b0d2bfdf88f16788f8b6bd1b44f60d42e99eacaef6ac2d528eb05b92b5b11d12

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83b2df54a2b7ff7764f80a6c74eb742c_JaffaCakes118.html
Size

45KB
MD5

83b2df54a2b7ff7764f80a6c74eb742c
SHA1

56e9a390dc7e6351ceef19d75291c18b0eec23b7
SHA256

b0d2bfdf88f16788f8b6bd1b44f60d42e99eacaef6ac2d528eb05b92b5b11d12
SHA512

0231b4f411a50758a211696dbfd6a453a6a6c54ebd0919b1705824f76e5b5b10d85826d55dcac942cb2273981cca8b7b6e9de109b6d2d8800b8b8cb1c3761fb8
SSDEEP

768:g8vbJRFknl28Qp1SH9ZXBvZbvalvUwvWfPDA6CvMAbkbmCr4bVbNsCTb2Chy0bqP:g8vbJRFknl28Qp1SH9ZXBBbYUwvW3Df9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
2428	msedge.exe
2428	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
1964	identity_helper.exe
1964	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4984	2428	msedge.exe	81
PID 2428 wrote to memory of 4984	2428	msedge.exe	81
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 2224	2428	msedge.exe	82
PID 2428 wrote to memory of 1760	2428	msedge.exe	83
PID 2428 wrote to memory of 1760	2428	msedge.exe	83
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84
PID 2428 wrote to memory of 2636	2428	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\83b2df54a2b7ff7764f80a6c74eb742c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff561b46f8,0x7fff561b4708,0x7fff561b4718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1075613179937084720,9149726891566126948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
  2⤵
  PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
963a662229411dc68dfedeaf6220700e

SHA1
133a44961d19ed9fea818a8393b80e9dacc990ad

SHA256
b7866579d6fa8876d2f8c8cfa572330039b9ccdb09ac89252074d0e0e82f35d0

SHA512
fc23361cdbd4890175427fcfee98b987831c58ea0071a2271160d1fc92f44641590933352f5ad161dcab3c204f37a7575ee41dd4eb262dff1b5cafe6c8e37370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
423B

MD5
9555c67062010fad16d425f001b522b7

SHA1
70f70bdf73c0e9b3ebb62521ff0431a86cbd0d29

SHA256
62970c6aae8bf0fc19223ec0da85c6e4238a2703fd26eddb9752bea1c290463c

SHA512
cfce2880288bea3cf49e5bafc8b43fe88c0846f192dc4cfb8a61f2b4d51f082bad93f08e54c67229f81ad72ad06e48a1c561eca107fb118f43c24fbc1c042351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e92f3669bc619334baa98d213c8b0fe

SHA1
08cff9893c5f45fee4056c6589284a856fb51e04

SHA256
92157f8ec10c3e57bde2739683cd714b9519c3c94839c0d29ba9cb482e80aab1

SHA512
7243ba58692aa9c69cf8b85cd8a4b2216a8d86ceaa98a0e9fc99fc59ff2a6f162f122d27b9f240dc3f1f2318d429bcaa3358e2a9e3b19c59c1cbb8418727a32e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e3069f5b927b13240879efd657fd0ef

SHA1
2ec289070e59b9b350a15a680e8e590401ec4c6e

SHA256
372e6236f67dcee5b05e30174e857cd7d97595ecee2561269633981bee69f053

SHA512
1a1889e4e5f40a0911ab0615cdf810d1e5680e08e18f5f3bd4a19a73b6b1b781c7d0927c6dd7268393a6c8b7800471f9fc2ad27bb2402024a8d3bb46f6323ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8dd1b114abfc81948464c04cbd985078

SHA1
8220277d4343637eb99530e5bc9ec6d5b4876461

SHA256
8bda57054d400760c1ae2859705acb6f62e1d4316f53ed2526a8f7fe57c09987

SHA512
b9fb10bad35a402ab16882889ffb21cf3ede6fe1301d23df82787796eb129620f0d6e2292eaaa17fb8361941e86dd358c3ed20e5019676a032bee11b17a6b7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
837beac4c7ccf2c18b3528be8a56d6b1

SHA1
c0a86cb85327eb3c0094d9212110f69b966397a5

SHA256
3b24025b2544cd123a592025ca8dc3a6d91f2a232e4a665b8faa5f28c180f305

SHA512
9bbc880f283f6dc16361576166d35ed26127d442db506be7dcb8e8d046642904a69a6c6abea115dc23b70177cb3c49cc44d6afa7ae53ced62187ede34ee528a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b3a0.TMP

Filesize
204B

MD5
2d67d146c8a9bd1de597d217d18040eb

SHA1
51e3ab3c3d68768f37e78a5453d2343c95e619b2

SHA256
ce7686a9f25df699012213e48cdac23db8aba0172fc77e1fc452e29deda2fc02

SHA512
d177c4a774a200b4e4129beb5149e8b68f9915466c1b63125b21d855626e7465a91f517529cd2df42ca87f1226864afcf14bd5b86b43a9387ef07113b16d28c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d15e374fbf80dc10c5b93605cac67ba1

SHA1
b59d4699922e01391ec98bacb3fccb6277a9a268

SHA256
9e49c09e55df48e7015947482f0cf87266935cc06358d202c0880ebc91a8497c

SHA512
7e7cabc3eeacb9f3231e998c306685ee70c20532d6b1483d8485ebeee90c052156f7663c3e34c4c4503a8dfd220e2d89ab545675c444b09820f549d55be6c00e

Download Submit