4cabb20c76f356b1eccf50a9c83b7ad5bbcca8eb73a8ea0d5741ad438e4f9b7d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d4b60b9c2bddc6ca36f387d8863edad_JaffaCakes118.html
Size

74KB
MD5

8d4b60b9c2bddc6ca36f387d8863edad
SHA1

a3bd58917cbd5f001f5d1d1bc8409a6032e1d868
SHA256

4cabb20c76f356b1eccf50a9c83b7ad5bbcca8eb73a8ea0d5741ad438e4f9b7d
SHA512

c08339a430a16044fb43be31608dc453019b633198cb825b6f8b1763fb108a78ce0c0744a7f19238075b4de801b287e38e36ae9f51f60a72bd88d1741c8b23d1
SSDEEP

768:3cto6EJjFDAxIAXfRDP5BQuCaxfNvUTFD+fDchN28+eJ/icsEic:3cipAxXfVBBLCW0bhN2Vq/i5EF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
3032	msedge.exe
3032	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4432	3032	msedge.exe	82
PID 3032 wrote to memory of 4432	3032	msedge.exe	82
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 3848	3032	msedge.exe	83
PID 3032 wrote to memory of 796	3032	msedge.exe	84
PID 3032 wrote to memory of 796	3032	msedge.exe	84
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85
PID 3032 wrote to memory of 2436	3032	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d4b60b9c2bddc6ca36f387d8863edad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e704718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13404761699728279688,11659678236340324974,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x4a0
1⤵
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d343bd90776d481e02be8b44b4d2e79f

SHA1
80bb274c7bed7d807facfb1616525aef0578afd1

SHA256
60cca131758ab4688a83cdfba32fbe185a06164d481f6365e5029142cbc09c28

SHA512
9e0451f4c0ce30efd41b10e5d3b8ebc94834620279ca8f81227fe6908f9c24eed195922287fdfacd02b750486f874b43d2925971048277b880283f3a3eca325b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7ec79f05794545fbf3c36a95a3e5284d

SHA1
1387900db5326bfefcd991fc81f72b3fb3489da3

SHA256
158c87cb5614554a48845e6a14231a90eab2d058db8944851d2e05ebc8014cd0

SHA512
6452036af8cccde2fe6c80f4842c33801349b96e7160eb853241df4359cc4a75c0016f5b2bcc4049952d132131eb2bde6c8ae4cae857c547071e05b9cfc65029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
10d7043cb91cd6fed622971aa3aa162a

SHA1
ebb5a876d066c77510388e1c70afa3e41c9d77d3

SHA256
fe4f1b43dc45feb5854065463d2f7317c259240110820e26952a4aa55caf6ce4

SHA512
1ccad3733bfd64193dd6d248dd6d677fca2786c6ff25bdf440d628faf3f8dd7982e0a9e9eff6d3317f54b9317fc6d78c7b7945c7698fc18fc371c7a462e2bcdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1d0677106607cae3bcc374bd5fd3d3d

SHA1
733a93e44484aa29ce07f40e94d34a16511e5459

SHA256
9358834c397dbbcd231bd9a954cbe1ff095becaad2acda0005bc48ac16e5a382

SHA512
01b137380b1f6c54fdc328cfcd60c26753d2995ea592bfcc2412d64fb28e65abd37e65ea6c7ef644814c3c5d0546a3e68c76ebc9d160a4206e2bf6234cc4fa85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9271ddcbd36846f51d8d301b966adc2

SHA1
0c689689be02edc12c1ca867ff8a4141d384a599

SHA256
764006701771826042f5ca0a379409e3b2b4f5f063bd5f27d179088266225d72

SHA512
9f2520cbe6ac721b7d76a1785d3e7d51e926cf20b8b0f80100800e4d7396e3346a2ac5a7980dd04227adbf4ba77a175f8235eb034fe5c60c9fdecccac414e338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0b4b46515f82485ae51494eb4b6f6c1

SHA1
ac5179617b44960b287f9e2ed63fa4a8082c1cd0

SHA256
d7354248f47f0982780b27e7d43604a7c5ae8fdca483d01589c6f0db285a01cf

SHA512
7951d73f999ddc2a41b53377dc36dee10edea6c28267ff789ee3f44575b024826724cc7f6ccf7828461d28074cd3b1b75ad4b14d78d333863ecaa8e4af819854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5c06bda12aee6a2da2ea31deddecc76f

SHA1
a10acb3df6008dd5114fc3c249d9098da261c893

SHA256
ab6554bfd0e80f16a38636e2943224efbee6fc1d89e2b201b4592549904b103d

SHA512
447ee7bc866b645c12c1d245a10f8ad05d13c6130ed7f1c65ad5b721d8b908afaa99a1ae56cc63331e19d1666793902e5cd1c4f70381714f2752bf95312812ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58218d.TMP

Filesize
2KB

MD5
d858e3b90af8ae50ec81c6b90a2d514f

SHA1
f75373096b6893b6a2da88e94891bce6988d8877

SHA256
66417f31624b5c2cc47916e8a0db7ec95600b2839c53fe712941853183d4f495

SHA512
b0150fe9fac14bfa07531a5e0d2909a37b80071c9a109e0fe900d87676a37b7cf36380d5b14d5211d590fd0e16c1199db79b93dc6ad45eb59efe0c96e8a11569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
371e15015e3c87e9c66bc67c56ab2027

SHA1
7d37847f5c6e6e0a578091d45ee8e9fabd726233

SHA256
cc5a2c00da8c1679069ed18fd078c5339778c03c06104005de79e359b6920c4b

SHA512
659cecfe5bb939479e8f0eb6d0b4491843907b45c1e8755523c939bb2afdbe801a56eb1c323afcf510628e2429c61c39a34fb951c12a77ebf87fb38c5f3d101a

Download Submit