5567e4e3e863725daee349c5c96268e1e389312d1790cb7c97b56174cfaf250d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02625864fdc1fa8923d5dc39e0ef80d6_JaffaCakes118.exe
Size

15KB
MD5

02625864fdc1fa8923d5dc39e0ef80d6
SHA1

ff18799a5d16651bf27c3e6cbce53ec9ae447323
SHA256

5567e4e3e863725daee349c5c96268e1e389312d1790cb7c97b56174cfaf250d
SHA512

f1d0c3064820dfca34392f2591351435c300d767f329de5884bd814b600b5c9490cbc0aeeb009dc2db9af79bc8ee8fa789daa5ab3e8a010a0ed5c8e9fcddaa66
SSDEEP

192:nOs61A/0LiwxqfKD6Vk/gqWhiQ7Sh92sGNl+vYOHsQjcWpKzglx:Vx0iwxqsRQmh92tl+QOHsAzAze

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
3496	msedge.exe
3496	msedge.exe
5424	identity_helper.exe
5424	identity_helper.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 3496	788	02625864fdc1fa8923d5dc39e0ef80d6_JaffaCakes118.exe	84
PID 788 wrote to memory of 3496	788	02625864fdc1fa8923d5dc39e0ef80d6_JaffaCakes118.exe	84
PID 3496 wrote to memory of 2880	3496	msedge.exe	85
PID 3496 wrote to memory of 2880	3496	msedge.exe	85
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1028	3496	msedge.exe	86
PID 3496 wrote to memory of 1460	3496	msedge.exe	87
PID 3496 wrote to memory of 1460	3496	msedge.exe	87
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88
PID 3496 wrote to memory of 5504	3496	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\02625864fdc1fa8923d5dc39e0ef80d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02625864fdc1fa8923d5dc39e0ef80d6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.hotmail.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdab2946f8,0x7ffdab294708,0x7ffdab294718
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4856134661560962066,10755258226717088945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
121bbf1a64bc1d6c3e3c8a39079b72a5

SHA1
ce523dceea8d3a3ec35f08aca4cf2b5b16d76f56

SHA256
3341a230929e4c3596cd6d66892e943627584e59ad56608da620a702aefc7f4b

SHA512
e8013f19aa96f3f77aa7fe13ea060264bc198c6854caa7916fa6ed9d3979716f7db6e1f1a47a7354c7e7fbded9b8d7505c793d62fceac844108b27bfe48dade4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
855B

MD5
6d731b3a554fb6d58e5bf193ca6cde25

SHA1
ce033ec535820c4dea0d4c5eb4474d9655c1f674

SHA256
861f7a5e9f7eab6251ba4352f32db9dba4627e44fcbcf492096bc65997b73661

SHA512
c5031b0482cefc17221b13d3269c20ce2575a8261e7af5f62bb08bd283cb86d7139f82535b6d31ff774c502dc69f47bbf28ef861f9fddc2f72e90420d7af8c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1ba52c6de235060416002901ee312b2

SHA1
95e093ec9c04486186a794ad2a8cccf05c2ec466

SHA256
f6e928ac983aa866d1a74c11491b6b0f6daa8eab19ad28c5ccb42efb88c4bc56

SHA512
ceb4f8e7875b3f0bf33e859632040bde502240dae9d00b83438234df9556fe5396e5fc58938a0f9f5962809dd7742d487d7074a6cedb19bfcfe08c519e6a4016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
085f0f4e2e34fafa1caaaa833657e8cf

SHA1
45e377f55a3a59953849581098ec3ef77f8a85f6

SHA256
c81d2279cbe6519f652d502a2d3d4b705c82278c5fbc83830cdad0240c8c626f

SHA512
816f229a2e2073ad4f1adb992bc47fe6b9f311c1121590a890bcef795b96cf9c3ff6471c873d17e086610da51df112891d4e256185b1b22113d489dba287b34f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5479bd1d333ee47579318cd1fa87b0ba

SHA1
5bc4eb96854227e38b1e489873d458ebf06a59c2

SHA256
dd4ebdec858f946443a09641f497afb934e7ccfc3efb5bdb3c670f0d086df286

SHA512
9611eabc7704cf81207415ee10ea190bebee34abdf461f07540444d29e61b47986fda64102f8a7db448903f8a070af32f4b922c26ee08f2a62650f1b419405c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0a319b829317cfb27793594fc03a0b4

SHA1
abc4943a0cb84811c705a6506b04b4926f422ae3

SHA256
abe513404dec692c8238a5819422f894e73b661d15f6192b1d74a7b9435ddd4b

SHA512
094f87645f940fedf56126224afe72f25c682605f09b3f9737adb85e7561c9831a182ae549cae54bb29fff3e1311c10ae897b68287738edabb49e576478ce668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5798c5.TMP

Filesize
1KB

MD5
108ac36471eeca35186bb89805a0e88d

SHA1
f0d7600987ccb12ab654e5fa6aefc355120b5073

SHA256
dc6e8a5554e1479d8ae8168156e53d78228241cc3c10418fc508bb21e67eb935

SHA512
c7425447e6d3fae37cd2875be32b1cf2179c580b0a738ae22c7767911172f9985fac4fe22ef09cef1aa2ca76548071db42d57cf94ac672324bfa843f18ee3416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ac44e3eef7200bcf88bff8872dd7578

SHA1
79c07b451f75af4128f325d3c817708849817f3c

SHA256
92411b03de304a9c4bcd732a9658392979d897f0000123622bae883d5469f20e

SHA512
6c3984da4a53332ee248d81dc90846941b0fc51575a55be9c37160a49ecfb3f26241b9dae8c19925856ce5fcbdb76769d5ceb4687699a8a45998e893d9791e00

Download Submit
memory/788-32-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download