f52d1ea2ed1e7d
SHA1

21b1aca05d1b801502da9db69bd6ed62187ef9f5
SHA256

e7f610f01e54266ff5a4f896f0c199b230510fdae01688dd088b382c3c487acf
SHA512

f127c74db152c99225ddb60c92f4183458723037e4a0c0692d33c7352ac0c202df0b9695bba42b72da949c38127a6ddde3d3761a717c859dcf6159c0c045f541
SSDEEP

3072:Q2A8hGgaX8QaAWYmcHS6P+ciQ36dSr2VeB:Qg/QlB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
4808	msedge.exe
4808	msedge.exe
5032	identity_helper.exe
5032	identity_helper.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4008	4808	msedge.exe	84
PID 4808 wrote to memory of 4008	4808	msedge.exe	84
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 4384	4808	msedge.exe	85
PID 4808 wrote to memory of 2416	4808	msedge.exe	86
PID 4808 wrote to memory of 2416	4808	msedge.exe	86
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87
PID 4808 wrote to memory of 3912	4808	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe54c6c478288acde5f52d1ea2ed1e7d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8297146f8,0x7ff829714708,0x7ff829714718
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14280776040893706034,1116337183302710220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
83a2fd6d03eac21df03b9d1de2802108

SHA1
ae5cac80632e2c55b5b880a85b25d6c9d1ffe1b5

SHA256
4b572cb62c850d05853d3e7401587920c9b4188e3db9b40d2969dcd896739db4

SHA512
cdbd2d83d19ab5632b9513d8387c7ce4c11de818b33f712e51dcb205529e7d15565334c087eeb51fc6e6192d41ad80dcbbe94dd8ef203eae6b4cf0fd859d49dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
affefae740db01cbb36f989351d71ee5

SHA1
500dca9c1870094db5dacc6fba5ccd14aa64390d

SHA256
e1103470d7baa47224b062a05c51941a0992a7e4f457126dc498ee0937770638

SHA512
53777e79bea879c9752873a7f881fd1a760ff0af25584a637b955f2cf3cca649b84518b79057c6f6789df1a0fd167c59dbb4e1b0f769d884f968884a6202d3d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
54ae9f4ec10a8bacfa03711599ec29c6

SHA1
e79de2a6c96209c6b019aac50e74b034adda3e28

SHA256
241c7a5e8722c8123006a4c9c8996784aaaa260997d6412a72c455973cb92274

SHA512
0005b0da9b6bbe654c1ef72dabbb50148f0107d8535459e362709557494c369a939cc5be83d8c5e652b7a32c3dc893035cf91f083a26cadf78a62e43d4ef28e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
80aea3872b1d38ec4e565ff98c839662

SHA1
1e58496df0606280782f9ab8dd1b94201383ebc1

SHA256
017785bc3802ff81df90ccc59c5a3d906c71a13e2919829a8aae5a693e8f503c

SHA512
cf13a401418569411c9330470fd7e55402c234336e252b34a9624f3f3872b855052fb48a3f24ebb0002afad7ac7d97f66bd476d0b7bf591bea927a9bf3273f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60e3066d6f6f92c2e42b87f5915e786b

SHA1
d35604d32d7e46c764f1fa9be6626acd14485ec2

SHA256
724f74a7f2fdc7b01e57baff943ed4cf482f50440824334c698cf6cc8a9cca0b

SHA512
86a20a34ae72a9f19b5324318ab8b90551b13ffd31e331895d44d94e5af52b57263ab924a6878471fc8368dff61dcaf237e59a806f52c4a28010a9cc4a34a755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09371049fa98e20210b99e17e8b99656

SHA1
5a54375d2a0968b009e9e26f5fef761465177a74

SHA256
cbdae3251335ce97076f6db92410b2f3d70b1c3c410b0e05b5116f435f11101e

SHA512
6c8334fb3d86715c675151650e398b30698e5973b00e6de2adcedb6fd530f87d1fe27c91a12ad1c85c1cc714e49bbf79af58e9fca5c85a92ae08c6a53e102ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ac15bbcca8d216cf32958d5e487199f8

SHA1
14246b94ff3952abf2ddac2e93676ddeb1168e8f

SHA256
4d55437846d75a0588a2f10b83ae8333213c4f96c7577cde8ce8acf6ad053940

SHA512
6a7fd975bcda3a29ba1218207da042296230a859f6ca8a550f3c8ff1a6264ecd4fdaabf9464420f927f9e380ce96a2aeec8ea73383c908b79c2e3e9ff5983762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
60127c6bb01cffad8ccbeb3d2c10ea6f

SHA1
a5474fdf76d3abdef93febe1ff578404e59f0d91

SHA256
e6525662e7445ce745b34716ca61307e3b973ebbb6ad4e746ad865f3c179ab7b

SHA512
195e90acde33e4de60f98eccda4642a0813c7424273c4335dd5f5ba4c02a9e919d4e4a281d17947ea5bdb5f8ac908b10ef00358d2b705a8d1b9263a486e625d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583f75.TMP

Filesize
371B

MD5
c87bd7e6bac5bdecd34d04cd5ac9eec6

SHA1
f3f54c5d721cd3d00c327fed3b22864a3f2d2b9d

SHA256
f848c666c990161338f4a68a9e68125b4ea359847b87e43b8bc6cfa74c910486

SHA512
ffd612e02920d58d47167576532909b254adb6654de963e01dfd29eeeccfd261d6ee3ed5eadee4c305d7678e05f29e7b7f6bca0dc4c1cb61f71eccdbe0ec3170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e7b22a6baa510e53a19a47eb4af82d92

SHA1
52126037a638abc1b9f33f568680087f7f2e0f6b

SHA256
655e9a6bd0a52f09aaba8ca33e026b718c877744db5e81ba0d35f35d9e012c8c

SHA512
d8ce6e882d6cea3807519f0c80abfb3a08902991444635871a020a2bece7325b598b06f9f8cf7a0fd98f44b0fc128c512c7cd87c3b65b33740348c29db20d182

Download Submit