9ea7454072b2abf2100746aa6ba37f8aba63e1625a8a84ada564b81a858d648d

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

886f88743e90723d2b6cf12e88adc892_JaffaCakes118.html
Size

24KB
MD5

886f88743e90723d2b6cf12e88adc892
SHA1

553d41b05395149ef30cd07701907c23e88684b1
SHA256

9ea7454072b2abf2100746aa6ba37f8aba63e1625a8a84ada564b81a858d648d
SHA512

b9acf61cd82d6671b88d5dc9387d3b6bbe434cd16c1197b2c68f96feaac9bd64ea19975a4ca96c6f3ca68e5ab545f5efa61c4ae9a90e46e5c3653bb855331288
SSDEEP

384:FhTJx5QSBMCtyiz0jUNh0CxiFJLyexNTOxTZrHZoAptmVBGLfWHt84osz56zwWR4:75QSC20CxBipPuSvlvT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
1464	msedge.exe
1464	msedge.exe
2076	identity_helper.exe
2076	identity_helper.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2068	1464	msedge.exe	82
PID 1464 wrote to memory of 2068	1464	msedge.exe	82
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 1688	1464	msedge.exe	83
PID 1464 wrote to memory of 3048	1464	msedge.exe	84
PID 1464 wrote to memory of 3048	1464	msedge.exe	84
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85
PID 1464 wrote to memory of 4384	1464	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\886f88743e90723d2b6cf12e88adc892_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe401546f8,0x7ffe40154708,0x7ffe40154718
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5319875220140103489,5183076397553429313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0a635b97ea4ed1d9c13686e9f6089f37

SHA1
c514ca6cdc520f240e879968e9f705ff2d22a8d1

SHA256
8d3556eae45650ecbdb0b26df0093534a5e68de0c6bdc11588360f8c67a55303

SHA512
be242482cd72bc313b62858b522d815ba13d2b7d0a96dbbdb9a1d432d137e34e5dca2d07a247c9e05ee55b3d01a2fe163b6d80163038e08978a55adfd0ea704a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
38197e3f70e812aa6aae93236e905cb5

SHA1
a2c9900e75eb353010b745f03a25d60517a4cce7

SHA256
c90e94420da3061d5f6c0eb07f31a5deda3b5be2cc254611f4e4cf1795147af4

SHA512
684fb2c79f4b4648d67dea7ac5ceae5d4bf83eda60eabad2e78a071f13d11d11d978673389aadf05aaa008f566d46087fdb4a22a6cbb6931acc0d396e0656965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b83df8c01670a2d3fc5b5dca64ef27b9

SHA1
b985d783aa726f55bd95502e3489a1f4fd2570f7

SHA256
0b630f19a38aeafb0751049e0969983632bd7d9742ab95093873c3683576d65b

SHA512
403682e83d11c8540c2448c6ba3d32e9dae44b0394cf9af5e6779d886e2e72763b37598f9c69cc52d54c306c0c06435cf86e5e865eb46205070a3135f868443c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6e94fb7c5f7b32a64e349b9ea56ba86

SHA1
8cbfdd481a6cfa5a0118410a993df0fb32e54363

SHA256
5e5960f734d5f4d59a3c743d0fb9f870e9a76a1161031901fbe9935e9379fb76

SHA512
305ecc08d575bedeff33b2d482adcbe7c6748d545ae27589fc5bc4e4cd05210b08cb2c9f9a242ced7f5b1d44bf26aa59dfbf94d86e526f7f7f9dacb12927b761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
aa297da34b2b9a1d3aa6415d23e4e2e3

SHA1
3cc3d49d4f764221fce05df4afb373c2250a5d7a

SHA256
492725bb11d0ff7843518d392fb1eee600b49189a23be876b58cf476e594dce0

SHA512
fed4622895415425f114eca5dfe1008649a18a433ffc13da3bf5d1042a9df613724331361563970eb7d8099633d4f3e6a3ffaa6da90234eb2e71d7fbd080d1fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e81e.TMP

Filesize
705B

MD5
d7d3b7062716fb08c45a8d7081854248

SHA1
292f63b3a751a1b5d7e6d031277b7f67a71023f8

SHA256
0123cd12f6f02ec5efafe32f7d608c26bd3c325ea4678fbfc2851dcc3e33d61c

SHA512
491799bf8adae07a55b22f92fd5f54014c263f6352f8370191051f8f8ce50e94af25c73070dfd8e41c08a39dc778ebbc833de3a556fb9697dd63e22b8110130f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa551105-44e8-4d8b-8da4-5166747a83c3.tmp

Filesize
5KB

MD5
8d9e56dc6d887f8df0f104f19a1e2b07

SHA1
1798d166c638ee985018973f9dfcad9a018dd79f

SHA256
35d4a6f49d11a2429b465dbd50cb14edcbaad21f0b0dbe14c5d5154bde817ca6

SHA512
2296cecdfa327f3ce392e505da53d7f0bc47fb9978919acf19b51866713ae9cf30d0e7c9adcad1b01ad837cc41de1c0481a9c17e87fc3f264810eba58c9142ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2924e8cf96b414e0968ee651b0f2131c

SHA1
54747b1741e14ac39d5170625c8fb16980fdd5f8

SHA256
70d8e2af4e252d883717656276592f2bcc86303a2e163d570c2db66cab489b75

SHA512
e3c8b151497d91acfd3f1d8c4b38c1e950afab3e1a65e07bf626a5a82a5a329e7252111fa52b1d31b0f1185c2418d79a43e18fac2cf809d8130a76974fe266e6

Download Submit