69731f06b9620b32e820325d74ef9c51682ae7fd1254b25ef4e65c4ec4218a6c

Analysis

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4b32d2c25dd31a2ab3eff82b699d13b_JaffaCakes118.html
Size

230KB
MD5

f4b32d2c25dd31a2ab3eff82b699d13b
SHA1

f9c05d06077b5622e380ff59c36f9197ed7fe993
SHA256

69731f06b9620b32e820325d74ef9c51682ae7fd1254b25ef4e65c4ec4218a6c
SHA512

e5ec210b94d5636c9523ac8b8eae3b10ff5bf24ef644d4a084633060221488b1dcc0b79c517910eb969438abe6f1bc3685c62870f8548567f21f526e75ebbaea
SSDEEP

6144:l+RELVzhXkA3d8VZQvzwV2lms5JBpknvjXGXgcHMW8rKQX:ERELVzhXkAN8VZQLfh5JBpknvjXGXgc6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
652	msedge.exe
652	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
1532	identity_helper.exe
1532	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4852	652	msedge.exe	83
PID 652 wrote to memory of 4852	652	msedge.exe	83
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 3840	652	msedge.exe	84
PID 652 wrote to memory of 1416	652	msedge.exe	85
PID 652 wrote to memory of 1416	652	msedge.exe	85
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86
PID 652 wrote to memory of 4588	652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f4b32d2c25dd31a2ab3eff82b699d13b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbdc846f8,0x7ffcbdc84708,0x7ffcbdc84718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1228 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10282990220838726305,14777594842895134568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f6ede07d25d8c2ad089e835f6d701611

SHA1
862eb4a037b1d51a88c1917ef6881cd0f52f6da0

SHA256
2cd5f4f11ae6d447753da5e31a8d2aa34e3d7b26f7d6c01635cf58e11da68fa1

SHA512
0a37ee023c3ff10ee98c4ca7b3bc224052d633fcd18f40af5fe2d72af0e1bf1468f9a959714685d36530fb38e4f9deff039ef3e3a2368d2880b497301cb6c282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
62bbe224a2e23a51c2a28fbaefe9e509

SHA1
2f2ce796ee88711abfd5923305c9585d50c9495d

SHA256
8030d9736780a5cf75121c26d324a95568a766bf606eb3a43fb9a3057b83e876

SHA512
d26b9ad63d1f947362ecd40f1119dc5c1a66c4ff3296d4954e777ac87e06eb7080619a8736b3eebd967dd7a3e219baae7cf5263f5dd5b3d67f38713464dfb457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fe1dfb9ddd8a205d32ee37b32c0e1302

SHA1
8a2c815662c4718536aa33640578d3ba97e63aac

SHA256
78656fa92e6adc0f010c16db9cd1416f2946b1a0589a014366e81cce61e3e090

SHA512
a07f3879b6c0ffcb5b4c390c5e6d702ec2da83623fb941701ce3aa8ea0b62e79d47903e5ed315148a417d2285887d4e56ed150404f85c03a5b4facb56f169d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eff6574fb3c39ee612e9198bb0e22232

SHA1
e4ad1d2f4e40e56283602d192918aca5f5e0f8f4

SHA256
d1d4659f2a694e233c033f36613e12093a65b6d6b2cb397e92071d49382105f1

SHA512
738982d1754c9582609283fdbe27b24299a0dfb29c847aa67694ff1e3eb2e9a2acc9eef171f0e630a050ae3dbd1e2d259d33fdd348f55bb7f41ae24f5bd42802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d001692b18bb6de0f0349a8da424a85

SHA1
effb8df0ebed68156e51630f78775258d30bcf58

SHA256
ec3fae2f2e0ff7595b5ead8db47d864c9c1ad3eb950388c9d083c520e10aff16

SHA512
02491d449809c152e44d7d3dc928ac3211d4ce6cb53f9d811e3e9445e7d4d1014eefc507eb664752f13b746402e99b11298cd58083a3651b2c1ec0a5ae498f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6510084a339380d0379cbeb103061105

SHA1
e577c8d2fb17cc5e5268850a1ebc89aabd02972f

SHA256
bf9de37a82a744974b9caf222ab99dba0436591b846b5356f3341836d02c0ea1

SHA512
0a7f7cf5ba0334d9d69599822a1ff53e3d1af427fd7fcd39e7516395826d9dc98ff828303c9230ce50cfe9fd64711f4919e86538b24c98398c8ed9429a085a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6779516fbc58cd4f26941f32d5a510b

SHA1
0463a4c361e67f923976d26c99c74fa2c19cfc78

SHA256
032ad5283e1761a1226b248f1d2cf9bad46c087267e364439a7b8a436eb404d1

SHA512
a9955f7c141bc05c425977339bbfa275fce1dd9109c24ac350c1d5d2bcd6c0dc480791ccf4ac3814675c2a42c8eb50f627ca536d16ccfc0834b14d7d496b2189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
0b6e7a859714b15885d0478abb3c1b2a

SHA1
72c28fc40ee86fa8a8109e57e39139218939d124

SHA256
a2df1901b6116eef3c79d3ef7fa176cea0773b50d8f90cd17aa6b4753d4b609b

SHA512
630ac2c42e0174a164771b152593643a894ec71446758c45cb39d1999fcd381cd49ca546c8015a84478d31f44eb73fb5b7caa3a900886f32c51c0fb5e5f8b9c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584baa.TMP

Filesize
203B

MD5
73cb8f3082bddf6f066adaf779060240

SHA1
a5d725739221072d441cbfe82f35c8b2b9033a30

SHA256
08a4aae7a6e6694c846c3a253f8764330d739f9b4310ffe4ac626841108283f8

SHA512
b79c07c58689f291a6d786d60d13e15b949fcc7e0fca2e00216fe7ac13385a3e14e0a3cf649f3658aecab55f8e4f89674ec91f8b2c143311b0144e2097a0c804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a78ce6d58c1a41f0f69a0dccefc19603

SHA1
88923fcd19e9af7d1e80d996547c5e96cc6c0b28

SHA256
6588f65fbdc225e1235e55872ea167d8d3b27b3329b4b7129fd2d8cb99f67f3a

SHA512
59f52cccef54fc1b7d05dce4f5154b3cc4192e8e3694815192c1baea738b27d838c32ac27e6c2926dee0af43551a81df9d5cf460613dda215a778e628ddbbf47

Download Submit