8fbceff4902ad8166b6c99ca79d0312ad6915e984feca1fdee118afc8e25a97e

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a17e50738eb7bac9bad702cea927205_JaffaCakes118.html
Size

29KB
MD5

8a17e50738eb7bac9bad702cea927205
SHA1

24b7b7925ca1f7bce3da2b1e965d6e78d755e8b0
SHA256

8fbceff4902ad8166b6c99ca79d0312ad6915e984feca1fdee118afc8e25a97e
SHA512

63a100abb202a3ded6a9d33134002d2110aafead603aab85b348c5d5e26978ffda7ee66e5dbb24ea4d3fa43ca84a8f28ea1d3c15581cf863b0b0d51b9c373e19
SSDEEP

768:8mvXvV6qfVO7Vdnujx9JKo7zFuM1YoOmjWDupIH+Y/JpT:8mvXvVlfVO7Vdnujx9Yo7zFuM1FOmjWJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
1616	msedge.exe
1616	msedge.exe
3952	identity_helper.exe
3952	identity_helper.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3276	1616	msedge.exe	81
PID 1616 wrote to memory of 3276	1616	msedge.exe	81
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4880	1616	msedge.exe	82
PID 1616 wrote to memory of 4064	1616	msedge.exe	83
PID 1616 wrote to memory of 4064	1616	msedge.exe	83
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84
PID 1616 wrote to memory of 3584	1616	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a17e50738eb7bac9bad702cea927205_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaf0346f8,0x7fffaf034708,0x7fffaf034718
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,17812077414980374032,8476318485847007087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7774b637-2ab4-43d9-8f20-fe1c19733535.tmp

Filesize
6KB

MD5
45d02a8c60bbcfcf1af7e610bdabbee9

SHA1
13a1a2ed4fc82331e67ff23a6f73aa186407fca8

SHA256
099b4bab72f27989dbf6c9b3204ac88b720ceb21a7d5ac92274f3d626e984588

SHA512
5b8e358a72b0a5e02ce48c69e64401f968c95432e205794bb32648008939ad9bffcc7efe8a2366c0787ae10bbf852848a7ce2ae08661fe1d8fc28b6e3839c183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1f7cda07410a6f7e5b071c8221cb0d16

SHA1
9380fd2174ce5869cc473b7c3fb10478ff2ff1da

SHA256
b55563c4d80e80550491a84191b89575f0afe41cafba809e12e8b634f6c8d3c0

SHA512
3af1c7e2b8f8627b271b1f59ff356a119d5b0adc54503cef0a50273c2d05995693dfda962cd61d42b89a246fb1db62292f8f58ed6092abc23abe21d0514994c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
121e0281468ca83a2c90814cf7e1c6ff

SHA1
b6b806e17c551b78c0da379001d9ffc20886b986

SHA256
13a14069183a133e8a493c14b1e52e8928ab25e7250913df0c1d784a9ea2509d

SHA512
fd28ee25c30d289b57bfaf6d451d2f00f286be1c2bce32d2dda80f38891596b078d2e6c218698b875c2bad8e361264496a2f6974bcf665414e22cae9fe0676a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a76571a20fe753426fadd625aa04c4f

SHA1
a7f918b3de985961dd1760de343ab2f6b61251d3

SHA256
3cedacd5474016ef97cec9837df9b2b4bb9e16916cd9f0d68be62188ac9be0ac

SHA512
298c1bb667ce09ec0307e6e4d45ab0b8f4b29f338417ddd6e353e76b2c5d7382511d3e2efaf56412f2995b4f5d8ab7723bc238cabdb651c4e6557ffec3167abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
da869d37d961d6b8a164b3f4600ce44a

SHA1
76493cf562017404ff8a59129c8cba8334f4e3bd

SHA256
bc3870fc2e766ee8e6d512f502a5c35a8e7308651d6a01418b999db1e77a43b6

SHA512
1af3c03ec18576c4397bfd21580ecaf37f1c6f1d04b4256c1448d8d0c33b60359a3294ca151304dd52cdb848984a55ca3895baa30e70c266d3041c2a770f4e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa2f.TMP

Filesize
1KB

MD5
3cb9d64c1f4ad43a198d5ba5911139f6

SHA1
1dfa51c0d9a4118315ec94a72e047ea59a886404

SHA256
b109833b30ab91192077d3e8762ab0554ab648b61a027fdb3d01c5d387f94ca0

SHA512
a00132b8b8bec56611521be5489d6d8e91f7e95a6b77175b71aae32531a1fef38363b7b53eab3347af238dfbf789d8c8dae6bf4f47e649fb9bc3516e949e92fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68b19ebef24174cedac41557240b5aee

SHA1
1f078d851fe7803496a900fc29cf0a32af2e8b4f

SHA256
edf32ed99cb15c3a4e82b4b57fa431c61d551e23dcfad096242c8130460d23cf

SHA512
20274a5ac6ed51004567f1dabd31b4ae9c84b70ab7a54d904e5621ee2938d94a1c565d5cc06588bb543d4d5c27fe8d9ac97012101861f57037585e7fa5559c67

Download Submit