a8985f2df1d42b9cd96017ba1f8c01c9c8a6630ed5ab16cb226f7fd6d206d8b0

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fce1948c6ee09f6ca18131ea7f0c436_JaffaCakes118.html
Size

52KB
MD5

3fce1948c6ee09f6ca18131ea7f0c436
SHA1

4aa4bc166c29e329d7a9eebfb9b45f3059927b0b
SHA256

a8985f2df1d42b9cd96017ba1f8c01c9c8a6630ed5ab16cb226f7fd6d206d8b0
SHA512

57102fd2a98abc22b320cfd96a3f0bcfcae71ffbf27129b07ca2b4cb3c321c1a01d669ecbed0a1508280217c477191f6cb5bc23284ac97261a4d89d607e6947e
SSDEEP

768:SR5G3mp4kLudVzZQbJNZgRGCww6g2VszvIT90ns6mcGxiiTnbYOvp:SRdXcsbJrBHqLBpvOvp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
520	msedge.exe
520	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4912	520	msedge.exe	83
PID 520 wrote to memory of 4912	520	msedge.exe	83
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 4832	520	msedge.exe	84
PID 520 wrote to memory of 2192	520	msedge.exe	85
PID 520 wrote to memory of 2192	520	msedge.exe	85
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86
PID 520 wrote to memory of 4684	520	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3fce1948c6ee09f6ca18131ea7f0c436_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c9ad46f8,0x7ff8c9ad4708,0x7ff8c9ad4718
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11140047511743912819,12083870380474412647,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\284866e6-4d5c-4848-9bc2-54d37d0f8afa.tmp

Filesize
806B

MD5
8561af62f36f454d892a2e5984ba4b52

SHA1
16a07181166cfab7f6ad4a79c1e5b5895d6890e1

SHA256
78e1b170c0face84553535c91bc18fcc477de58b0bf8ab0b43f5bc5acda0ffcc

SHA512
25135df6adbb9ed413bde20f867be8d9a562818da5605f4490e9b21d9d27700400f6830daea0139bc13527e4d491ab33bfa7a4b4baa7c2313c9ade0f1fae2ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
dac70724a535c2c7840268d406e36518

SHA1
1f75ecedd7a41cd4cb4c4224e71368e82d783f64

SHA256
16f49e298a77ac3b36ab1359551058e8af046fec519944329bc11386d7aa8c45

SHA512
ff3d023813e2faff2cc5edfccb7032a8c2adf4f50c62998d06e9e7d944022c095fd19070810418e5b967be18a8db639c2d87148f48f480f8820aa4394f39c2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
868B

MD5
f2a4801e47834fe4f3c27265b8a1abc0

SHA1
b078798bbf77f75573c5ecd9303dc4cd2667f3e1

SHA256
bf1509c2e9d5c9231ad361f14ce72e9a55aa24287d38905de2ee6a9b3377d56d

SHA512
2215d532654bc33c5694e9dd8ef9d5622e95c2a5a1425e43e29e1aa24838da2bbe77aeeb3216f4f9092ff8f8ea6a64eec3c3cb0623b0022a5e46479168dbbdc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fcaf3b511bf69351acc804165be88a1

SHA1
4be37897f3e494b24f0cb7bd049b334da811c77c

SHA256
3e51842969f1d4bc8a80f827f3c34f23aa4f9d7b57f767a9cfffb748cb1802b4

SHA512
9bc7c9f8f3636ba16c20e09e51a490f34ab59e8fda0bb5bb5a5c95abb9f77428989e00768eca2ab42cd1912fe69d9c308343517999b465dfb3218a8bfb9401b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ea91eedf7d81de1b2102fa275fed61d1

SHA1
99e210df8e2a8c6f069559468e00b6695acbe477

SHA256
41284be9c6f49d0a99ec218d2156b1fdd03e1360239b42d63aa6306f22ab4346

SHA512
bc581d5fe802ba880e527bcd3fc54381038d328b1de4942694d6ed957f4ff7d2e9114ed57f3e8c1624562e4fc982827e368006aa34cde8a5124cab2c52c0e18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6d92751f0321ec02e437b6236185ac6

SHA1
03969e1d21b201576cf8b13dc1b301256a4d91d8

SHA256
675ba67c8107d6a4168426dc5d6632c25cfeaf569bc77482169890465a50f446

SHA512
23e7134ffd5a7c064fa0b81a8449016063db6038ab86bd391bea0c394b66f5196fab6072bf1a8ca00502d47972192758b183581abd8fc0591dfebb1b2d8d7b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
14c10ae9bab1d78bb2e0a3fbbce70505

SHA1
d51b2344812e87096bcd0adf0fd3eed77212113e

SHA256
547997ea19fb6f7da090cd7c3af631e0ca29d227374a9cefb102db4e3454a09a

SHA512
9092cecb870b4b4af7431ec372edbe07dd03e4353160478c79aa4e4dd6efa32f27d8cebb9e5750a90d4aa89401bc3444adc1afbde91b855d8a2369be18fe7d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582ad4.TMP

Filesize
203B

MD5
027ea87069e2639d65a41cfe8590ea8b

SHA1
32bf9aacb35f23482de5c8d07e021fc0d914a4fd

SHA256
97cd2665deb4c268022487145467f3a2659455a56aa4a8fa71d02cd49e13be37

SHA512
9b9c4779325f8eaac472d402685187600a6766f9c95317c9b72b139aa67be4728b508cbfe3670b94cf4cb679cabfa7e9b5bb1f2ef00cff0155a186b68c0ad3e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
39b3ee495648bce0f6ffe9d7a1ca5c6a

SHA1
c67a6028cd1dfd5cb07eca90039d35ca235c8492

SHA256
a2a82b307c011a53ad687601a176278b5adbc50cffdd7e27e5c3d4f46196c190

SHA512
b7cfc88f00112af492cfb85ef8e242251092bb440778328d88c745ad9f4cc18ebfa4cd9216ca570d1ee62be53bf27137db9ddaf042868e9b802ab83d5140f560

Download Submit