03ca302c0381e00ecadbe5fbb02df64dba1e7dc111750c9b217f4a4d66be88d2

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a59f85c5291f155fc632836acd20331_JaffaCakes118.html
Size

189KB
MD5

4a59f85c5291f155fc632836acd20331
SHA1

b94ddb932cdf630d5600b7739b98a5b710551d40
SHA256

03ca302c0381e00ecadbe5fbb02df64dba1e7dc111750c9b217f4a4d66be88d2
SHA512

c99bac95c9432d9ae67e36fb34cc0c2bf32ab993a2e8c3d0bb184fe445d1f0ed3be3ef864d6e35fe75bfc1dd34fe4d2ec4e7c5bb2bf25d53fb2caa543b86a926
SSDEEP

3072:nyBh6oQIi5F+/yGqRGXDllc9cDF5vFeoxVzEuS99/Z6BIeJTpTRT1G+mMhp0Jdrw:nzoQIi5F+/yGqRGXDllc9mF5tegzlR

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
76	sites.google.com
77	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
4376	msedge.exe
4376	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4988	4376	msedge.exe	83
PID 4376 wrote to memory of 4988	4376	msedge.exe	83
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 3160	4376	msedge.exe	84
PID 4376 wrote to memory of 1924	4376	msedge.exe	85
PID 4376 wrote to memory of 1924	4376	msedge.exe	85
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86
PID 4376 wrote to memory of 4224	4376	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4a59f85c5291f155fc632836acd20331_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c4718
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8268617673391656582,7179467687938290164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
77f8a9e835fbf08628fd2de113ac8b30

SHA1
8d0de0017aac9d5580558139330074c8f4b4616d

SHA256
54e587de5e9d7e80e0930a6befe4b2edded947db13762a02d549423a9c06d278

SHA512
cde7dc58b5b0b89c05b179ea93256b37ea1475a360ca7b904d27938294c9ce385f62343fafa03ee4a77cd9c948b46bfb942b9b2f89f387301b9c4b54a6752148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a8eb54f20aae351fdf96963fad729c5b

SHA1
fdf12542bb234934daf1ed83218229e2e82e1f10

SHA256
1f0e54a8ff7b9c2ac503d86ba20af51346b0e83f8fb6ce607fb4402c40994887

SHA512
707bac98b8a8a892f7a522e97b4307b4f0459f923d57397bb6911c09b9f0e79e72cb1e1191dd2f794fbcca715b876a97f9bfcc2bdea23cf4028d572a73cb9b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
82c6c537af2516fdc34bb03963ddb7cd

SHA1
3a8455709ae35f5c47b74ed13fb13ffd5a5f257a

SHA256
5c6bcbf3c774e0957727e66cb573c25c2b9ee70412ff4c40d4492d373ef900f4

SHA512
022b4af7c807d4ced8608bf12052bb3744fd8990e899b4aa0aaab042777586095184981d7fc8fe8a26ac984da2035fe629835564cde631fed524dd7d8ff0036a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
881d51db756ea062651eabb749e8ab27

SHA1
1739b9254b4ed925584b08213d7786c07eaf743e

SHA256
15d02dd5ec0407bccbdd34f82c39600ff5b25bd46d6b89c42aaf2cb7c7009407

SHA512
715d903fb1a284b08a05090b4a3ff64cfdbed8bd01fe74f0a219b5b0f791dd73cfa9aa56d5ad1432367c0807dde3feca8e7c7b98d96bc18fa5aa8664ba3cf684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
49a8f4640856e9f10b602173cf010220

SHA1
4a96fba55953850cf45706cef124036386987b4c

SHA256
d240c194493e2cc47a0ceaf69069d68aef68f1574994ebc582047f8fb420444b

SHA512
b72f3394e2c450806b2638868dd7bfbfb73d79d15271523007626f05a4e83f5b12ca8eed1a3fda3ff84ed3804311ac6b4c18b05eec30b68351cc9ab39f39f767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa4941f378a6aeee6429332da40ff06d

SHA1
f7e73a979da67407afffa73883550c3af2e01808

SHA256
39cbb5bd50fb9a15974b772187f21e6cf5ec25dbd1695dfd9248d5661554da67

SHA512
556c94aedec0b7e2bdcaa9ec515e3aa8376a88297b57371313098773a34e2a486ddf83d4859d8f221f4285d7efdb6bc16584c76f2319cb524fa4432bdae00f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c0a8560ee8e1a03c253709c3c58615ec

SHA1
763c0886f3509806ca50a105123a8d8420e98607

SHA256
23fcd020b93d0aa3fcf581fcf49280eeade270a6e299a5b1973260557b1c7eef

SHA512
aba3290d55a5c2368bdd854503e7ee695a7766d3b3f35744c597d7a476342a516ff42bd90a821c4673137006c554cc53bf4126fdb9337a97fafab90153e24c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
51aa3cbdb614097ba810935703a1349c

SHA1
8dfdadf4ad6adeed6855b1ca9ded0f9f24d89dd1

SHA256
d57eb9cf4cdf39b6858a28e4c180bfd317a51c1618becd61fcaf30a4e8bb5a01

SHA512
d85c7226350c4cb0630e046bd7b5b656ca5930d6e596f79d7cca4824c9e821bd5c5d30ffc1630979d0b7e71ff8b8d92310fc7205c1bfa5f33b5b809c7d8f97dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587e82.TMP

Filesize
370B

MD5
c1b8f08a8f071e101c3136f6f09dd278

SHA1
dabb6951c92adb65499fef92f6330e11aa1994c2

SHA256
a7dbba9b6e9b3cf8fa08a933ce91860a97f4176f861365b4549c50f98fde6cee

SHA512
c53beab7d5bffe1afbde02c7c45f9229ba9f8aec1988393b325949c53af59766d3e51e50a4a245883841096603a06169eec67eb4f57fb77a0d9bddbd971665e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc86e583d2b23c56626324d2a6c2f9ac

SHA1
45cd4f3f1c39a12beb41a7099cbaf443b72daafa

SHA256
11852e27ca56e3cb01f396ffeeb4ff8f8244ae92ce96b62be117dcbc6631b455

SHA512
017a013b87fcba5c32c39224056354c6dac6a46cfaa4364af213670dc507ca16923e574118e200941f18d864c1d5d03ea8a0e3d4e39a63c21b68492b905c43b4

Download Submit