cb7b4c7def7c23418073558d609404039ea02da32905958beaccf8132a55bdad

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d615a1aa437b016e1cc365cba0c579f_JaffaCakes118.html
Size

95KB
MD5

2d615a1aa437b016e1cc365cba0c579f
SHA1

fb62fc661952ccb78c6a59d3c836a57aed112cb4
SHA256

cb7b4c7def7c23418073558d609404039ea02da32905958beaccf8132a55bdad
SHA512

165cde89b83ef17a3049061b9e52bbbb4407b9eeab3967cb997b8cbb71b2cf45234bab8ce3ae0c8bbe027b3bf6795f8cf7e61e97b4b40e945e920c0c38e551b7
SSDEEP

1536:S2imBqrim7t2VZFMevRYIbowLPVmkl3lQ4VWNf7ZZFsW6bV:S2imBqrim7tKZFB9ZxozZkW6bV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2448	msedge.exe
2448	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4576	2448	msedge.exe	83
PID 2448 wrote to memory of 4576	2448	msedge.exe	83
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 1644	2448	msedge.exe	85
PID 2448 wrote to memory of 2036	2448	msedge.exe	86
PID 2448 wrote to memory of 2036	2448	msedge.exe	86
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87
PID 2448 wrote to memory of 4268	2448	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d615a1aa437b016e1cc365cba0c579f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc375a46f8,0x7ffc375a4708,0x7ffc375a4718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8702771537135051446,11828411979584161622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
58f69d6bc5ad461d99d4b3e324de6e2a

SHA1
549be98c1e319d31c34dbeb20f27e3d1a9f6c6b5

SHA256
07cbc7d72d8f68330b65b86cd125a4f274e6bbbadb2ec313aad3ae7c5cb5dd30

SHA512
ece361bec5bbc40388a388d60f6bd27fecda97032a577cdb3470443661d64bd75d984a76c84e290e2ced389b2cd4c26fe47537f62834ef0f7c9d5a17bc664027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
386B

MD5
bcf3e28cc4f3d91dc17af1a1cba19469

SHA1
0adf057c0fc9e39fc8400c146b6c80ef3856e98e

SHA256
4f1ecf5fc043d6aeafed0bd085d1028d3389468ee14aac8cacd7f0f7d71cc9ea

SHA512
5ce1d275f149cdb3b9a3f3297c5fd8c5c214159ed29ee450ac8a485d4704e698945e657700a82d25c2cdb4d7ceeb7f7ef33dde5a6a3c7defb8364f1165d96b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae64022bdcbb2329f0bd1d1c3b62b209

SHA1
380f950ada6b69f672e0242f5f161ba4f64a062a

SHA256
72a0f6ec779b402e6a79ef73119563b5796d09213c83b08fa2780c417888461c

SHA512
eaa219d88eb58e36fbafed71cc16dbed2c76f529db2d283f79aa53a126e0803b90c5cf77f48a8637ac5fe2ea6d737f2fdf826a66a5e30e36e7a3e1eebc7fd1eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cfcf9a2b4b8fc866f2b27fa44835fbb4

SHA1
145748fbafdda4f94a3c301e6ae1d68f140cf30c

SHA256
cec8fb8177f0f5f0f1ec7562822bd42c97e2dea9058dc8194ade045f14f7b3d3

SHA512
c340fc3435b9b7fda08215e673404ddfb89e27c26115e4302798bd89f4d66176e8000225ba1f1bd76c0f3ed84d0d11b079d9d62c4bb6c7f91ca7e8c81b8d424c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
598abdf1e92423252fe3d9fa75af6fb7

SHA1
d5fd2fa87e7432abb8bf02cad711d8a53286e6ea

SHA256
cfacd68f4e7168dd84be0e50f761ada52b1be2e784108e3bc156e46535328e89

SHA512
924ab3a3e208c33c43d6eadbedd611ee9ed9e5fb298472e27a107d5e0674e82dec2e8c256d8ab85cb4947d0a9a6722749f57b27c275f8a539af7f1622d8d8211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a531d3bcb2af115e9beae7269e9dfe6

SHA1
c3e923c11a4d89859bab6820a7412ca2fb22de8c

SHA256
6f938b196e322fce5020436d61bd3dc60a583af9d938796a6ff4590487b89260

SHA512
fe7c78a3a166fe1c33c529e6b49ab33f3961bd36fbe35c548516e1a90bcda2f53fc4b910c8c18f8fde25efa1cc2891046b3358c840d61312d4228ff7567d4448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
55b5e900b1ea0c535d0374c9b97fbf4e

SHA1
c54c3dcb3330976c4884987a720c80c386b6ad35

SHA256
45822a40e57c8df5d61c17ebece83e411d486a99cc1d4baa83f22da2f9557a7e

SHA512
e932b5812925edcb3e651bca0fb33597124ddee4d2c2400ca17cb8c5bd0625461e5eb124643f24388341e35e5ae7d7806ba324754c051f06e72ee50e6dfa9f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58df8d.TMP

Filesize
199B

MD5
cba8493c8eaeceebe49a302a7c9232ca

SHA1
94c0638fc49bbd2f92b3649404a7715b6741ede1

SHA256
1b5b97bf1b987406f732010b81a37b541b8230854c8d96d21d5a0379e755f403

SHA512
080a8c50f79e3e633287f85c6d0f66ec913c4877b730a5a1af75d0ed99605fb26cdee7e6b51666e7a3cd2f1f0d2a7f5ffd1ea50b06b301e87aa82be3cea2fa51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57958424c140f71934809c7de927e67a

SHA1
18db5929f2bd624d7dfe11e85cb9fdbdd4138d58

SHA256
92aaad4df67b9b7ab49b9d9f855053b34ba563a0df91703715fca5fdea077609

SHA512
67531edd78d4d9f67acd1fc2bf8b39b620ca6e3622756e3ecba85e3c41926e689e3944035ec2281d64b3cd3d3ae218e6200cec54c508bcfd0bdb63e87039b629

Download Submit