1c60687f5f66cf605563689b24940ee01587330126c67d6d85cc9b681b6528d9

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

282cf62dafeac7aa1a3ae9124631364f_JaffaCakes118.html
Size

55KB
MD5

282cf62dafeac7aa1a3ae9124631364f
SHA1

6b0d81df4c7203c978bd3ae3d9a589886915098e
SHA256

1c60687f5f66cf605563689b24940ee01587330126c67d6d85cc9b681b6528d9
SHA512

8fa1d7c16b8e98cb9b04965a646120d4d42b9d39cbe147e0848b28af91e4961325ba07518ce81f67bdc7d10b77fca23bcd5077ca95d0d69346bed9c3987a621d
SSDEEP

1536:tBevL+fy67nY46g7I/pWvxvBBl/v0mzHNjINlwOzNgLgugsggVcooMMWWAA9900n:BJZHLnNTtuLSVyiiDKM5D1s0AE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
344	msedge.exe
344	msedge.exe
4928	msedge.exe
4928	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4508	4928	msedge.exe	80
PID 4928 wrote to memory of 4508	4928	msedge.exe	80
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 4740	4928	msedge.exe	82
PID 4928 wrote to memory of 344	4928	msedge.exe	83
PID 4928 wrote to memory of 344	4928	msedge.exe	83
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84
PID 4928 wrote to memory of 1376	4928	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\282cf62dafeac7aa1a3ae9124631364f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0f0646f8,0x7ffd0f064708,0x7ffd0f064718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6500100551130748138,561144331240359776,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e2fdfeb236138719667f068278d50315

SHA1
a1aaba81c4d5da0d72ed86cfbe26223dd9a20741

SHA256
f1190b134e689d09fc2286e3bab53a4cb957595becffb0d9608850cf97d379a3

SHA512
0a71adc9656bfdfa095f730bdefc3461a1f02d883f25221afe03ae7f41751519b866b1ccca89dac470661c143d49c24de10d06368eede7ece3cf6ac073bab1d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
13f919f72a23853d7969ee38dbf9513b

SHA1
788a93bae4f17066d08cab89fae797d53cdd4a88

SHA256
462f3a9ae2381ffb2d68e565b59c9f7e5a9b22405a5d7a6bf6e46b15bf0cc0d3

SHA512
bb937397ea0c362c88790cd2a148e533d1f859c02179b803aab6fbe24b6db6f4daa8e235551a27bf21ae884536502e80e6ac70dd3fab702f47b8e006be10fdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1005B

MD5
2cae9d9e5d0684c42b753d58b61e58c1

SHA1
1b16536bf9f67bc73317b895ff35fc22f991738f

SHA256
57da32d6612f71468a1a5dc5d73de0816b66f5b8bc7ddb476b5591f769c3de7f

SHA512
b5da147a69bed101a42adbe33daeff7308194e8e03940121a2f637205f4a6c0bfa8d11f1af043c11785bdd9bfe493a5b7384c1116ced7d4dc10415add9426cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
003cc86bc5932ee32076dbd6c40823be

SHA1
d7748bdfba23305c4d54808c67c841ec93b1a14b

SHA256
9d983993a0bf98401f9bb0bc5e614eccbd668fd80103f0093dae2b93bdc16571

SHA512
cc6e999138c0a2150ba6817508baa827a8698800ab5e467dfef6aa2141ff88f4ed9f3dad013d89a9d50180ab152eb005210ac9621f4332ae8b426baf36661983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7e80f014e76a6913a6d94716c8b4a823

SHA1
ab2b1ee58120a11c0107b532a151aa4473beacf4

SHA256
37b62ee47989b76ab7928dadd5867489dee2f3e2f789d7a17b5af65ff73c9fdd

SHA512
00907f085331dcc69c16ccd4dd354d332ea78409df6fac3b191045892c0a4c70213558902ef0969bcb2ecdd1fc96d498110c724fa35d747c5b684bee5ba6e2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68f25e0a13baa959090ddae2d4c9eed4

SHA1
b971b1e7287491bd3daa332e1e9734caf0246562

SHA256
fe3ac5e72ebce25bf05eabe828031e3cda10e8ebaabaf648afdba18bd5426b80

SHA512
b65ca27b34cc436506c3fd8e2ab1e10c82bdade01ceecbc50b18cf8f3c5e7c31f057937e1e5024eac175e75734e01e1d2237d814cdb8bc76486884e674093693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
298db13c73bd5227f680330135c82777

SHA1
256698798cbaecfceb6857bf169431196468aa24

SHA256
dd7f5a330efe5afe4a174b75f58e7c9ce27889c68275bcb9623c99504653ef1f

SHA512
51c94ebe3e134233deec09ee18eb35c0654fb6d5281a3031efe47298e6bd18b07442dd00276bd16b7c60319adbf8bb0ca41cf2153ef77c1ffd484077603dc431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02f2637dbcee063b2a2d0d1ca93d9076

SHA1
e88ccd31e085f9e5d2fb7fb86ef7967d8677be10

SHA256
48835f35851dedfe40c283c4a1582caa5f5715ce64a6df78dad85d80acbae3c8

SHA512
86ee2439534dca2f908b967356238d6f0b550bafd16c63aa96a8a7fa366a5c5dd3acf5c9da5e4c301d9f4e4b1edaf31a6a86437bf18f3f0f36ec0481a12578ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
96ff864ebfcd22ea6c8c5805b52f8b44

SHA1
e090a4c4ef4c4ed07f67232ae74cf7693cabeb42

SHA256
dc4e3e4c7b78972cdbdf57cb8a21f782b6026322750977e770fbf26a8ed41ffa

SHA512
89ec9528bc33df7e668f3e3247fc4abae7d914118d54fe3c1be63b2b74b9a3266ab909d72b9ecf2e2cc3a470e3d4d2c4f2928322e84fcd3605434fd041810a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e33c.TMP

Filesize
537B

MD5
f7aa8d4860ba39722113c4dc6984c6f9

SHA1
e753439fba0443986802be534a9a1b6651fef740

SHA256
e3e12ba06396d6adbab90d59ed6b820c588193575f59e63ddc49e0874e1c8149

SHA512
c5ebf848928f84437920962203e33c052113ae3da4356c9d05fda96ff4a766f8d2aee35f23fffb5b9d1df7fb130f86683cad1561b9b4d1ecccc8f653a45f5b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dc80831ad5012c56079c898b71ede34

SHA1
3e002f05af3b374e8d918605ef1a7fd59b688c99

SHA256
3707163a13f902473ff2880d23625fa9cd1a7ee01bd5f16d31060be6d6ac5b5b

SHA512
c9098dc793ac6616b062288b0fa76cb8f302004eda9888e5d37ef723eb2a3ea38666104a9bf9a91d97a61478a1c085e0c2112329c8037dbfc1208b12dbbe9fc9

Download Submit