e753e07b70c3a2111576d7edd54cc94d80c6cf8248009a4b79bd9ad0c93528b2

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00a6d9a944f83ddfe83ce103e148ef66_JaffaCakes118.html
Size

97KB
MD5

00a6d9a944f83ddfe83ce103e148ef66
SHA1

3846a6bf1772069f840f85748fd8074ba221cdea
SHA256

e753e07b70c3a2111576d7edd54cc94d80c6cf8248009a4b79bd9ad0c93528b2
SHA512

c0045c1f187e36e6df7902dac24e5e5946fdaf2c1392b587f90a01503580a9175b3b952b402545e7ea33ddbd9fb5aff84d49af2d1c7b2127347d9dbd57db78e2
SSDEEP

3072:FYWEiOfLOoNE1t8KNfiGTgm4dmXKl8XsAZDC4ZCgB/P+cVnFr:FYdNfhut8KNfiS4dmalL2FLn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
4112	msedge.exe
4112	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 736	4112	msedge.exe	83
PID 4112 wrote to memory of 736	4112	msedge.exe	83
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 3116	4112	msedge.exe	84
PID 4112 wrote to memory of 60	4112	msedge.exe	85
PID 4112 wrote to memory of 60	4112	msedge.exe	85
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86
PID 4112 wrote to memory of 752	4112	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\00a6d9a944f83ddfe83ce103e148ef66_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa67b646f8,0x7ffa67b64708,0x7ffa67b64718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5094316877743677831,2526015383621590393,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9fbec1ab604d5b2b2255cbc667e69d0d

SHA1
8f26b49623b2bbbcd1e041d5a7f5e23352578400

SHA256
2b8da821018b6bb37dde0ff8649b81f8d3794fc1d6639a0397e14a54ac9d3f38

SHA512
ee85919a24ae8848186939af39e684c37b63844c7c95cd7c59db56da6db24cefa1a6e1f6580cd12869d3c9d52cf838a16f89bc5aaf093ba5185740072fc6b2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
35742d35dae6b7461fcb4b20c1ea3c43

SHA1
f6115af27b3d6d3189a63e987b86b42eded90ea5

SHA256
589aff8d3c20a0485e559acde785bd3e8ed168850d7e3990ab60801f3ca59db2

SHA512
80447fa7613b2b5be4f85cb6dc347adacbbdf21e23d8612335e40d166ee55487574edd20ca482ebd657c57dbc65311ac3d2fddb6533c98b9e27b2388e6e7b264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1c83d9af7c7d4718d2343fe9e1ed01f9

SHA1
753bd3c3ffd976326fd357f96e564ba31763a621

SHA256
d6e084fd522cc239daa034831a6a1909a212102a9067581d35afd0a00a77b107

SHA512
774b4aad3209bf195dc0fa2ac4766ddba2a93ff73f24fd8550a7b5f04139a47a55efb9d8622f05eff6cfc907fb9787495e2a68e50e0ec1b167f155efa5e2dfb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7dfb9a853eb1f702a29812a2f9e4051e

SHA1
554e0d08e7eccf5151d7de393c8a47b9daac14ef

SHA256
8b7b00fd95209101f9aed5af4726f89362b633d462bca981323e36e5191ccd6a

SHA512
4e49002b413731bf2a78d35c645c36871e2dd709450396a78f24a219772ec49f22416740fe34c7682c41e333c140d368f72589821341dafce8b923729e25fb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bd5d52cf699bb41c8e8eb64dd6322097

SHA1
cf3a353ecc0af8d737464e73b309249556ab96bf

SHA256
8629c9fcd8f621c491a6bee0b85488bb4d9d45b0bca94f5ec24a53fdff660712

SHA512
8c202c52784341b58faeb7baf7fe0aaa434cfe4d7059e3b4001f8a66cc698e15090640d12e8adc770852a0541c44df1da73dc6c5ad6670299a2aecd0c6eebfd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb8355fc0b57da55672e3b3f9d721302

SHA1
dd1c17a3ececc74789a85dc8a359a8f45a4098fa

SHA256
03099dd8d044baf9886431cad42940d1da10cb98b0f54e80c844e80e9bce72bc

SHA512
a2481bca924ab65649589d73db1b9ba8d057b443601daf0f57dbc9dec194198b786f8e4a19d02759558a793d0dfaba6357ffaef8da1c09879a16d8308417a5d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aaf46e79c60c7b4a6186e91a8c00e36d

SHA1
9d2648e7d88678a6b823efedc6f85f4a9ae0895a

SHA256
af93fbee1c10fe9d4e38d4b9ea37fec161853bb9f0d7a65a5c869b80171a7715

SHA512
b56fa47347ca2c28d75238da53e435b6b894bfacbae9db50f82bb3574663d26a8595e1a88b076655b396eca301e1b1afcfc46fbc817fe6a98be1c2100dd6379d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d189c061976ddb30adfb5a5e044d5930

SHA1
c94910b90bb4bbba39f77e3fed713a0fb3037de8

SHA256
39aa08098f0cf163812984e5b5b11e4ad8a767ad69ff049e68acc26fc9a005da

SHA512
b8870daab2fda2f7af74659ece43f27733e4a830ff65f23f5e744948b2efeaef26fe9db1086bc92afc109e6818b81f85dbaadd5cc51794649ec0e2cd679c83e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
201B

MD5
0a8066ada42b6cb4bf3e91d65383dc0a

SHA1
d527f28a4f39cc474e0aec877a43fd98d59f066b

SHA256
297548d659d29a4eaa91f7d7a6a5aa3dc062e50f9847bff682958fe9ded15f5a

SHA512
c90153b23fd78218efab4d48bd829f5acdd7038b0c97135ecc7437de8dcaa7896602fe2719a952b89c63e35683c18ae7d968d80a2670bb13cea5a3acaa6b9ff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5889fb.TMP

Filesize
203B

MD5
d6ce35ecfd08a3258fb642782e06e75a

SHA1
3cb06e2bb16dc5f16e73cf180c876a56817fbd56

SHA256
46a8495e14568533de5a8aa90ad9d4a4bd79a391bde042c2d378623a2c77313a

SHA512
e18af8d28a103c949a207b3de59685c59363ae7027e6a155e1f1514409799f9488e8d0f5918edc70e12b07a0c47bcd1b042f3d1cbd1fcf2372c86dc2c7f943ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cec09a0294091d7399403000d2d4f377

SHA1
363c30c0f70f2efc8097a37fc136ea7b1dd82667

SHA256
da8add4ac93614d47c347f422302a627209d8747c0ee68439c2c7020f1bd1c9b

SHA512
5a618a1e50958ba8b76821189f02fcc5f1114a4b2e60aa36a41c614ec8c29be78deea0ca95cc530985e2ca0f97513f69d3d5cbed9a56a875eeb03d575c923d7e

Download Submit