f1fcd056d57e84980ca2986c88b20276f786633b046d09692ef31f814dd8498c

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7d2f3adb888559fbf52e31aca66ad8d_JaffaCakes118.html
Size

30KB
MD5

b7d2f3adb888559fbf52e31aca66ad8d
SHA1

1824b617d61f2e84426e3cbe4a821e1579402941
SHA256

f1fcd056d57e84980ca2986c88b20276f786633b046d09692ef31f814dd8498c
SHA512

25f78d982f70b279a51262d98b6d5bd76b12ed10e57ef1b9d68b9d8800df4a1a35fda114896107fbd7870d3f0d7472a29c7cfe8cbc8003033c14c1409847d583
SSDEEP

768:m3mGf0yL7b/VEXjPWHljWLwPWz3bdRr/FEIng4j5/rVr:5Gf0yz/VEXjPWHtJPWrhRr/FEIrj5/l

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
3620	msedge.exe
3620	msedge.exe
2816	identity_helper.exe
2816	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4700	3620	msedge.exe	88
PID 3620 wrote to memory of 4700	3620	msedge.exe	88
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 4524	3620	msedge.exe	89
PID 3620 wrote to memory of 1604	3620	msedge.exe	90
PID 3620 wrote to memory of 1604	3620	msedge.exe	90
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91
PID 3620 wrote to memory of 3944	3620	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7d2f3adb888559fbf52e31aca66ad8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb270446f8,0x7ffb27044708,0x7ffb27044718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1732491829003483503,15234244709593287911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
24d0cde802968b9b366530efa2ad1955

SHA1
90ec91558780b1cde9e3d36f74d18fe4cd2495ba

SHA256
3048d6e7ffae88e822cbe08322cbc48dbac1d4954aaa1ce6e7f096fe34fdb1f9

SHA512
cddb331152afdf635f0b1b66d16a4a74241afbf3c78a8690ccf05922508c336379080520b2350693d3e97097eab29cf6f02e82dc484a71d9f1c3f4ebcdc32224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1e12127bd82651621030372342ba7b7b

SHA1
965b3745d4758375e7130181ff4921f8a3d112ba

SHA256
65c856d98102214533c546fff3adf5056dd55a573b0ffa69810b38084c5b1a94

SHA512
a42d0dfab134a92954ebc9c9b1470d4f4a0ab01653127f1f16a9f5ec197a5c3fa86b863c1d6db825ead0b936b8f9fb343e740492fcf38667120522bec45a99af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a88762fd3483a7584c07220f9bfdb5b8

SHA1
0b300ad617f896d1f3e2d35e72dc15814ae1ec31

SHA256
0ac46049c7a91e9a25f81432fdf57d4cf853b917062d7fa0e68320d3a1051bf7

SHA512
68ff0ad921db6f2cac0ab44a181c4015459235943892a54d0ecca4cc02332d26b593c385bdc13b011e622046890bd2900440d3b10470739fcedc60a6800aa752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9988dd6eedbae2362b10503596720c5a

SHA1
5439825c2e2ac00e3e0edf23f1dcd95b31bd7efd

SHA256
d1dad309cb56a040932697630fdc7051c791968370ef1ef8bae1db313bed4229

SHA512
584f0358407725b59dca2d16fb17305761865763f358e72a21a58e02a1addf59cfed6874d0e97cc5f52f50afe56eb467fb3d6769bd185526d05e3ed87bf3bd62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09e5c12f694762080b8896fcea8b68f5

SHA1
b02f66f237acd445e053f1cd2b8682ae01fcab2a

SHA256
177c2cc83cd20aa923892c8410d500fcc34383e1fa1608a6c549573c5bad5cda

SHA512
92707eebf90aa43ad5ef67248eae1ff6e6e9fe629a2ef0d66edaf2802b71593499a5d1ab65343a34beca317db5ed6377e479ee5f9090aa367ef17277c3d4fc95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2e5fe9267eea2c95d7e6e12ad1131c5

SHA1
248af188cd523f016759e538dc0aeca076b9176e

SHA256
6f9d387b44e10d9e79eeebe383f839f09cb663e52ab536f7d8273f5f7e605ab0

SHA512
b11e2064caff4647109a7fc9dca475c690db1b800c26d1972d1273d4ed3013be443010e4e8cfb5824d11d9bd3f60036a9e736084c394fea87443f5568f82c112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3c0469a496476aab7c68c0d12f04b70

SHA1
0c17711ed2566077f4fa656114d1cbe3a1a15522

SHA256
78f13c634f7ad586780c1c5495896b68e8507d4361a0fa3a79263152866ee7a4

SHA512
4cd0c4211164ebd3a68aabace87c00decc2fab0df92e926ab7f4258388bf0407c024d2a19fd5ecb85a84dbbad3ae1ed05588b872df081bbf2fc7d6151a977847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
362B

MD5
4c63e0d8082b12af9a5905e297f99ff3

SHA1
cdb823c410efe41fa6561032d74f252e03baaf17

SHA256
7f5b9beb94f522dd1578327483efc37bdee3aa3b0af1d4c81c8b85812fab83ec

SHA512
d6af7d3a77e05bfa4c420ac8b288c115477dbd0b594e642fddac2cb6533467c048df0b0113d3e3db22af43a3038ad6394d8af08d2a50c9684a22479f2f0893fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58817f.TMP

Filesize
199B

MD5
f97fc769d1bc8d23f05c4dc9a2a61f03

SHA1
10916a048f5fbbf28eca26fe2cc698e67b5ff5cc

SHA256
939a4eba68b5ddbb4b55eef60610fb13e6c66c0e099122118b0e3283bd37f634

SHA512
85c25630fac98cd48c791d775759381c23aaae0bc8473a9ed3ba2762618f1bc079bb8986888213777efd56ba745b8b7609f36573c7185302a49c0aad8c5ebec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
553a25b750620757bbeaf89923d4c614

SHA1
6c6959ef1e5d38be08404005f7e394f08e6e4fbb

SHA256
4dad8b53192648b675f4f960b61f5c21754bda548f685022c816f04ca1f397f7

SHA512
1f92851a744132e4348b163b9b56c07b8cd131dc8cfb8623be75d0ce9e721fa09e59190b7fa39deceaf8e0cb2a3c8c62fd4b16526e45f9880ce2aa4d42bc7607

Download Submit