6acb3e597192a64e12c555f54264cc7560bed25299d342b9ca61fb72d71ce6f9

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

610adaa17bf0edf8f828eb1b830fd0ac_JaffaCakes118.html
Size

173KB
MD5

610adaa17bf0edf8f828eb1b830fd0ac
SHA1

3cfe1fd6c7127acad61fff3f88e7be68ac73eb45
SHA256

6acb3e597192a64e12c555f54264cc7560bed25299d342b9ca61fb72d71ce6f9
SHA512

72254b444212a5a641ea50fde168adfc9b207f166960cb61c4c8929497fe1c5898850eb84b27313abcf3a13f3781ed2763c3d096692e35184df91db970d7fc5d
SSDEEP

3072:sULYur21jEmOzt8aNnHQgT+ZbeGDxt1oEuf4f1U6+P9nUAeWWYHTAMOg1:sULYur2kt8aNnHQgk7LUp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
324	msedge.exe
324	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 4664	324	msedge.exe	83
PID 324 wrote to memory of 4664	324	msedge.exe	83
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 1268	324	msedge.exe	84
PID 324 wrote to memory of 808	324	msedge.exe	85
PID 324 wrote to memory of 808	324	msedge.exe	85
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86
PID 324 wrote to memory of 1856	324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\610adaa17bf0edf8f828eb1b830fd0ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d4718
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1937598732572299538,16580909929032468184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
a52016c5f01deced781b78a46bbc9253

SHA1
1cb04fc114230a1fa5bd1b6249770b76bd4dba4d

SHA256
f9ae4d8331a6151859594b6741c0d954f5fe7e36d5ec4cb8be967367eab64b98

SHA512
c7a1705feeda2f1c3c79dfce89f8d3823c16f3998464f5280597876a18f4b1067570cd633ae83457d3f8402b6a7a017b2df24dc55677ecac4378ccbd27dc4a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
65228db59d074b631a4260ba8904a151

SHA1
5f3703003f06cf665d7d6410ca9ba2d1f3b3033c

SHA256
8c788b2db97551a9111498be783ec2e6106277ecbb563f74dc129d321cf87735

SHA512
0e3c6267d800b8947504e76a3506447211b9427195c1b7053382c0e6707b861c3093bbda50013e79d18ffef8c938630acf4f059a28d468d6791136e065f3bbba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
5dab18963fb2ec43457344323d1c7897

SHA1
82f59ed2c9b6d5935d650e4819bdb70e3e69d9da

SHA256
5bc0aece83e760b1676e1eaef7eda707d962c1fe39ff4ec53be2a9e771c8f987

SHA512
34faa967006a498e3a3e7a6310c747ca4a782b76cd18586c173d4224ec1ca1d9e8ab680a8544eb1fa26f9086bc2f39356bfac197bd1c3d41e6a1547462877157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
edfd5596484ce0627a121aaa01d44bba

SHA1
874d9960a576b4a6f6a679bf588c1804d0ca08e2

SHA256
4650a009b65638bcd8166bd6fb1f80504c3eec276ffd76d0674d296dfb510bda

SHA512
b8c47ef8b7794881e0780d30fe9734bdce917b3662c351598253c773fbfdd3757dc715a14afc25086405940af9f4380b9163dffd37c1b7d45b5c6d9c91670303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b329266f0ebe6c591bbd4477c7665672

SHA1
21e52a29fc2f7424f959dbc7b1c0415b8808421e

SHA256
0e8ab5094d8a13054a2124746e528152b406562e19ac5f1d7cc5fe4c8787e88b

SHA512
cc7351f881f0c7252c2fe4e8ef03d7724852024e8b2144923eecf4f2bc086fd76133e1f12ee59f3cf82d7a587ae46b8535420e6043957fc45486c5b1bf4997dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccbf69f5c54b38b1005eb9642d465924

SHA1
5b9640a38adfc65f4dd016766259df0e7e36a57a

SHA256
624d16f11bffd22ab1fde852a34b2c86449e4bb7e83f7df84908f1330e84bc6b

SHA512
8bae933c0cddf465eeb30bbb21714717024b823c91b8da37ff7837e787050b3f4fb9c0984a0740ef0ebb324aca846c488aa738fa6f722929a83cfc4c5eb8bfe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ce0d5daf174e1fa1851af3106096ae08

SHA1
397c398e4d4384450c4f2e87f5c26f1758f944bc

SHA256
a231e9c5bee767e87348ce4751117af3cdba185c169ac9582cfeb91f3e3383f7

SHA512
90d7aa0b60d6bae1c11e7290a574da5d13fc6587e9438aa4eaa290e10999c0137bee65f713464dfcc3ac025681c8c6746622f4eb94bf07e9bec4968890b09697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a75e340817fd102e3e1c7a2c80057a5e

SHA1
2154777e5fae792ba55a5cd4c8b3669921f2846f

SHA256
b8c7f37c4c609b2f23310c2615aae2da98aa41e3723222fc9c3f70e4370f177c

SHA512
4a77df3fd5d09464e068bc54fbf8fc20bcef399d60494f35155d1ee75bfcf3f26574f5070e34c51b4543469ab1d75756d12bcfd69bedc4aa3dedd3f00f6fd7c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
77af8cfa13999011c5ee8579a53a4a99

SHA1
d1e5a1c237680c32fd4f7d26898a335c88eb600d

SHA256
512832a068b9d5f9da70902e97e62c7542bdded109b60bf0257469d5c77b8c91

SHA512
82f9919c18b9f53f94db7837805c050e4f8ed9370cab94ac7aff13d9ac71b8238d6136d727ff43276b7779c58fcdaf9ed3410d550e8b23032047cee76c323bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ded7.TMP

Filesize
873B

MD5
89e61bf5cc5a32717aabdd41cb8a988f

SHA1
5966f6df525255278dba34e27c83105ca17b3e57

SHA256
f250e6a2f89976f23a0479ea0019d53001990dbdebf77fa5c493f1b2c9405e47

SHA512
663c1a9ba877f579b058f6cf062caacad452b44800991857a706992f1d6fa6b527c934b44b74fb705e101734b6e0a5ae6d721c62900fb62d99b34a968cfdbc7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8e898ee0d28285ba91f134531c7a3e8

SHA1
cff2855e89ab4fe6a4f525083d30b09f28a84ef4

SHA256
aad0af14a50cf60848f319935f31ce077664c9e57dbb89f8709a27d1b8e4b799

SHA512
230603d72ec7dd444ae84406ef47ac520d115fa768a26529f3a0058ce08560e38ab71774b07214ac6f4bacb6ce3446f93e60478e960421dc8b97a41b03685efb

Download Submit