a5fb6d53bc282b0e2b32f7541d6644238730e145cbe32965a4c0dcfb300131b9

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3156feefa6c5ea620de48a6936ebb96c.html
Size

105KB
MD5

3156feefa6c5ea620de48a6936ebb96c
SHA1

3cee02c194c3f28e6801f9d6261b4b5aea22da87
SHA256

a5fb6d53bc282b0e2b32f7541d6644238730e145cbe32965a4c0dcfb300131b9
SHA512

1cce6dff3f858696e540c97711462091d1d53bdb9c5418012f7c6a384712341155b8600235fe77b11bfea4ccbd9eb4a2813a7d2ad5eeaa366ac1cf480334148f
SSDEEP

3072:gFGqbIrqbIVfTBuK/dVwtAch7EAhNg8cwbf:kzIIIZ8Ac5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
3288	msedge.exe
3288	msedge.exe
4656	identity_helper.exe
4656	identity_helper.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4052	3288	msedge.exe	82
PID 3288 wrote to memory of 4052	3288	msedge.exe	82
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 3596	3288	msedge.exe	83
PID 3288 wrote to memory of 2288	3288	msedge.exe	84
PID 3288 wrote to memory of 2288	3288	msedge.exe	84
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85
PID 3288 wrote to memory of 2344	3288	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3156feefa6c5ea620de48a6936ebb96c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb504b46f8,0x7ffb504b4708,0x7ffb504b4718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16892899118939070534,11752963378926486216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
8abc098492e073808b97ab4bb140ef9f

SHA1
551cf58cd327bac55c804c86c450d28286735b07

SHA256
c0a43cc5ad34b5b0d5072f71dae11f5ebb6f540cf9b0fa569d4ca525cb2ac69f

SHA512
5b83b7abdf99f5daeff8ac2deef0c500305c73cab82c013c36e10badac598772206c978ecde5682b5be3776f7bd3ed922a7f77987e7afb85fa772095ebfb6b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b7d7553b0589e23f5511c443c5b9d20e

SHA1
8ba10d2b151aa47e62a222ba3e99ce30adfdaa87

SHA256
6781cb255bfab0a9da1141b26682b9b6b2b806e97b92cf57addad282b8664167

SHA512
184c07e630dd6fcbf3a0d69a71df7830077f816740dbfbaaa4a5380c1bb342ed7e24abe5a88ec42e2b20a6ad81c43b093a649fe97a1480bbbc8907f7a1c4380e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bb8bd6d250eb56ae7d00c3d209caa272

SHA1
868cc7d2c368568141014fc0be7bcc70f15d10a5

SHA256
410f5ab2b8e5285dd3c039622b1aa290175a757f6b9ff60e02c4722195ee8c5a

SHA512
4582725a5bdd83e99f9dedc3db2a499775f1d94b5315f0511e2b32b5dba65b9ba353152b97388bd526999c26a840c6912573dbdec897702ce26de92e03620cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d12b6710b62d667e63c32e2af8ef33ee

SHA1
cedfbf6aa4f77416df1f4f82e8137b9139594b06

SHA256
5f8340cdb0c5903edea407c9e0e9c3f268239be74a54d6da68ced0378276c696

SHA512
98fcec587d201098f378e00ed40f4c574faabab489e1640c80fe4330ae4c975fd0f2d995917b3ff80a0600704c75aad151410a8b8c4aa527ed103552426b39b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f332ecd729878e64161cb4223816f765

SHA1
1c85303fcff9cbea5c76438777c82b0deecb7fd2

SHA256
c0c6adcdcf12a7415c14ad40404c6cab7bd59d21f116ac82f7c695fc6b336666

SHA512
47bc4d1487f45e408dba916161f96ff62275c7cf3970a7cc75beadc0c8cc88c0fa8247034bfdfbcdbc59e1fa434fc0da0e6df6ff1b751ea3550457b2f581433f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
059eccfbe7fc49ede444c0955b3f5b38

SHA1
3e6941cd7091e96a8fa0815799b6b711625a4684

SHA256
5461379df493acc6f1c01dc2d82d1437e2d6a0478f15c39ed7b7dbd2acc7734a

SHA512
1aea4396058bc234d0efdc509ef4d8c47f3a64e5ac6daeab565d0a7f42d014b8614cf640c1b00ed0ee7c2b73c40c46a9b2e02bf1c4cd5e7c5bbb79eee1edbc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcfd71674f7d3db0fc15ef559ea32db0

SHA1
7b5f221eb4f2d10cc8caa02582408c4ce913d970

SHA256
bf23a7ed26e382488a91dfd06c66f34ab142a179494981275efc7298c3f4592e

SHA512
cb5bb3dd091210a85f56827ff63520397e3e05e168558ad4d01e4e59c2a62513cc6a732300024fe1ad772370195aa66d4afcbff0516a1f61a1ff59a04b100794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
e63c84eb9c90aff972c86fe9f1b2d6b1

SHA1
2c420d91d78e3a7aa89f6e2dd73cb66fe892e424

SHA256
f3bf27606f9a9f13c11e7c7172c50640e701bad73ce58ebe790245ceb4bfadc6

SHA512
26550152e0843dcc4f01104973d260b74fd16574ddbb5df3d0a99f6a6bab97c451238d5abd50af9352b20cde5c3482e9d1098d9d33dc87da992d89bc964d8197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ac0a.TMP

Filesize
537B

MD5
a6c740161faa90c6e006c5447907dae7

SHA1
942cd6a55ad5f4e6b57584cd8292c1cc657db6cd

SHA256
66109365fef17257468bfc88174a633768d80e40e77b17685afc418e69992710

SHA512
a32d815a92e619eb9c202c26cdeee8a2c9be2948bafb40e0940798c788ffae090585e5fb62ff28db44d55b8c094a993529704786052d7c57aa86984f241383ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c1c956bae7177fbd9222064897746e6

SHA1
00c7473d03af1d19e9e29410b612ad26d90be4dc

SHA256
ff624df8484e31c7a3ad85cfd93f0ab6a1ca406f5b445dd9ddc5b65235cf903f

SHA512
aa17fd5c342402015eca66d5e50865484525b0474dc107ba80b32b497cd2fd6750f1b595a5a84bab3616bf251abb87bea4773153b7d6b1d46dd3499ef236131f

Download Submit