6bca2edbfc3dba6aaf35fa0ce24301861d3954222c7bdb852d469b636980ff46

Analysis

max time kernel
144s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34287b1b7bdf4e585117afaff9ac705b_JaffaCakes118.html
Size

33KB
MD5

34287b1b7bdf4e585117afaff9ac705b
SHA1

cb6432f506adaf1bc6397b885b9b4380a04d071e
SHA256

6bca2edbfc3dba6aaf35fa0ce24301861d3954222c7bdb852d469b636980ff46
SHA512

ba3f8b67057696833f4e7d85044f22182cf793e1ccf002a3c56d0ca21c3d7decdd36ad84ad38e0c76d07fdae5363d1ec79b17b352e72788b262b7a3beec4574c
SSDEEP

768:m/YL0IG4ORfPYfW7+0TfrRarn4Njxnlg2L:m/YLbW7+qrRarnOnbL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1372	msedge.exe
1372	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2116	1372	msedge.exe	82
PID 1372 wrote to memory of 2116	1372	msedge.exe	82
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 2376	1372	msedge.exe	83
PID 1372 wrote to memory of 1956	1372	msedge.exe	84
PID 1372 wrote to memory of 1956	1372	msedge.exe	84
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85
PID 1372 wrote to memory of 728	1372	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\34287b1b7bdf4e585117afaff9ac705b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd944946f8,0x7ffd94494708,0x7ffd94494718
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1384 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5067736074528001538,7890186725830772271,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6aa437ed-187a-4eea-9413-4a5c21f5ed64.tmp

Filesize
5KB

MD5
68315a3f21a270de4dea179f3a0ffc71

SHA1
5ee05364acf158d9a12f5a1e2685a87daba370d1

SHA256
a59ee5707072f6fca8449b22c736f7ce7e4f61c6b56bde219debb3c34880d28d

SHA512
18bf3bb0e63944219459ecdd632d9eeac92b1010225792ed7a0c03af2e518fa2651b911ae2467126ae2fb3ec13186d6c3be00de4abc08be8792e93acdced726b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b62615645127639b78c0bdd566de2e9c

SHA1
9a98847e3641f5d52586d066449fb31442b91380

SHA256
6d3ce145980f421c85b54b27cd759e9a069f302459cb37afd42ac2548e03e46c

SHA512
90826f19a808260b66c636b8d0601ce279da2cd583cd75a205994e54219c7a84c4a55b9e8c364220ae9a10ef8bbe69babb13b244d80b38c8147278351a3e121a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
cf73efd0c37026788bfada5e450dc086

SHA1
2c0cf94aabb4e6571b6ae949477fe57b2c99189f

SHA256
797c2ec90b0da217e85cb80d06f390a5ae3750249cc45983dbadc6b09fb918d7

SHA512
c0b666ec1a19eb809155ec05d0b6e9a1d53ef4647c9ed00bb59c7d98c85b29e5ddd4c20c9aabd8aab63a80f337d8d293eb323055a47a2121fd3a38978a6f5884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e3f128c912cfb2817cfbede7a496d54b

SHA1
e3e30bc99b92a9ab0812123955a499032935dc5d

SHA256
fd90974097f1bfd73b6a124f13180eb088a8e9c9097f21ce80705bece37fa8aa

SHA512
3b7c65172fda38585ac3980c480363278e6ef7368677089190b13816a360cc22e85ff25c02574286f9c554bf7084b4cac5aaca6203bb3f042888f7376db84a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
767cd3c3ff30c10e7af107e9503f902a

SHA1
b33ed0869dd90196c46847a15bc3e54e4988b11e

SHA256
1147a675be85705a1b4a66bcef683da57f496f9420740fb5a5e7028acae3d0ed

SHA512
05bfacb794b9e9ce197731d088afc64a1eaf70614a3a30eef75b0749f4090cd3f7e1b0d4bae485228089c981e978f9152addd1693222aecf5f3038121ccbc6d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94d8d499f02108e6cf5470164bac2a1d

SHA1
6cae06050c707e2c1524e78c8adf5c00823ad7fd

SHA256
c1390892d9942398e936e06ab5723431499815bcd3df6211d00579eb466b5f8c

SHA512
6df818208d151d8f89d53e4ede18cafda27c39bebc923c8c3e9fc36b2d53b29365c8819d3545ab36a40a0c0896935cfbe801db200700cf7c450c870920669972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
159905ffbfedc407882d30773c7fc825

SHA1
4b742131da71c43534ed5e488ce8211c5e4aace9

SHA256
c7218160e3a9e78060918fc3e1a04583fa76e092fb9ba45ca671c597b5ad57e4

SHA512
274cede5d82fbb2139bbba8584a5f8f4376184ca203293e9f72f8b69bf8cc2ca96902331bc993b41056928483d38bf795112746ec20525f6fcf89e31f4021d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
8eb220d8f9c200155562d72ceb22b2c0

SHA1
cb560250fe376916b269601c8e417302cfa8d951

SHA256
6ca93d23e53b0bbbeebe3bb6abe78075d9cf49a65a5c8f4a7c9ae01064d5078b

SHA512
da1fab1dc5b67ec65de27e9f4b6260b7fb3ead2cf64e906a92369b6576df37545a1a43c429230a3e5d6d9ebffb828d63d473d07243b47142635b3ec373ad9bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff5f.TMP

Filesize
203B

MD5
e4d0c4d9e6355147cad553962aa74ef1

SHA1
3951a35d1b6ed1bf95eb516f1017fec72232f3e6

SHA256
2f8258702476b10ff04cb45111ea851baec527877aa05570c0ebbeb59aa38dcc

SHA512
0d9466675fec66508c6d3bc226652b4ba84a3da493ca7cae7bbce7eb7ba4604729394cb72be774c2df64ce9b735275b676bd35f199ea854f3c39b627ca6e921f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d10ffa01318e5eece877da7b9c10eeb

SHA1
ebac755b3e41d9081021f0cbf9b70ab11a4ee2e6

SHA256
a19b415b7f7c9f583a14814de8c86421e01db78e0ffa3049cf569def9daa96cc

SHA512
42ff58cb37760c7c679bcee24551558d5dbf92f0eec7478f18f24499a6935829edf70c6d7af423314e3a28fce86e81796f5e8752ec2647a2a33f0670752604c6

Download Submit