dd86a73696344fc26855583016eb6d72138e16134060c3527df120f73226b788

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ffcf9c4e48482dad2f5c99f74be6e5f3_JaffaCakes118.html
Size

57KB
MD5

ffcf9c4e48482dad2f5c99f74be6e5f3
SHA1

30ac7bc5d14429b993be55f35b5f19daccd65445
SHA256

dd86a73696344fc26855583016eb6d72138e16134060c3527df120f73226b788
SHA512

41856131537f6cac9b6d36a0ba4c8b90fbee63df38cc98cf35ef3203d28429791f60d7b2f8a8304b56d7f9508218fdcc81dfda80802ff25270a93a11898f00e2
SSDEEP

1536:ijEQvK8OPHdVARo2vgyHJv0owbd6zKD6CDK2RVrojqwpDK2RVy:ijnOPHdVP2vgyHJutDK2RVrojqwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
912	msedge.exe
912	msedge.exe
5216	identity_helper.exe
5216	identity_helper.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2144	912	msedge.exe	85
PID 912 wrote to memory of 2144	912	msedge.exe	85
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4108	912	msedge.exe	86
PID 912 wrote to memory of 4572	912	msedge.exe	87
PID 912 wrote to memory of 4572	912	msedge.exe	87
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88
PID 912 wrote to memory of 1832	912	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ffcf9c4e48482dad2f5c99f74be6e5f3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfd7746f8,0x7ffcfd774708,0x7ffcfd774718
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4674176031226165622,12397088717873248886,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
78061c8fbe841f3fb3660144019e9a53

SHA1
4378a4e66d52aa7ab86fae78e7b4a88042297f05

SHA256
d8752df2b98541b9a9cef3fb135bd7bc285bffa403183dbf07c08f519e69ac03

SHA512
e5b88b492fbf31f4183445342d3d6c5ad4bdc082e4a39438422f31c5114115040c53a7cb63f8943e1fd3ca964368f06697a67fa80e7abd508be9227abeacf740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
1d1566c830f6183c798f219d414b569d

SHA1
765d43e438bac33cb351f869a06e838eed2e6471

SHA256
c3c64c19f2c331378b1b3c1d26edfc633e167db99de72bd50713305b8014d045

SHA512
45e380530a539f94d7910fdb8ea7f11061a27c160799674e62327aec6d5f80db01c9ad963eac25d6c3e06c676cff1c22525c0b452825e692f1bc14890c5b1dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
933fb8dfe38caade354c47334ea9cd1e

SHA1
13fb97b7a5d0ec2f0e93b0e488bcee710aecaa27

SHA256
8e7171a2a29a7bb07d9693bdd52f1bad53c6d8e968891c1ecc9433e4a724584e

SHA512
e9e996535c5a19719128c956c193e0417d68a9c9ff92b151882e00e5cd6882e72b04a16fc54f9da338c3e1822c0d98a1f7cccd3fde967129cc597185125984f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7348cf9b3a4e470103d7553c1a161029

SHA1
a55e9faff04f41e3c3d8a44f0652b6333296f39c

SHA256
c306c36005a601f4583bbfcd32a037e16ce382f2766bc3284720bded8e37347a

SHA512
3db8f7072388368b4b9414cfc04c236534b3bb80c5af49062ed9ac8d0c74ed0631666462a15812d79da67ae7b28222784e1615dd04b643f2fa4781d7554223c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
719b3c32e70cf3464b21310b62548ef5

SHA1
39f2459ff55e8d0687e964b18087dca727ec8917

SHA256
9f8db098dd79e738dc67df437cdfcb67833deb1259a246a1b8e4313b654130d6

SHA512
0dc3efa563437c56e5991c1127d91ae743c6d3361bc956e0a9fe6aa44a9d58fb355b650299dfad70574d4b099663e5bb1a807e9c393677b478932a755d6d6006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57dca4.TMP

Filesize
48B

MD5
e42d48599cc60985bd9bba6908bb1c11

SHA1
969e3055cc6bc5a55e5e67c0a998e629102a3c2c

SHA256
f1aa2d0b122b109d9d7aac59dda9bcb3fed0815eda6edd003839f77aa22151c8

SHA512
ff09c88651ce67aa65b4d04e563c8001c481839b87b76b2a5b368900fbb3fb98a27358db172f9f267a1c6d25c5897297bb849d0ad7bb0f1879920ac3726d40d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
c227c7f97a3f803fdee24fc8f8184fa9

SHA1
40251f0b6be45f84f270d0d44d524ee3ac4c3fd0

SHA256
e367ac3bd4b5dc5427229d100f754ef751e02dd0a67c9c35c91f0777800c362f

SHA512
2b77907c68afcafcf4f638f939bd19c681675ae33036110c5609982b5257becb799831886f2f62388f5ade89e24e361b990f43650bcd722a426113616797d3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b19d.TMP

Filesize
7KB

MD5
709b3ef1632887eff82b2054b279b5e4

SHA1
f391c3af21e249fcbd18fff62a5e6f29415921f5

SHA256
969ca7ad79e5383c1c549a1f58574ca9a0ddac727936e70dab07b5d0b3b0f4bb

SHA512
505d4d3562113ae6f6918758bcea89bde2d079b2e5767af4a7fe2b5f5f8f1d6674ffda31e11a2fcdcd9501f8bc3a3bbda019326f4e1e5222b7e266f961ff11a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14df03068336ccd38d81dbcb48e948b2

SHA1
6ebfbe769c2fbdbccf517ad6dac554270c1b9eb0

SHA256
d33ca61290817558a31ce713091d3eaed71d285430a00888e20f9a5041b2fd24

SHA512
764c5322a8debc0aff231aab198d7ed3d4eca33979f22dac21114b65e6cc215ccbc3ae9a8e4a8a902d7b888123e4b17f952e04395cb5480ed62af1041534e3a7

Download Submit