d87b8be91193b728e3816b9d83f41864436757943ce9a23373e4d39e2511765a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7921d1aba5df5a6bedf65814823cefb3_JaffaCakes118.html
Size

251KB
MD5

7921d1aba5df5a6bedf65814823cefb3
SHA1

b841a0081011069d7aa97fe86a42f4424ec68def
SHA256

d87b8be91193b728e3816b9d83f41864436757943ce9a23373e4d39e2511765a
SHA512

b4040e0fbe1be960f8d8b66568092524b489f67bd6214318030817bf0457c14c1a494757c8051151491cc9cb08577e95b1e79c1a82768fe93da17b6fcfa5fd74
SSDEEP

3072:pqfyfkMY+BES09JXAnyrZalI+YJg6S0MIyfkMY+BES09JXAnyrZalI+YW:p3sMYod+X3oI+YfS08sMYod+X3oI+YW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
544	msedge.exe
544	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2488	544	msedge.exe	83
PID 544 wrote to memory of 2488	544	msedge.exe	83
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 2784	544	msedge.exe	84
PID 544 wrote to memory of 1248	544	msedge.exe	85
PID 544 wrote to memory of 1248	544	msedge.exe	85
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86
PID 544 wrote to memory of 2448	544	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7921d1aba5df5a6bedf65814823cefb3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e7f46f8,0x7ffa1e7f4708,0x7ffa1e7f4718
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9921314108092333680,4436640495924823132,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
b4806182a62a3004723aed39e209cb22

SHA1
bbef89ec24a6271eaf8c4db339ad6b205d45e2de

SHA256
3b1477d2d8aed0c8cd8d4dc4d08dd69fc410faa9e67e2e1c6e4f417c4a39f26f

SHA512
aa6ed8de5bedaac0715e111458c1891a2c504afcc059002666ff1e4b8d4055148e086a64e4adf56417141eb0750d6cc123b56dde5bad2dfc75174079a7c5f409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ade4cd6fffe85deef57381ff71d5a9c1

SHA1
502502bdcc2e731f8ca6feb61ffb4ff368af983c

SHA256
963f282eb17bf845b132cac02fa7f55d7c115cf56f7c2c6036f29910e92d5384

SHA512
5a9e8e47734ddcacdc8406a0e63300c732138a0ee54d2a69f1febe997c956f0bde80d736160306a714d2ef2405be58c86fdae76681968be0f87ca40f9699acf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
197a4aa39764d430e56f46cf1604b149

SHA1
85b10c802ae5ecf32aa7d9b748d04e4a489197ff

SHA256
d321553d2dbe91112868a1ddb38137005863a15b19d1360392b330ccc384fd67

SHA512
a25b1145afa0857213629625fa49952a7525f8fdd07b46c30bb3eed4f971d8ea12c659ff1f125d3340ea8b03320a0a544d0d9c05f5ae3e9843f9479dd3aa2018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0c1746904c8d0fa88014ee42ad5eeeb8

SHA1
3ec22d68bd878397ed0365cc7861651438aeda4e

SHA256
d83e74b2b584f7f5878bfeed2ad63244be7ae3015b6f98e5b959badea0484ed4

SHA512
8d8d530aebd5e63ac5ab3d3ae22acb7c6e5b9d0a2c2ac84925e00c2c21e045ff57865a7ab1aba5bf5549cfed6c13ef1aba9af62c0e42737e0766b86f949544bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6665530fa2ba1aa585e87cfdaa2bc64

SHA1
023d4ec00b63bf2ae7ea4624dd968000a54c96c8

SHA256
9bf03f45581953352b933516384cf9f236b427d9aaf92018596e01c064846055

SHA512
2119468758bdccde1afbbc72394ae22c2a1aaa5542232b742d7255d718e2a06f85b27c5023cb02a404155354b9d7a40e9b1907b8b664cec889bb110620c898e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5361d5b8fd7fd7cab7e10a74131ef3a8

SHA1
53b4751839d6251799e46403cab60eb7ffcfdc61

SHA256
057fdf9e2b76aecaf55c8a0c5e7ec28306d41b66df25094ddd58d3e15ceff027

SHA512
4cbb93891cf73d65c060351c5c799842f6f501eba559d7a648936d8f54eb69e6a553153958b926cb5f45ad73fb8f4b3c7fcaeca3bf1f10d01f3ad1d2361de87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
868dbd464837642d67c4ba4a5266f4c7

SHA1
0e449f1b78703030f575f2538f2365e88eb53b14

SHA256
f3d9778219cf0d58c5fcb9f195d8aaab33ef074dd358f08dbd057ed47acb9384

SHA512
a5573a58a08a1a876b618d1e844b0f5fed9d28a8c1e0a0f2922a898699944806f091e2eec68b1cd258a0b0907d492e37090ab5d3da7918c093b118afb12e4afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47f817c1c8473fa30434e28d109338f5

SHA1
ef31da6ea9466e5a992e4f49d7e66c5f4b51bf6b

SHA256
e27a54195a8a0d56984d01e9c2903308421292b522c8bc00f266f0853fa1ac1a

SHA512
cdafea4264a1ce3ef4d4fc57e8b39d4c249c432d765a7c18f0cd1c3711ad81c1169ceb39cb57943d692ce5841d1cde62a82623b76c818064968c0f5b1a714bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
b687f006bec774376e44646631b4bccb

SHA1
a06ed46b64c50c110b2849088497a1bb525f1af9

SHA256
8378e580acf2343db12d2166d5cd5028ff602a7a1706f9f5464790edb12fec73

SHA512
dfab8906aebec092f0a687d689f29f1c41973316d8c100c9beefd0dea10af925b9b8ec32f252dbe89529b8fee3d660cf2f9994a7d30d400909d3c7dae366548c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
d28334df38489f638ff63c265b4eda78

SHA1
752f08a17edb87581100a08d455f5f647c2b1db2

SHA256
8e447e5cd8c299c44363dcb287b7b13f81c27df1c40f7cc1c63c3f765958d91f

SHA512
49aa324fd7cb2cf14fca2067325538be78906809ce13d3629cba33f9f4f11d3d528d2a021946d0cf753397faccb0fbed2f63980e8c1e291d59a337cc3f0c8b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585a9e.TMP

Filesize
204B

MD5
4565323bd86fb38104864648eb29a29f

SHA1
bc43afbf8d6abac135cd425ff35668a0f4ba019b

SHA256
18385df338347addce42a565efb1f2c0b35d93c151a63be7c509895dae7c45a6

SHA512
cbf46e92dcaa46b805e1fcc06f1f1ae124514a8ea70b65114085159fa81d46d3c1558e8c31117a44f62e88c740875b2acb5d5967ea0be9ecafd3d0e715b54537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c6d38a882a0b41aa0f32d2d4d1b84183

SHA1
2060348f0d9f30ee6db421b30c075956b547dd29

SHA256
62abcbebbf25acaef0c51be163e2db23b6e0fb4a50b64a6a0e357dbe64db5644

SHA512
6bd07704064481e595e5681170eafe67215ee7d6820641315f38445d5f1b10c94d5ccd9357bcf2fe02d417a554a3c06089cb6bddad9446941a99a5e29434a9be

Download Submit