bb2b4e70919561bfaff614a5bbf72d9f576a54564d1aba72410c414c48772aee

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48e1fd71194d68d1c307ed201a49bdf7_JaffaCakes118.html
Size

216KB
MD5

48e1fd71194d68d1c307ed201a49bdf7
SHA1

992b309b40e5c7cb6a81924ee5d8572ddcd8ee65
SHA256

bb2b4e70919561bfaff614a5bbf72d9f576a54564d1aba72410c414c48772aee
SHA512

666b6f8e9c41dc169dde66dfce325a8ebddae0be2e265b7b9f4cd3c1d67eb5d6bb7922220b20618551f40c706af72d1086a940e312ce8e74d0d4a53e88dfde12
SSDEEP

3072:jzQ3eAUYdNq/kf0zeKC5ZPrVUYd7YzYjYzYINg92o1JXmhaR:EjKC5ZPrVUYtYzYjYzYp9nR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
804	msedge.exe
804	msedge.exe
3468	identity_helper.exe
3468	identity_helper.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1376	804	msedge.exe	83
PID 804 wrote to memory of 1376	804	msedge.exe	83
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 3132	804	msedge.exe	84
PID 804 wrote to memory of 4064	804	msedge.exe	85
PID 804 wrote to memory of 4064	804	msedge.exe	85
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86
PID 804 wrote to memory of 4136	804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\48e1fd71194d68d1c307ed201a49bdf7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdcb646f8,0x7ffbdcb64708,0x7ffbdcb64718
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2840186412294939098,8482411547200732718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2881b58536083f5ad06bcd89fd128e72

SHA1
ce1e5b46a57e1a26faefb9e50c13a7b3f17d46b7

SHA256
56ce169d32edee836dd2b9c2c7134fec3f5b4d644dbc9a18c29182956ea7351f

SHA512
55bca2479cf59d8eaecbac24c755e8f613ea8bcdbe3d63de4df48505513e5bb7c61ea3d0d08fed12cc8a1e08b553c19e57882037804ee335a167d0199146c7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
8dc1253cb7604f9f3e05dc11c10c927f

SHA1
551ae68fbba2b346e85f656521606d9dceca8ade

SHA256
d7bed6401fbb649e1a5690a5e9a81300d0c667f0bccfc0fa81248c7f593e054c

SHA512
d56b8081935b6ea6860c4e12b86e8db4d1e05a143b1ed73262974fdf8a34530d56f06f2146e91e1fbc19456d4a69079f8bc2e8d6ad3d9e242d68033989b3223d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ed54f563da64f9e600eea013c48674b9

SHA1
96f52735ebffdf3d8d9bc793dacbc4a9f885f22c

SHA256
151ffb07a731f009a2d676ab2a853c3a2d6e938850a562636ca5585fb58087f6

SHA512
929f75c01ef2ae326b0864aae30c18f43d7baf9129eb684f305f98e6fece8f3ccea42ed4b24b05d8992a81ac3b44d971f89360a0c603495159640d30e60ae92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
b04ad2d079a667bc296cad9325b91f3c

SHA1
664227a9702910c2a62992cc51d3a81462bd08b0

SHA256
1f735426da2f7dbbd4bd9203ca592e5abab4739924833c7d0fbd58909e55b283

SHA512
f7cec8f490f2b0713d79c324eeba2243ef0a53e91d124c34ad8ba93034398937d72130815f1e45272b1f1b820757c528098422e8a76a10fccb4f9578c28ca4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d86deea52d32ef2e82382ee16d98546

SHA1
595430ac28b49af6aeaee460b52d677f0d378d41

SHA256
173550187337608435330f4a534ae0c00b96748ae63f9864223c005b89db8a1c

SHA512
21c98728ca1a528d98439d07f429a3db55a551b44c312b02db4b8ff1e4df0eaf50075916b9fe0ed55002f8dd329ec46583293d00491431747698ecaf410c9659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c258de824dc9446a34e1cd59f417d019

SHA1
1035009d859796267c0c6a86f16fefeef4f9c89b

SHA256
60c8fd23df5f0d0fbc89c480b62832c6c7807ee8c27c3d6c8611dfd6701c61ff

SHA512
f8d4ccf6b8c3268b83f2e5fe130269aa602bb9ca459c273d60b5fb94496c700abcf2ed2fa7444d1bd41d8039089d7315e1a9d9f375914e8ce2226724d5732488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41dfe374307d3dc7284e45579ef53cbc

SHA1
3460582cd597ff2f921329eac82eaa761e678903

SHA256
247d7b9c27b801b5632bf9df2466e93669858d260de44dacc112fc5643a40b8c

SHA512
6c9836ed4abc14b7f0529eb4a611ccec1b2f289368f214b63667a6a654af72ea39dc8bb876da36a5c3157345cc3303bccd452742ca73b434c3e367870a3adf31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1c18812f7532cc62c173d65ccb43f86e

SHA1
3f79acffbff203c24b3526383eaa2bb6d0df25af

SHA256
bcded34d9fe5f5aa14e2c2e6d90b75c398c8aeab8a1541f65768af2603a56871

SHA512
06fac33616ed89c5f52a5f87363bea7416460d017c0ae4a44d3c7fd735bb424c84045a8dd68f1dd3caf8e5b0a4da5196f7e1a20d48fbcd8decb1ae8b7383de25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
669e2c3efa8a521c4421536719fcc3a4

SHA1
8c67232a7c4ced5765413ff04c2fe2c3e4932c02

SHA256
bbf6dffacb7d6a4680b18aa1969f11243a1bdae66ef006858a5b7dfc6bc2c977

SHA512
6126b9f6234dad3c6c9726e7d0da60012511c2ae4a969974df0a2ca3c8306c65d72c4939d4d4318972f2149245f2cab83e4ebb05b020f9f936b5101d8432a272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca26.TMP

Filesize
537B

MD5
c41d70fbffc1d15b750889a6fd40b38b

SHA1
6c04e39284f1ba3228c2941ecfab5e1d65890e36

SHA256
b74ef897523db91a19083b4d7eb41c632597ee6313eda1f2b0429600f971f9c0

SHA512
ca677b729431d78a12881d42e359516f8fcad2919624945990ec82b00f5c772ef4edfe908dd99f69a69f19315803fc3a6a9657dc70534a5db64b56be88a5d3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8c97247535483f5c00ba23edd665f9c3

SHA1
866690a01e372a3002dd9bbe3b99da58b486bfd5

SHA256
750ad8505abc66e3445f5aa5de635c5cfa9944d672af7d6d797e4e50334c6210

SHA512
d584494cb8250b8621309348153a6a8608fd40d8551c1e38c019a7ef101a04933123996d539151652ad7253ccf54a579ed6f7ac92fc4272e9f673a8ca99c6b8a

Download Submit