6234058c98b2e984e36d1625f5c79ebd76550a7cb21dbb0ecc48f6c460b7d60d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57797502ee3859a789d296f3f2746cb0_JaffaCakes118.html
Size

118KB
MD5

57797502ee3859a789d296f3f2746cb0
SHA1

0991a87dffc0bcbe4f99b70b8bd55ee2c6b45dc1
SHA256

6234058c98b2e984e36d1625f5c79ebd76550a7cb21dbb0ecc48f6c460b7d60d
SHA512

25947a5d68d158a45fb209d7a306321f23f797915b3cc44c1db791fa5a627c4c4280db3bc7168c01e6e32faec7824bddba88426027a4391e6ebf727b7b57ee9f
SSDEEP

1536:HtJEwCjanDD9BVZfkjDoFjuxlp2c8bj5Klf5wrw+ih:HhCjanfVZfilp2zjK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
644	msedge.exe
644	msedge.exe
3064	identity_helper.exe
3064	identity_helper.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4972	644	msedge.exe	84
PID 644 wrote to memory of 4972	644	msedge.exe	84
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 3944	644	msedge.exe	85
PID 644 wrote to memory of 4944	644	msedge.exe	86
PID 644 wrote to memory of 4944	644	msedge.exe	86
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87
PID 644 wrote to memory of 460	644	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\57797502ee3859a789d296f3f2746cb0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabb3246f8,0x7ffabb324708,0x7ffabb324718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17450706512191881154,18049810851401861375,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b0547ce47cb43fe298a587743fb1f6ba

SHA1
e5d86d77394d8ad60bfe2d1f5e7996ac108a45a9

SHA256
1f9a89e888f814d9ab7e1843b6bef5d587d5b19f64ea4e9ddae4ce953c7da764

SHA512
161861cf1be0a775bcb44299504d249125a629e25422617a0cf11be40f491bc0988fedb19a7479ba49e1d0e8c1e4606ae4a890ca62e76955f3841f9c1f75c5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e2864de5c2f446661cb66191ef7f4eb5

SHA1
280d2c5895d5bcdefb07402a16bb560f67c40ee4

SHA256
36472c03f6b01577b11406eeb68bdfda25e44c9d500c6612916319cfed8cdaa2

SHA512
943f81a215262bc93913768555775de0ae9ef868c846380f1882df3eceb360a4dbe412da30c867c9607978b23c10865b53c434d7d223ee3f1b49ce799acd7a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a5278de2671b8d829979b77fc8acac4b

SHA1
6469c7ff5015ceec6de0ccdfe9712aac712cf5b7

SHA256
09e8dc7f928551bc5f3f5ea66b679fe718ed6cbfdae284494ee23f63b9357a43

SHA512
89f6fdcb40abfc3d7296b61b2036aa58f5329d73fb71876bb7e60ab00661aaf0c67a8e297c3f5351b574beedfb99a5ddc5e72473a832a602bbc73ab2af6e848b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c875dc97731ee981f354ee10c96c445

SHA1
67b3dd8db3f2b1d0eade5d060cfd02b9dc7c0cf2

SHA256
1e6e912470217fd164c69cd69a8cd899020a41037dc0db4f937b9b41f65bf8e7

SHA512
d125596ff953a9c82f66bebc039fc12e9d6ff9074b8011be9b1cf99e4dc8caf8d1acb059da5267ea9a4056f760a1dcfa6c1a2e70393f79f69d22598645dcdc9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a2bc4c77ff0267a3df123a389e0cb4c

SHA1
59097543ed5d41efd5c4b857bffec883a02e4faa

SHA256
c3df5b5b008a60827e144bb71dbe06b50bf6a3b437ca52814966e05f6067d17f

SHA512
915c3084fcf93ec9643c4c1067416cece9d5cb2b4fc519556d75521ea9016dc3f2bc13a48452c1b44934e911d195b48741d5d7be0cbd2082a3f3f0dec113f229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ef7c93805ef49e074fdf5761808bfa8

SHA1
b4ff4edd24d07b3a0e11833aab67059f24437cbb

SHA256
ac09d581550a0ad046cb1786971001832eb5471e3b724e94d9034f6dfb48f09d

SHA512
a702d461fc2d23843812ce64f98c25cbe65af3ae88107b119b959ed8a05ffe49d335d6adc7efebe5113dc106825bb514615bcc2e23698f7b3a23f895c41a06c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cdfbe9de0f058d03600932efae609b3

SHA1
94e746dfac174580b37b79d504b520fe6da7c6b6

SHA256
7b4998de6e12f999a21e28c46552aac962c38d7f135b5c7eedd3c0ad1459bb03

SHA512
f3cffd0666f2f2efaee72771d3697162447328fb499d700a46f2d2f68901bf52f26f1e01bc02b17dc0cb8dc2fca6e606fe6d9c8c0889756e047ae87c3da92c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5836bb.TMP

Filesize
874B

MD5
534d60105c8993c1c84e8f4d7c9828e1

SHA1
e40b7170828d6d5df20024419f88dbce12e1d706

SHA256
53a5b5e02698a416993e6c456fe7981e542d474a049542490b3fa16cf5696c92

SHA512
51848cff3a30560c76e6aaeeeefbaf29da066d0c6e650978952b5285c6920937216df04db9eaf4b222b314a9d4d6cdf988e9b0ac865b9a7a51fc7370a49f8c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
670c49a191ee7a1a5409bba0bbdb8aab

SHA1
2850326d123cf8a4c6518a371ae6852da05b83b4

SHA256
37c8ec590af5b2a8193d6a262042ef9fcdbc903bdc730a03a3fc6e4705fa08cc

SHA512
ad114d05580dd725428cdf2b5b07f8ea5331751b89154eb2ccd0d7ff4ee270a0aee4356df1cbaf8a3bc116a73d6217c1ef800f23a0072709d6575b4f98da3370

Download Submit