11c1d8e73192c7e1b708646e9388163e69ac77afc4d12ddaa35801ab47b16230

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09530d4deb6745f2c7e1220d06b0cdaf_JaffaCakes118.html
Size

233KB
MD5

09530d4deb6745f2c7e1220d06b0cdaf
SHA1

771befaedab32350bccd02e289575fc7265e2f90
SHA256

11c1d8e73192c7e1b708646e9388163e69ac77afc4d12ddaa35801ab47b16230
SHA512

b081cc06638ba09fc832d555e48c523ab8d9c70472c63ff12ce65dfb88ca3dd5cb00107f1843611c71913dfd76e9c94aa5f670f5e8cd6d0e094998cda530dfdb
SSDEEP

3072:BwpUcjvG8rMdcXmNRS/RmpYryr7CLHI7PJZhpRkR8pDtwIbf6:BwzrXmNRpRkR8C

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
2828	msedge.exe
2828	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4840	2828	msedge.exe	81
PID 2828 wrote to memory of 4840	2828	msedge.exe	81
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 2420	2828	msedge.exe	82
PID 2828 wrote to memory of 3828	2828	msedge.exe	83
PID 2828 wrote to memory of 3828	2828	msedge.exe	83
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84
PID 2828 wrote to memory of 2008	2828	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\09530d4deb6745f2c7e1220d06b0cdaf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd944946f8,0x7ffd94494708,0x7ffd94494718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7792 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16807471756673924397,7597197376150409756,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
3b9fc9acb9a2b7e3731c97ca7dd9e8a8

SHA1
048f9546d783731109d020cc9482eb6b763ee694

SHA256
2c1c088051a523c1c04e98bde70e6f5d86060a50666751154a16dfe322666401

SHA512
27a498f57ebc321413cd41156c8aafb9e7be06c867977df06d5a8baf0dd2f1549368f753762a7f274f16c3422b70d1a01fc70410ed55553bba01c19ae6f0b19a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
de43fbf3831b2f5d9c7042dc00714eb4

SHA1
4b31c6ad872a25782fc0e970f449b348ec59c81d

SHA256
9655c19ced04e70a2a8a5c37bd4db95ae9eceee5cca76a10cb1a03c3029e91c2

SHA512
7c4a96fe43af6aabcd9fab70d1eb506f70d66959affd27b4eeb35a93efeb40d8916fddf8c8fc6d98be1a69210c6e24a36e84de918aa0d3e2fc2c2c28ec8a9434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a762ef5ca22983fb962ca15c763e5cde

SHA1
3410da687ed0f34ecc8dcb2bf342149110578ba0

SHA256
ccc2dda26dc38b26bc3c63f280d976b4b52cd97cd833cc80793a5ec12a4b8c7b

SHA512
17edca0af1d1256c49c9f634b5102d78f6d0f3b94639795bd18c72d9ebff92a324393af5c848ed64eee90b3815b41acd315fc018136545a908fcd4b97050d8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddf72c6f40ee4921b43c04ad960b98f9

SHA1
0991b7d61a3fa6e59db1401f450673126ac13f4f

SHA256
c1e55e1462183eef06dd791d32e5b186d002dc6f13ad50e37de28a3f2c926d8e

SHA512
30e4028aa3291c4bf979b2671031fdd4fe6f517e28c47bdf72a7949f5cf0914025542299d7ba862654188b954f8a2c5603f2f7421e024707d87f59259cfb9f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
803354c5dbe68360964eaf4c017a96ea

SHA1
b8feff08ffa016ec1a4c56669c914fe256a3b693

SHA256
8b494ccd7c46299a3fc5924238d1d3b92aa16d8721e237418347866843ad272a

SHA512
37491e3c9d8040ca62cae9594fb1fa20ff7701163b1ea142b4b1be9c2a959f69365779ff9b8b82a48dc675961bc259e1bdc5519f7e1dfa3807ca4c219e7ee418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
223822d12be67b2229380a441f8030d4

SHA1
6c68a5f6601b4e278420a730e501115d929c19e3

SHA256
e90420534345106ebb6618c4b9692c592151b860c1c61ce616e3e71c0124f724

SHA512
5a3abe7769955d842f8ae18f35827fa8844c78531726d57c074ff569e9939239e910bc3ec1a67674c7d53d084771652339deb9c20fff3fee26a2d7984078d4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3575e359119e3c94cdf6c415ae0b4db6

SHA1
3452a8bee9673aa20a5e9359a8331e5384169d52

SHA256
19f4cfd1f9a21a254641322be3b4446d64ce14bba42cb2c4f35a6f524bb6bac3

SHA512
ea8bdb03dd3ba35b3808a9d688cb72811ba93171dbf1251d23ff6d4a8164bf8dda5754186d3fb5bfc94ccfbd009c4c54305dd152f87b236f3dd9f1a89fc47cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2bf1af30dfbc8718d7570fb595225adf

SHA1
c3ed4aba4d938574db1c15bc2c4ab753f9f721a6

SHA256
41a6f8622a6b30a913f5c9e4be3ec074012ec1589adc9ea624af9d01d7d7b177

SHA512
bb8f57e9d41668b9a088b6b1f4acb071213ed0d9ab9f40d1e93879161fc66ce39197a2d2b2b45b48079f0861b08c4f6818a0e55368e7020718f3df9506508180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5808b5.TMP

Filesize
48B

MD5
28eacd107cc87fd9f61cbd18b91312ca

SHA1
9522a04828228321ec3e7e7bd2067bb34a05e9aa

SHA256
593143c091cc1103649bae17a5a182366d6c3fffc40096b31298d7b669a5e624

SHA512
ae5e969fb2041c88ac960f916f11bb52ed76d7a5e817337504d2a569cc4e70ee35fd43ad6ea8182387f921d6b3018c0029c2da0ced464a6112ec3fb04d7b02ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e2fede3b7bfeeac6fb024c98a23a6544

SHA1
b1a7ada57197cba882fd64ec5d5790cf2c8389d9

SHA256
7f007a83ab762ae17481e463528e6b5cb7a726ac027349fa3a2be2caece8a968

SHA512
acd1c1eafc448c51e011658668ece99f6abcb756c99a10f43b431f8711cb4666ba1c01dc28bf46690349d04a6b2caff2f14972209c90957179b4016bea59904c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b16e.TMP

Filesize
371B

MD5
c6f6edc7d7a717ecd3729ef14c33c1be

SHA1
4555b0f48bff11c3a8bf63b9007c6e4f7388d2f3

SHA256
273262b9062f8f2c4ce3305dfc5a846beade2e793cec193e6c3c9ba37454e3d0

SHA512
38df0297985919967b64f1269e180fb9e581811298ea5207a3f52156a4fcd4cb17d2eb5236b79e8ec98aaa00ada2f1f92435a4ee1fcf95add5fca59b2966a577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fb34c3ebc3171650b9b959d8d9a5ca0

SHA1
90fd10681c8e206c21724d864876034381730d44

SHA256
6d8534a2e92963a321cbbbab223ee8a945ab16d4cb98987e4dab90663d8be518

SHA512
c9300762c925cbe4aa7711ad51b125e0a2705699efabb5bdbee6e14d47bfacf5372a8842d2632356f24d7a322ff2fba8610cc26e428409a9afa1cefa2a9fd091

Download Submit