f7b8dcd602bdf511f39a52c24795b5d29f40c22fe2cd16365b666f7804174eee

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

389c31c47cfa9907df2435f9718c6d03_JaffaCakes118.html
Size

35KB
MD5

389c31c47cfa9907df2435f9718c6d03
SHA1

4ddc02f19c666d2af2030df7ae8249af833039ea
SHA256

f7b8dcd602bdf511f39a52c24795b5d29f40c22fe2cd16365b666f7804174eee
SHA512

5b84c22f0f15a881c7a415f11de4909c13dcfd826931e1f44459062450d15956352c79e9fcdccf11f03df02642cc129263ba27a7e33796a6a2005f0b5c8b018d
SSDEEP

768:FbUt98s4PMGpv0fWdMaatupHsH/cWbDeImqBEP6Qq+idYqVedTvkbiICz6L:F698s4PMGpvvBHL2bB+w+idXVehvkbiK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
1632	msedge.exe
1632	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
3652	identity_helper.exe
3652	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4004	1632	msedge.exe	81
PID 1632 wrote to memory of 4004	1632	msedge.exe	81
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 1180	1632	msedge.exe	82
PID 1632 wrote to memory of 4588	1632	msedge.exe	83
PID 1632 wrote to memory of 4588	1632	msedge.exe	83
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84
PID 1632 wrote to memory of 1676	1632	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\389c31c47cfa9907df2435f9718c6d03_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb923946f8,0x7ffb92394708,0x7ffb92394718
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1935637469176080505,15631930772132414966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1f25a15d4bea01164d8a15c80917ab46

SHA1
ddc9fb1a23f0b4036ce6a5d154074c9b294de8d6

SHA256
8b81ddc539dd2a8e94f1641da05007178d0d31ee6c7f1f5b08e2feba6a3cab60

SHA512
f2cb4c0268a42b9c19082fcacc3932da33df14bb1484065efd2fa21596833ec5978ceb6bbeac63c6827251501b3b6bb7bed20e6860d2afaa344e10d2221363b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
562ea70b9b4edd4408bce5c6e56539dc

SHA1
6de6ee81d5aafb491c787cd34ef805e02c624426

SHA256
25101d3d7048121f49de45a227faf3e700d891081ca850ad180b2fcfaba86478

SHA512
77d19ef01addba55d40c792fed3b06766cbd7bdb2cb3780db274e671347d2784e87987504c57640db20e635c548caac7c755c3befad41d9fc6c13d4a0f5d74c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89df9ee69c54a166995207a1b4fff46f

SHA1
ebf7b720f343f6a38784ae94642020aed84fc83f

SHA256
c2e004634812e9c21d8d1aa3da707ccad18e982ec4b924c4827660d2deed259c

SHA512
18d9db261155358a031daf33f78de1d1a80b7db7aea2e68ca49136f3e0a240a5e8e28c233261e17789fa3746cd2116094d9019c5c897cecf4a716af8b54605c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cbc03ce36055a523cf8277238a9ab8d7

SHA1
573324d6f72e66d7492b0a14e28c8777ebc11d0f

SHA256
0dd4ff73c20385aa0c34e199bb13639e5342283289fb58b917178e8aa2cb2970

SHA512
1d6d73010478b3591d492957071a2099e34eac33cc2adb0d8acada40622c1fd9bc8d5682e8b3f37df07eacb0ca83ad49671cbb892ed8b3172f5d15c3ad071044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cfef34674174495a448a137fb01779db

SHA1
629a63cb0e61162a357375b0e6027dfaf0ea9ec9

SHA256
8461f0e22e930a25b18cc572f56f448bd9859972d13056417fce4bf3e674a6ed

SHA512
b74cf2c45517f16fd39a5f289f5f504fef4c2e3a6758007d28dce9afebe4c9eba10db01573a25e70deea47326a56aa37d989727fa47ac560cc87f38ecab5edf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bfd0.TMP

Filesize
1KB

MD5
137b88607a84b32c906ce7faf0ec25fc

SHA1
9b596e51a2d4656685ddd5cb5a8d80ff8d780c21

SHA256
b9b26a99f14cb7c5d0b09850c1ad1200f0a61478a4d5b1b7ec5698dbe73f63a3

SHA512
ee5d2d50f0dadc72946d27e1e46cefd7e93433640248dc04e97a1f9e031592e82578151dc7718c88f5bd27d3629b5bd37de4944bbe122deb922adda964ea1ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9bb229bb3f647dc5f1237ca220b10816

SHA1
51803c1e7c3810e77e0786e6379494981640ea43

SHA256
fa2e496c0815956470237cd1e327af3d5cfd65627403b43cacf94f4e5942d9d6

SHA512
34cbc583c7101b10b0efbd268b02a66fdb34fac39404720bda53f611e4f0515dfea0e307be30755483f24fa01ab340a2e9fdbad06250d8e1c3a949407031fd2c

Download Submit