7946e14c7302fae0a9538f2033a6995170400c43d1798c7233f87697590f5f2b

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e01e56eafbd16b78ba05cf5b7fc13235_JaffaCakes118.html
Size

71KB
MD5

e01e56eafbd16b78ba05cf5b7fc13235
SHA1

9718dbbbf152cb137eacdfab0ff52d80babda007
SHA256

7946e14c7302fae0a9538f2033a6995170400c43d1798c7233f87697590f5f2b
SHA512

55fd847fbbfd9066fbf206a58123cd6ee98a627c904ac4c03ecaa0a7829bffce99628b73df42a1e82e776dab9a13da63528748b71520cd9df4900bc1c4717e5b
SSDEEP

1536:JHvYoFwP88sVRECZqxUvC93IxgdR6TJGv8f66xOFDc:JHA6W83ECZqxUvC93IxgdR6TJrVxOFDc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
2152	msedge.exe
2152	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2380	2152	msedge.exe	82
PID 2152 wrote to memory of 2380	2152	msedge.exe	82
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 3560	2152	msedge.exe	83
PID 2152 wrote to memory of 4164	2152	msedge.exe	84
PID 2152 wrote to memory of 4164	2152	msedge.exe	84
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85
PID 2152 wrote to memory of 3048	2152	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e01e56eafbd16b78ba05cf5b7fc13235_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8895a46f8,0x7ff8895a4708,0x7ff8895a4718
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2672516064828093031,1903375982692673177,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e50a680b9ebbae5afcf9ac888d101c8f

SHA1
e5a32daa600204a1908687bce06d080082e54675

SHA256
e4d5cb020a320082c5fa6bd43076884bce261befa1fc4e783744a163a5764cea

SHA512
cf466fc4a5a40fac04b67f8a67dfab218ad34ba8073ab48f5a04257319270b8c038ce93a0f89f031a718f7dd15025db3b2d44399f1745581ac83a02624d2e484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6f9731cbf621e101fb4b529308900062

SHA1
f2ef1b52debab5670ec7423a60e1e579ff8838f9

SHA256
51ab93667c3603b39b4367c2b4ecc668785b193f621bef53cc1eeb8316201b7d

SHA512
abd8cf3110140b85a387a1d68106356349b4616f3dd2800f5380999958c23cafcad331488ae4879b895e80bb58cf8f0248177057580a15d9449fa0b0d86385f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
472f3feb2aed93a69772cc09c7d57cc3

SHA1
a7a146ce085f6b7d294162e461589d0fd049169e

SHA256
eaf2b54c1086805ae25f67346ee927b75b681a0561a473b22bcafcb5b289dea7

SHA512
712d749a2ffcd15d8c697b1158fdf397798b751905833dc418130db6cf7bd4fbdb1cc25a5a342cdbcd746d6a21b5c2fcef040fd408cff2a841f8180d549ee10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ffd38e1e934b4395828204f070dfd029

SHA1
405069e2adf0f6fa59cd005b09ed59869eb8c1a7

SHA256
aef7209b6583d723f78dd10738e9c74fcb09210a8ff0ebbb7560260973c65778

SHA512
fdc0606a84eff58bd093fc6f436eaf646cad42f53971ac7a7cb434da5221d52093f24374ddb9746740df94f3383e1f1a639210e7d770b15c9558e33c67ae7ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
612b462cfaa4f0a766b620819357ac5e

SHA1
0c504e84ebe7ca2daff75ccdf2f640459285f2a7

SHA256
f02907ca55937db9965f49f0aad9de2add126ede1816e4bc7fb5fba03b8331be

SHA512
16fd686ab9c5a2438dbecdadc416f29221aad1ff06ab59f925cf9ec5ffffdbcb1afe1c2dc3546e4d9fcec5444e1680bc019e1bf85322eea2fa5fc1572b9c5ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
deaf57a563f10a8812975ee344526a02

SHA1
3f8e6784b89c0c807c32d80f0632d40ca177c3f7

SHA256
75733b21f96ffa16ba9abf0f94b1113fc9727f50c86d85c95bd2aafc3dd16356

SHA512
22701cf42eacc0ea7e9d7c2ccb6f0af5f9bf66ac4ce26a87d6a5f285f3314487a50bee52797527c9c5716f546ec8b020c12a7c935a359e0009f9896baf97691d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583311.TMP

Filesize
203B

MD5
d2bc792962b58d1d41ab5b04089f8118

SHA1
c6a99c509ef82cb93df4844ddc0c199a68e3468a

SHA256
c0f6642afd8cd19ce3576135ff1b462fca450c1c86be720f73c4d10cb846100e

SHA512
fc6ed85293abab14d0032ca1eeb4daf84c0b5cc72b4002d8dda36b23c11ca054472a58ee5c818857255d5061b7f17222553dfc422b31e38cfe0194d65ecc74c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2e1a68a8d49db7de03667b879fbd825

SHA1
b4c43087b65022db8084ea52aee6eee64705ca7e

SHA256
a5edbe6b911c21d7cfde49cb8f7b3987e441254b4b2272772fd8fbf5dc6b5f3a

SHA512
8e1502523ffd5d9d102550a231c0cc8a72352febca41bc5226d88ae26bc26801da157a129927af7fb6d84445583adcb6a1fc7e55beff76d9904da01b69e72d54

Download Submit