a8742f6d4061400d3315a2b4fd68934fbb47be494021e043b264a111d57e1edb

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1280437918118e98ac4bb5085e4f7c34_JaffaCakes118.html
Size

74KB
MD5

1280437918118e98ac4bb5085e4f7c34
SHA1

5d219c64f8cdc7b3f71e65ea0e8dbf0c58fce28d
SHA256

a8742f6d4061400d3315a2b4fd68934fbb47be494021e043b264a111d57e1edb
SHA512

7f524cbf5b4febc630d57b4a56183b2dfdcb4e04a4e4584602e8bb373ea234ef4c8512f252d7500bd4b552690d55a31e6263d54b37b2a9078f45ccd0a77c94fe
SSDEEP

768:3Utd6EJjFDAxIAXfRDP5BQuCax+cCUPFD+GDchN28+0Z/icsEic:3UDpAxXfVBBLCl8EhN2Vo/i5EF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
3288	msedge.exe
3288	msedge.exe
216	identity_helper.exe
216	identity_helper.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 592	3288	msedge.exe	83
PID 3288 wrote to memory of 592	3288	msedge.exe	83
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1484	3288	msedge.exe	84
PID 3288 wrote to memory of 1868	3288	msedge.exe	85
PID 3288 wrote to memory of 1868	3288	msedge.exe	85
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86
PID 3288 wrote to memory of 548	3288	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1280437918118e98ac4bb5085e4f7c34_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0db446f8,0x7ffc0db44708,0x7ffc0db44718
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1340 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6651740267397348805,16068459686686020773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x4f8
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a38d673ca1794c68fea0edcd1aee338c

SHA1
6ca2947b245a5cf2bc6aca5894b4e6a9bd4baee1

SHA256
9d2e1a8401a578a69c5cdf7347f89e19810a8a8eea59a2271d91b5edfaf14144

SHA512
bc5a5d6fae95b52358e0696441429e6758ef23497fbf792b58af49cc35bb1e8401390258e4fe97e6fd9718c8721c0b68b8fd751448426e2fb7e9faae932f372d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0d32f727426a3abe26b4909f3ff169f5

SHA1
d917cbac0db604b760edda884e1a8acbdd0cb089

SHA256
b0223a3f587f8433711dc2a85388431518c63e389165d511bb3a214ecfb86550

SHA512
1382afe2a6ac88d97b1a5e480188bb95636e7e312c609aceaac86ed4a8e828cb3faa0b4ac42edbb2c93ded1ccccc4ff3178b1c38236c940a8bf1f94583b0d41b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0ed2b61ed5f1cdefffae2c981ecb3117

SHA1
cae1334aeaba16e33f13d5f1f2eca3ae2bbc9dcf

SHA256
dfca01f7c40e6d8a04472205b471b87158824cbaadbe500648c96f1d36680b2a

SHA512
7e259e9f10028dd814e72673c6faa80ab80ac607f7b7ad5ffa45d7339582b6c7baa2d93fec3504b77110f0ddcb7eab27a254aa54d57f47c87b3b381da761956b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb2e32ed46dd3a32ece43195f7c76a27

SHA1
f816ca30f4e936d5c101d6489711352276d20cd1

SHA256
26c891743d3a8fdceebd804375cb0200c41d927dbe4d3d3b39c63b5ac45a8e5c

SHA512
dc98f342f56332be1e0165851dd8dfe9e47c34fc5148c1de882ea528df311a99d37e05c9fabf1e85f540715bb85daf79a45f491ac5df34b3097126d41c5137ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
116c1578b21f9f2b0ea78c8952aa3aa7

SHA1
b54e3cb6f90b74a3ec808d4ee44929b2696263e2

SHA256
77aa63a7085143b00a9b901e2ac7a74fc84105a2faa9e9d84122a723f636dc3a

SHA512
1fb9a35d5a0d753ec98cb3e8965e17580d9ee3445f084b75b48d2853bdef5aed941ccb0e3c7428aa9a022f3a04aee79a2eb6f52e6c759688aa4b32fb001fdff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b4dbc09da6d42801b977cfc1f40ff9c

SHA1
f22072dc6dadcce1c5929c767f462011caa44f95

SHA256
4b392b8efe6ed8b42cf4497595a4bdb70388df5eeb7dd34d25b391f53209b864

SHA512
bcf7b275d21f89b02e0da05419d1326f12f3561dcd1b2b5509611ad1876441f8c71eaa195d2d0d65959b9323484600b73914298b0dc0535286678aac538f7dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f96eaf4096a140523e2220fb62bf080f

SHA1
78962fc8c8fbc1a8e78eb0bda73d3c21d36048cd

SHA256
582ae480b489e8516a695fe04e6f39a7b98f29d45e2c425d7bea186450545e9b

SHA512
478f067c56074a44c8d2bc51bcc3738db1c35b36cb82a5da95ee9f155ec4d5921d768edf6c38692a1acadbc268d800656fe31d676fc9c15e1bf3813cceb80580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580f4d.TMP

Filesize
2KB

MD5
0d5ef1216e728f21688dfd0d153c6846

SHA1
33f72ed544394a88d048469d65c6f444b71c2686

SHA256
1ac61a4c826a5e74d31b1867eb2d2f164b7e0153910ece0edaebcd8ca961728a

SHA512
fffd466ae65c517f7e515be1d8b8a1744975175207fb7831500adc224f585a215661af9c196a9b85b9830f14d828dfcce10d44f3514b5c65819b0a515bea6b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ace3ed7fb3e90d3f477619c0e3589688

SHA1
eaeb4ab55dae23f995707d8284ce662d9f72c196

SHA256
4909acffe6a7e229330cd13d4463282e93f946cd6833a15b2a449dc7d2c5dc5b

SHA512
5ad64f29a5e141760642f2ef9875453e178ef01cc6a40ab8be7490c26611dc1e36ae05272551e06006ac68fd60bf3a43af56b362c351ba982ca2f1f1e64ff8fd

Download Submit