65bb9f8c186df8879af4196613ea7d0b3a785f8982fd6683aea045d4b3c577a3

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

289a151eea16b1760d570991a7d490cd_JaffaCakes118.html
Size

123KB
MD5

289a151eea16b1760d570991a7d490cd
SHA1

0576482ebf5689a1589b0db69a6a81b75ebba124
SHA256

65bb9f8c186df8879af4196613ea7d0b3a785f8982fd6683aea045d4b3c577a3
SHA512

f91d96f9f461fd1fa8567b3d989ae2101c040e3607a2f11e5d81aa327c2df69a471c46ff0cf391aad7c56780c989e3eb75fdca7753e9a35f3758ba859e690851
SSDEEP

3072:RU9CWDxYxQ2PDxYxC2T/Z1stoExJjSeuhzSNE7jzCqeztz3yO:RU91DxYxQ2PDxYxC2T/Z50

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
4908	msedge.exe
4908	msedge.exe
848	identity_helper.exe
848	identity_helper.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4460	4908	msedge.exe	84
PID 4908 wrote to memory of 4460	4908	msedge.exe	84
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 3360	4908	msedge.exe	85
PID 4908 wrote to memory of 448	4908	msedge.exe	86
PID 4908 wrote to memory of 448	4908	msedge.exe	86
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87
PID 4908 wrote to memory of 2288	4908	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\289a151eea16b1760d570991a7d490cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3f9146f8,0x7ffe3f914708,0x7ffe3f914718
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12435826929523089344,8864465830826129034,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5012f5c27f783df8fdfbdf15a7501d0a

SHA1
c306bbb86012bc4cc837ea0568e88b14c053c7fc

SHA256
d998bd5b84304eb1a8691717caf02e12a0fe6ac297c7e7c55db0df9e84b13505

SHA512
48c974cee16debc208502b845d5529182281c720fa1b9252404c621704a745d01998c339aaf12fee9842301cb9f7b814d71f151ccedf80dff68eafc8e2952ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
abb423c26f22a9103a32a6532f220335

SHA1
870b17865cd2dbd628700d5b520a678db9a7e25c

SHA256
5480572b21812fe609ab1cdaeeb6e4acc8c11a8645a771843fbe4fb03974a561

SHA512
7b46f842ee15ba56f5596ab50c281a0008f1c867535ed23eaa04d2e754f0da84d20763aa697779287365f86260e45cee67741e02dfe83a7a93ddf8570583ccc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a910b175c68ec3683957a37f7387a8c6

SHA1
9df61f1f3a61c2146bdf92a40aa670600920af14

SHA256
1f1278fdc73be8c62e21adb1832690a6e9d27e6ee4878a4139845d133a2c6eb0

SHA512
20d69652d6d03dd50251e15dfa419716a12a8cd2ae1f6dd8a1677203961c4ce9b26af80ab4476317010dc3bee999a49c9d03b54b2b6b63773ce63d3867dca99c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
645ce551a1a9159383211140059986c9

SHA1
b53d37568b3390f9ea2cd5c5bf98484d780957d3

SHA256
c53829ee415b6a95bc086aad4d05675e540877f2eadbb847255c23a549039422

SHA512
a04f3622fb7760ecc9cb23622c4646f7aad434caaeeb4b71b8f9a7f15f3d8014f875378dadab356181a8aa834e65d39698b6c9c32aab14ccb328d38f7f6c8200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cd89cc3abce8c47db532c4c06abb2ca5

SHA1
6fb43e42ad86a309ba68b2a141a1cf43a154c8aa

SHA256
353ba20bd898277bf697e33cc82a2cc5b2c3f3e948e08ea25e1c04eac527b6ab

SHA512
edaed2024cb550f5e896fc2de848fc77892eb098686480d7f3bf8e1e557ebf35de2b268d3f2830134b4d8864779255d8eb5f30c11788695f9a993160ba9bdeb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
126184ccb065d2ca30607c00eb44a6b1

SHA1
cc544be3ec433ef8883af2b663f3373562e663ad

SHA256
1d98007a93967e880aa7b1cc75377ada4c9a3c24ae1c3035a75587cf90d62dc5

SHA512
2ffd4c08d0fbfa48f63e89b49aee9c012919bb200f4d7482d6448f0499306d379473a63687e84f620d9347d2a246bb22bdf3a0557cf78ad6b119d5cb6ff81706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583999.TMP

Filesize
203B

MD5
901f2bab21d9fed6e8c3a31af01052ca

SHA1
1fb5656cf96882c4974e3a10047231e50289d75c

SHA256
4bf904a7c5924954c667c78cccec3370e83c088e86d1b6defdbd340cbeaa0951

SHA512
7c378a97d690a309c171d1115b73ddd1cd97db56e1aa5950c939d493911938627073fb7261570cc4f30cbbf2a413ccbce777c8ca24206bef202335d254d41fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bbf24ddf4d4c4a9c7d6faa51b4ff6cb

SHA1
10f0cdc5202211a33b5ee4aaad10ae0e076a2a71

SHA256
af11658ff13753e83d1c7870b1eb8c60ee8acab4679371c214ede7dad9426d32

SHA512
61afb759ebe59671b01ee4bd2f0f838bebebb8f6e9db2acc44edebf1d31d1ff8e9d5f090c024d530e823fe48016e6a0d56de3736b262fc94f36be015391c3eef

Download Submit