f18f22e5868cea3fabec209a156eead3b114b9ed6d189525370c87becdbc61b8

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce9550238e59b9dd38b1bdff63774432_JaffaCakes118.html
Size

137KB
MD5

ce9550238e59b9dd38b1bdff63774432
SHA1

2bc66b80d22927724caf1944ecd4c4cbacf22823
SHA256

f18f22e5868cea3fabec209a156eead3b114b9ed6d189525370c87becdbc61b8
SHA512

b6d4a4dd7ddedd921f2df2dc4af5ec5952ebd6290c4a4078be6899cf78a0f7a8774d0e8c18da0ac55287739ad67fcd24b5d5bcba15d458e10b30233c943419eb
SSDEEP

3072:HUjCWDxYxQ2PDxYxC2T/Z1sSoEneo6tzS8JjfCqezltjb:HUj1DxYxQ2PDxYxC2T/Z9r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
4668	msedge.exe
4668	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1576	4668	msedge.exe	82
PID 4668 wrote to memory of 1576	4668	msedge.exe	82
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 4816	4668	msedge.exe	83
PID 4668 wrote to memory of 2016	4668	msedge.exe	84
PID 4668 wrote to memory of 2016	4668	msedge.exe	84
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85
PID 4668 wrote to memory of 4580	4668	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ce9550238e59b9dd38b1bdff63774432_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8885846f8,0x7ff888584708,0x7ff888584718
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1192 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6540630260556965177,17427022258346277096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f3a5ba9faccc6f77f05983259ea439ce

SHA1
6fce86d2872287d0d15183e7aede8fde5c33e0c4

SHA256
5cc24853cc10ebdda08daa03b77db4ca2128e8dac20e17503ba6cdffb410523f

SHA512
6dff0c0546bb2f395f90a7f57c3c65e58b85f5d883a3302af31a2046acf0038b9662e8c20a35b62776b7cf91a1d253f585a2e14c6ca3d526dc32f5be72f15355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e758ebafa667dc14e8df5ca48854d2f5

SHA1
edf7f1dfcd328010668306532b10fb48e1a1216c

SHA256
4e98a1626ccd12857339ee81bced956b9e2ac60cdd624ae589af0711a90ceb87

SHA512
5ac2f0845e53f0644cb85775b4958d7734dfca6a72572b3e2bac606298cd962d7424c91cbbe79995ced2260173dfa8cbe0cf064bc824e0400999779af179cfc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7298e9d7b8ce633425448c68d2490ad5

SHA1
ab214901e659c5027e6155a384bc225bcf010957

SHA256
234acac11310799c00b31e912685c322d50a30840b16d8ecf9f430bb95a3eea7

SHA512
ada61c923fd22688a50335eda442432e38ac96d0b3f4a1ae48116e3dfa9702bb40a5dc155679ca8a4fef0acd64fb3f41ec718d1c0c66fb5159dde90ef06e9f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b856539794541d69cf184311971d675

SHA1
374a3ffb4241a791e7d2b1f5295de821901ea149

SHA256
96582963e3fdf8e7e48b992d16294f69ee111197cd26c6cd36fd573031c1c90d

SHA512
81efaeff9ed5ea18491f9dfb0e92156b2063d87890c876c18d0508472e1e46e5c02768b1c0d4b39f0e87aca5f9741fb384db55f41381b1cb0d23d5fe894e8e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
58830ea251b6892ba04843bea1e6a2ab

SHA1
1ac7753db95c6921ac110d4ea97a3c61d3f2465e

SHA256
7d9a1f41d0558f8690238c2a44c5d19459ab6cc3bd637692519eb507e0254b8a

SHA512
68d258ca7ab8cb5515257607ffa1842135526720ec67dcee2b07ebaa73b6e689b2d2b730d24c4580b8381275e32a8909b081e9fbecc62266b7084e010bcd57cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e385.TMP

Filesize
203B

MD5
9bb5b93aca696fb146961ad43195a740

SHA1
e57938f08f6349aca0210f6eb6029af799821932

SHA256
dbfc7e97cd8ffe0a6860da4830076acc350fc34fd7408e18f286cfd9eb1403be

SHA512
58260cb04682b6f61f61790b7330702ae43bb40b37ed21d5b0a4355eb0eb0a93b130822737596e02d58fab482078a4c2848ac048ca5a1ed191692f25803092b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f7f4f0d9616631b86ac1d2a433ccf56

SHA1
a8cb9224318a83297000b98ab5216da7f06388b2

SHA256
88e5f3ef94571a4f61562d1c6779e90b946ab9d4b7a3c981d90a4421625cccfa

SHA512
b77fb94471c9a7df764e8ce647a07cf8e8e55e81a172138c94e402200a470813f0801d521fd09847be0fbf17300acab9022bcbf26cb15276a31aa1b46690cc67

Download Submit