19f89e2272e39e5fcce0e3bfc4392cbfa132edfc2997d14743436049671a24a5

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9827eb5034c93b5050cf24d76609b6db_JaffaCakes118.html
Size

99KB
MD5

9827eb5034c93b5050cf24d76609b6db
SHA1

6e92410fcd1779a9d1b7ec8f48101e019ce9c40d
SHA256

19f89e2272e39e5fcce0e3bfc4392cbfa132edfc2997d14743436049671a24a5
SHA512

57c48e18b280fcfdacb0c45a995c8f304b4ed6779c039733441803841babe5673ca28237c9cfbb3a4cf39070bbe52de666ba2d9e09bf2f952d789eff1a540dbb
SSDEEP

3072:66N1Z7MEGi5rg2paRwjQCyakQAERHKMtbTv:6uMEGitQCy+

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	sites.google.com
10	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
3680	msedge.exe
3680	msedge.exe
1556	identity_helper.exe
1556	identity_helper.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3828	3680	msedge.exe	82
PID 3680 wrote to memory of 3828	3680	msedge.exe	82
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2828	3680	msedge.exe	83
PID 3680 wrote to memory of 2512	3680	msedge.exe	84
PID 3680 wrote to memory of 2512	3680	msedge.exe	84
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85
PID 3680 wrote to memory of 2108	3680	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9827eb5034c93b5050cf24d76609b6db_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee01646f8,0x7ffee0164708,0x7ffee0164718
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,427975969768205979,9474533509223428091,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
eb694d88b8d627561f6a6b5123383e3c

SHA1
265cf3be4b50d429aeb787ade7c0401664eee637

SHA256
f66b8e11beaa2ac164832d44607a9c461b0f1accd72181345522a2899719177e

SHA512
4017a6ebe759064a56d6dde674659489701221c57fcb9d4e7b05ef31811df26f7165a47e15f77e264133716759301fee4e8f1571ca4997eebcb7743e3423bb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b88559c47750b884693f2b0b9dc7534f

SHA1
329ab149414c8c54a22ca7261182cf4ca1fa29f1

SHA256
2befd8c55a71c070cf1a557f189003307ba323fc904c647d5c6f91774ec94b48

SHA512
0e48b82422843fb1acb79d4a8868befac606377fb281418c3501784e0a07a7d780043c1ffbef9a4f5969433de2d4304ab1a0af069bcee0186f4987893a4daf21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5d514c5f4eaa033af59f3699433deb22

SHA1
b411001ff63f09520550fe41d3da6dd3ea798b38

SHA256
ce0b0c2901a9e0ab72a3c5f7023f21bf7b15424b826aa258bd3a28a6bbd3e391

SHA512
8126e35935d5c41df9298d447e854ed3c3dd1c3d064db3c978e73b59c8ff74192f6192255ebecb5183535de8d2c0c63fb9acdf19167f1bb256176d7b29e36a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14987b898d1f766e0ed842258be9fbdb

SHA1
92aa012b0d7e27efdaa82ee2acfe121495e190ef

SHA256
686dddb1f6111ca20882131d561df2299f1658984f0f27cfcd7f06588f65962f

SHA512
a4a3995421de72eb73902b6c22c2660926109d86cef227422b06d8f352db2c2f9d0fab94dd5c3030d847f27780130218a7333796b5b655d2ac2bcd8f786a9c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a3e40750a75b443680b96c30fa977cd

SHA1
270f789de5deb419ac3b177dde5cf3cf919089ed

SHA256
a6804bfd83a1e865574ed344955e6738c1175c0c8b26b5134256581302e0297f

SHA512
da50a197655299b0a994d38e619e0ae1d527742e60cb7d2a06ae3b812f83253f1716dd14cc6f21d1f7438297fea1b310049e8fb1b867a0b91d7f29df0175509b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6dacc0d5e8fb6ac7ecc6e3a10585ed31

SHA1
4d7877ed5c611963d9eaaaa6fa4396b444c83a39

SHA256
607633eb89f76091e438039021b7a61de08a0469c843e9696f4fe4031ab540c7

SHA512
a2476a56bcad72d6732927bead3798430f44b2f6c5ec1372b510f93ef69e46bbc91510f36a09bb619960db8504a2beea7f50d813701ca971402a4e20e36827c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b74e493f87b545d2ca0ae29201898009

SHA1
5b88f6d1bda1d57eaa219449ef7f67f38b624bf1

SHA256
69af01c60c09f4911cba36cebab63cf8c9c122c84f615cadf08fa37f39f545a3

SHA512
56d36cbab522b462e34b86f5b834853bdd204370c7af2c974d8bc7549f318cbdcfbd7ef66b04ac0d44892bc10115b2b74e136ec20df7eddb7ab234abedbf0562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
f42126237133d6b2ac65ad2106e7daf8

SHA1
d83acc7817fe1e8e3b9cb1a8fe89192787c0ce87

SHA256
e5f568981757c8167c162b00b51cb7b257c440cc8e61d3a4ab0e94e73591fabb

SHA512
9f0dc2a27c480dd3515e69d6aae6519bfb6109ae95302e690620b78ec59cc577f1acf5f17748ef1eb914cbf7088695d5bef337f5709cd76388a7bee012b5f311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581085.TMP

Filesize
704B

MD5
6f2b8b14110b828d2c83e9ae0a4c1b51

SHA1
a5f5a5ed5288be3cce720d383d1df1c2cfa4d0e0

SHA256
15ac625e286549e6b05d5b46f9c3db80fb10c1f38985f91f0543f915c39c55eb

SHA512
1b37262d1f8d62d744e824747ac98e92e26dbe9630b0742195458ce4c7e29fd4fad4ae5791f29915ccca5587afe67ea75efe34f6631a5ba79f458308199b1ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c3eb88ef7fdd811fafd60c62dd3403bb

SHA1
4db1cfab91b176bdafba5fddbd0e011c69b5ad46

SHA256
d86c73537c858bb4e1a386c1e03371ccb85ab8572cfff30dea1f66fa442a8521

SHA512
79bd9f98f159f7eabe59f772782383946642c18ae9e1cdef8d443d14368b07e96ca94cbeda9806e4b5ed470077ca0039942077620e660707e2d774e576e660cd

Download Submit