728d6ff2c90e26cbd46fbf91ef52736a9493aa41944f74d79d4380618c0a7326

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55e270a0e70c4bfee4ab02ad440e420a_JaffaCakes118.html
Size

57KB
MD5

55e270a0e70c4bfee4ab02ad440e420a
SHA1

7472d4436ae8e703456f8fc26a85591f5e7b6e7d
SHA256

728d6ff2c90e26cbd46fbf91ef52736a9493aa41944f74d79d4380618c0a7326
SHA512

57ebbb1f390df0f2e49af25ca2fa8dd3c182b490351d6d1afa2d6740c55dec8ce41f567deeb4b5fc321e8ef648e0dea0788d129ce164a506d570c6ba2a374459
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroTjwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroTjwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
3968	msedge.exe
3968	msedge.exe
2164	identity_helper.exe
2164	identity_helper.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4820	3968	msedge.exe	84
PID 3968 wrote to memory of 4820	3968	msedge.exe	84
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 3700	3968	msedge.exe	85
PID 3968 wrote to memory of 4972	3968	msedge.exe	86
PID 3968 wrote to memory of 4972	3968	msedge.exe	86
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87
PID 3968 wrote to memory of 4808	3968	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\55e270a0e70c4bfee4ab02ad440e420a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb171446f8,0x7ffb17144708,0x7ffb17144718
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8391830134153319560,118363846843636772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1432 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
1068b5f707cbe80dd94ded5c7ba2b0d2

SHA1
cd7586e015859c267cf8930a89fe23e6e22e0588

SHA256
f14c3a1077705f75fa176eab8bdbc15349779451cd21d7c0b4feee135245d1c9

SHA512
9c7baa6aa1fa8370bf08ae7243e91606eadb3ce7464a52822ec3656ad8b3bd28c4ab514bf9b75af194a5172feb81ef93f1b13c14c82c91fdc557c2d7d0c84790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
88f40cbdc6450401014e56987114e647

SHA1
97374cf43c2fa24bb5e541978b0aba88643ecd83

SHA256
934ea337f55d3d91c94b2eb4557f562f84fcc59f5a6807f94f21726e04b3b87d

SHA512
f34c73ef669182b20ac8fe5a256c8b20745ebbac9a8b335d2b2efd5ab6e5bf066635c1a04d74169db909da2b36a70798807788f295adc39aba67572e6023759e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
176ef8458a890d4c3b30c9435dfa4ed4

SHA1
19f2040051ea1e5e0c8c7acee5b8ec2a9904db64

SHA256
2a459957b2eb4b5452ac9bcf67743c0d4d10baff754e89e3f51c5b40ffdc4c65

SHA512
ae658626f050cd1317200ef644147be16b938e625c8a125ea1488aea235ec74609e7ae783e0305d6ba2b038bdc89bc37ace3fdece4dea7aa897449296466ddd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ed878697c31f43afdca63a0ec646d52

SHA1
44b8971217ba631c6a28bbbd116bb1193d51bb91

SHA256
c9f1af1e4b59ee842652bb25dd0e9b1360e48f2b1fa7010aedbc4ac9759f98d8

SHA512
d7d15de05449403a9c7e7b3a3b7eb52e437e746f3a95d92d5175973278d8ea07eea4386c8d807ebb540f875558bd1f2caa2cafa11f512354153641e30effef47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
737d18462108e5f1697b3e1503adc94b

SHA1
c7907a202d953c70fe0924f223799a5d5fbf7053

SHA256
3ed5bed8fff575fbe8e2642320f22df149ac6a59a35a2e457e921981f8e10401

SHA512
f641e77fc4d8d71de9d0c5a323d3c4c47fb8eb7fbcd28f9f927af57f83a2dbe395bf1ba6204b1dda04b5753b56b658f18ccca66311b828831af804bc2542149a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
b149fb14de73d15f87484221341c39da

SHA1
ab69088626c0ebcf7d32d0271e8e43bbc0cb68ef

SHA256
3591a51885a9c716c2bd711730bb76c9f6878be924f4da06d492f5a544734e2b

SHA512
968172d15101ea69b5779390034c95cd77944ae0f3554e00a8cd4f94f3a441308fa6ed0e32ccf397f093a83a8084ee51932fa2e9d29d08c72ade5035661a8a58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
05698f6a6d5829a5da08bec283679afe

SHA1
08f8dc1dd6a7f56e9726ef93a6bbb38100db288c

SHA256
7cdbef39b3e373b6537d2c7da962a7e2af29eb1eb2d54f6fd957f06a6a6e53f9

SHA512
85710e2dfe5656d0693074af7677f103c171d97deaf814f323b5440fd7bd8d88a211f61ccbc40d229bcc3d902b23ea7a9af8e07fba3eac2a84f9af41fd8524f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585436.TMP

Filesize
871B

MD5
96b46cf01f7c14ca9868eddd70604df1

SHA1
3efa281ff2004dccbca1d822ee6d6a43d8cdfa53

SHA256
8ee709300f83306e108cdac289be25212450ad72c92442d6c72c643bb2c14c46

SHA512
92e1f8d2df92b59fad9e4dc34f056ba9def52c5d2830c7c16d8ee6d5d46a1a9990ee21b6386267b5aa35fd547e342c3f315b929f4adf487541fd3b59f187b444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fa975b9d11f86cf6381ba8781d02b324

SHA1
baa61fe242184259523064cf0952a064f9c19390

SHA256
3fafbb215599518265a590b3d7cc194c213638c12b3dd7e4ba4758e5fc1ebe9e

SHA512
9c52b111548bbe49209235d409933b5943c176ac9afd2316c06404d946a7e0b80cb640cc8c4363998370f3f27cef72e44a0c8a56741602e5b7b71808ce363dd4

Download Submit