8e9f33da480c89248ae6296c8701abf46497da9c72a99089e678a48162df409c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc217cee326667d2caeb8a113eb4b61_JaffaCakes118.html
Size

120KB
MD5

6bc217cee326667d2caeb8a113eb4b61
SHA1

c46096eec9878c9ae7b2298dc6924eea48c8d5b9
SHA256

8e9f33da480c89248ae6296c8701abf46497da9c72a99089e678a48162df409c
SHA512

4e7601ba69fd673fafd7f870605ca57006dcb05e3c2a6b41438d139518535d0a5d9cfc5f441ccdcbb36963412045e79d1d937d91ebc079a77f799b71ae3e63ec
SSDEEP

3072:jEQzqEVyp8UPGJvpfT3l8DXNewWszgb5SNtmo:jEQzqEVyp8UhDWE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
228	msedge.exe
228	msedge.exe
428	identity_helper.exe
428	identity_helper.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4020	228	msedge.exe	83
PID 228 wrote to memory of 4020	228	msedge.exe	83
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 3212	228	msedge.exe	84
PID 228 wrote to memory of 4144	228	msedge.exe	85
PID 228 wrote to memory of 4144	228	msedge.exe	85
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86
PID 228 wrote to memory of 3172	228	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6bc217cee326667d2caeb8a113eb4b61_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97dc546f8,0x7ff97dc54708,0x7ff97dc54718
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16327802430603890561,7045218508043728259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6d1333e52e0dc647483dc789d1b6a1cf

SHA1
feda87392ef51fcdec1af52b3e01bee1367c065c

SHA256
1c6cb6e9d67767958056bc8765e7144079005c8786f54486d6dc30a4ed4e3c81

SHA512
210a0ee3ec832c6240db5ee249893f0610994a77867aee27cf4d6abec90f4cad467a4a68fb65c482a9202f9b6d3a47de8ebd8d0f86fd65692b61a5bd544e48b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4f3204ad52fbf40ed1726ce6d61c9e9e

SHA1
5885c589047e611ad78be0ccf953356863b31a37

SHA256
0aab98bd8b63248df43738e7bdb7a1c45954734b47fe7b849d6bb06b9088ded6

SHA512
6205a6d19c13c5aaf725169050c94ef55bd352ef11fd7866d555d0f32cdb22ffd0540d41a74074404c739bb991b02b6332941c9e816e864efa4ecb156974a779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46e748e93a6e1724c654a126a53f5b86

SHA1
3d07d5053efd9d84412b911a61a51ca2471a1ec0

SHA256
da6b217c16aa0f5d36a1e184cc518222278e847a6bb2043fc60d390381a85bd8

SHA512
12b588035c164d83ecec29e97ce21431f777e7355fa1b326b8d6b395575c32bce5897ba9ad87f53718af7cea69b70b7260ae808441e1c92a17c345c5bd5f40b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e827bc1a315621c3a18d7bbf0908eed4

SHA1
00c7fcdb249f32a50c3cedc1eaf931dae7789730

SHA256
5eedf6c511e822841b57b2ff643515fcdadb122ce428b183bd898e31232abcc8

SHA512
4eb036c64bc107bcc1cfc78f2fbf48364f9b6bd3e2ca69efede4a011ad5f72606ddd6df69a29531fa67785d2d63f3cd2a7b34f87ba09391c1fec9f9c288fa929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcd9c123c7212297bd1351b9f3266434

SHA1
1aa9c8ba870e0f5eb5752b2cd8fdda825f12c3a9

SHA256
c162618111286018a264d5565b3855887c268bebf2fdd38df8f40bad6a40eccc

SHA512
b37fd47e3f9f458eaaf9a056149f84150b7566f55379f0bc912bc4ef73774c3f3ab5e96c27665d4d2ed21a164abcfa332f314b9b6116bf04788b043a5bfeeb64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
60d692cc32ba976762c99bb437d4ace5

SHA1
426ff8c56fa966664b145b228cf44d12789612d0

SHA256
17aa9f1a6cafd03619ddb7f5e6ec35f981ffb702c5ac7ce45d299ff1265d0ea0

SHA512
2ec3850455e99af1df6307cacd3a3eee896152209fd6593f8d6be3106047e64d5b8fc7bdeb974b2b91f1661fa86bafe4f24dbe4a9640f791908b4dc0eeb44d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
fdc4c4694fca700b7da3d839aa98cd5f

SHA1
09659c64d4b7c3cc39b29b414a6744cfde42c816

SHA256
4fc068d8c36fef942925aadf813877891e1ee3cba9234fe9309a7ab7668dddcc

SHA512
17996e31bf3e8cdef62b90be57241c3ac09d0f0eaae14f4655599cd31545966b8fb84c8d696d009f76ad6e150da91e37d6ea67de9c98480efeead42971d1f2c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588be0.TMP

Filesize
371B

MD5
65129095b411663c3a3784308c098cd5

SHA1
a285719efa5579cb3f873379a2b1795ee39cc478

SHA256
2a158e927b096a401242f1b1481ea67b0f526c211863904fc463e204b847bfa1

SHA512
b94fe8e40ee4f2c6fd51581dfb02893208b6acbf37aa1ad45eaa68bf1a18f524cbaa9bba96b2ddca394914cc4a6b9076677203d6815430168538592ab37270d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd0a620831d247d3a199976da9071ede

SHA1
7d3e430006bf4fee7e9ad1d58200a013a841293a

SHA256
64b3db166115612d277e28e5f1c1385578aa2ba571fdc9e184360846f4af075a

SHA512
e7c13c36c8d95da49dca39b8cf750396309ab590f0a20f7c11c1301cf4eb5e872df08d1d2d4df429a58a23017831c5a4c89bbd2ee6b43680469f311a378cb7fd

Download Submit