c5640d73f7153b504323856a374d256ff13c71a45b502c82dc1f409e79158bd6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ebe64642e31de15074e012b3270aae_JaffaCakes118.html
Size

287KB
MD5

16ebe64642e31de15074e012b3270aae
SHA1

d386271ebdf21c44e07d1520edd746179cdf5248
SHA256

c5640d73f7153b504323856a374d256ff13c71a45b502c82dc1f409e79158bd6
SHA512

c51a0a8ad9c6f1f0afc3d12bdc8e2e20c2688e47fe057f32d2169f1f90aa135f3e4637e2a7820f43dc33afd2064a9ea7d3ba6da9ec60bd07109f5ed7ee75a852
SSDEEP

3072:FfbRDVKUcjvG8rMUcXmNRS7GhJpeg375rwXnOdirQsKYW7+zr:FfbRDVuGXmNRVlr5rwXnp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
636	msedge.exe
636	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4748	636	msedge.exe	83
PID 636 wrote to memory of 4748	636	msedge.exe	83
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 552	636	msedge.exe	84
PID 636 wrote to memory of 4560	636	msedge.exe	85
PID 636 wrote to memory of 4560	636	msedge.exe	85
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86
PID 636 wrote to memory of 3400	636	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\16ebe64642e31de15074e012b3270aae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8355b46f8,0x7ff8355b4708,0x7ff8355b4718
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17710017659552557340,16847001976031795843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
b00bd63f12da8d0c9b11f6268b72f04d

SHA1
0e4c192d6e46046611488fb8dd5040f23f276da2

SHA256
b9da0583475728de102d427eb2818fa14757082b69744e12efb05679a20770bc

SHA512
247a4c8c01e865e44cbe7bcb645685bb6cd5473a733a54de31f53c3de36831011ae0b0532b746d4d3072a1ca3e2efd14f7fe23743f9db1cdd9fecb8c0efb8f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
75493b72591f429fbfcd950210757620

SHA1
61dac906403c0591cc529bf2695b7902ac4bb493

SHA256
5e6aa2c87f93e2a171466b0cafd05f9e830dc0c3e9a83575c19c0dd78d12bbaf

SHA512
627bea3e60417009935a300f10ecdad7cc1d5d440fdbcef2e72eada855df2fe6525d1b439744e07f133dbc175b4ddb44dad6a6379bc14d7c9a696e730ef9e471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7a76d887a883d98299076131efc4ddee

SHA1
09a90ba3437099bd6a76a6eeca01fc9f46966794

SHA256
caffc7704e915ed0420d76f5118ab506eaf687620e8a5e5b2d683d9b751ed6e2

SHA512
6730cbe7d7814f44aef1ae9ce6efa110480291ca7711405e75d7f0727cc3ef30765f22e06050914ecb5e420e69e354144c5612d6b2e9e04e7fbd8ef8a85e20f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
789b90e14527051a4af7c92ec5583d92

SHA1
6141c2abaf4c5976acd532bcabdc73557581e2c5

SHA256
9d9d0ef69366013b89f479232d98ed64f292cc1a908d8ac7b61e0df726de9287

SHA512
d8899dbbde9c6127706b2f8307692e02e590b807d8c804639631c4470191acd566d53ce9fed3d3bac02135472a9f2fe5e33f1c1d087377c7e60c5e72fdd837df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a567ebfcbbb7251b22e6d0ec1d5b083a

SHA1
ed9ab8cdde8da620e63d54a58b2ac328e8cf2340

SHA256
8f26d41da3ebb7c1ee9c4392bd9742afe115f669dd597173a7fac16832b5f8b4

SHA512
96aba177014b21fb29c755bc31fbb6ef90fc0139551f0593dcfab24a18ee7812a2d55651fb3b2f01f1573497e85e7bdac1e8d16d2b67e6138627250dbba19302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9a751daa41763c2b7558f7196e2de46

SHA1
3abee009da6f5f91a0ae500359a02bd8558c297a

SHA256
6e11136756b96ff8fdd4877fe69435eef604c8982eeea65956c405fd7698d703

SHA512
3f390ef605e80cb0ae16cc2d6f682550ce444b80b9a597dfe4cb1a71f778f36b1a3d66bd3ce6ce004971389b1e07e74dd9f522c1385deb149f8a183801b7f25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b8da3b1b622c8b58fc55dea8565b5c8

SHA1
0f0c806642d70348108e45338faac532164c908b

SHA256
8d9b673535f4f88cb8f59ea1ebccd243866914933fd3b5e7cc938ba98f40c615

SHA512
e96f376790a7c308c24e88809f61fef16b98a69a56fed05de7e03127bff7950dd773e0616d2abb39c679f1f89a43a2bab250132fa565f198d455dd2eb0c32eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c77b644790064ed1a1b486d2120559d

SHA1
262e2f166f47db8e10cb8c804d6c275352ecd9e7

SHA256
33bda2cfa1c8ef21f0212171ae264edc9d89176d23030be45adc938e07f7e8d9

SHA512
9889149a267663482a121cfb18974062905c1f5a063ce48b3d6fb6dbaefa0c2443182e4f36d42d8aa64430ec13778bde422b8ec2ac5578327559a17dc3b0c6ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0567eb6a1b059ed29ad27fa5d21b89ba

SHA1
d75a9930fcdc5618bb475ae42d45be28c05c26ae

SHA256
c8bf3bb7ff2535780d949636584a1b99a447dc4677cf600572cd06fb2cdcf54a

SHA512
ab24de609cee0a6c3ddb54c1f494382d087e842898b809a0bfa16ee52d4a1bdc52e7e2efc5214561310ed86a153ba66d8cebc97538b46d3118d5884236a1da76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b844.TMP

Filesize
537B

MD5
d5927c34fd82a25f84bf94031c121439

SHA1
00b446da662bd859c00a8e4298b17933ad45e120

SHA256
437e4d71a357cfeb0abf70bd8d6c25c24f83e4c1201cfc7af63dfb912f2e5286

SHA512
66ccd37cbf66f4e3cdab22405c8e5d015790c9fda5fd548eef9aa798bcbd2a6b2c261f5f7b8e6fe9dea5e9c6a54ab68d289668f3a3fd2b6723421a04000c1aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a905dc24f997802eb04ad4896d551448

SHA1
89d1198a30641cde0bcd968b7edf5e2278755d65

SHA256
d5210cafeed98a018790b228615f2ba26a226fc7639f9897fb48b71979498df0

SHA512
a4b155ffe963398f570f39912a29661b55a609b4123282e7340a2911d9599cabfa76507879d8766f3ebd2a2e441e94d4a77ace8294fa809c38bf09cedda3bb80

Download Submit