24886e5f09ee5986207376063033e1f10aa40057717fc51ed906a9a652309246

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2960685012c205282fb4941fd02379b8_JaffaCakes118.html
Size

133KB
MD5

2960685012c205282fb4941fd02379b8
SHA1

a0cf8014420ac7f2687fee20d78805d700d621a2
SHA256

24886e5f09ee5986207376063033e1f10aa40057717fc51ed906a9a652309246
SHA512

c964a9f4802faf7792d1b4d7e2514241ea3a972d7082c435d2f5c2baffa304c614abe4c8245bd3b62b130409579856ba28ddfaa7b002e8c9b4f47628471e518e
SSDEEP

3072:x6BHWNhnrO0A3qIseX7a8DWQQc9zOcK5Bgs68x6SVDmirbOzvcChUCbdnP4H2XIX:x6BHWjrOXwe2A4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
1644	msedge.exe
1644	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1332	1644	msedge.exe	80
PID 1644 wrote to memory of 1332	1644	msedge.exe	80
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2984	1644	msedge.exe	82
PID 1644 wrote to memory of 2996	1644	msedge.exe	83
PID 1644 wrote to memory of 2996	1644	msedge.exe	83
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84
PID 1644 wrote to memory of 208	1644	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2960685012c205282fb4941fd02379b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98fab46f8,0x7ff98fab4708,0x7ff98fab4718
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12787189602446719580,8665715507747758861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1472 /prefetch:1
  2⤵
  PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
c4e80c0a70d580c11d598943f1e870fb

SHA1
5089c2409674814aa5c69e1602e60451ff92efda

SHA256
9fdfbfa12e8dd4ba2e5325a2281d5a9dfebce18d88aacf22dda8aad9638e9e60

SHA512
2bf9114b63a8cad4b0db83f16689b5e1757dde30f985093780d423146c61dc73d5d18becf6bb9044af2c892ff7569ee257fce81e28e1c938ed5dca9f2385b484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
ff481653f66cc86a4d62baa65eac02cb

SHA1
f1ca504cd7ac5093ac529876f606569bceb8ab43

SHA256
ce1cd4410bc8d70d3c19963e74acf72f3dfca7591cc86cd2f647f8c67eb1f12d

SHA512
7587d261aea840aaf73fb51aaa3c02e5483d58d5c427c2c856f3f734a6f2600dd94d2de4e888aab68120e061300c43be871daccda091020a540b5e7d582c92e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3d826b5b704b74084e7431dc139ac81

SHA1
a14e9f213113e203ee34881fa157b695d58bb791

SHA256
83254a21445af5c2dd846c6cc08cb151109bbb2f4615f4a7fb010bee2b0ebd05

SHA512
d9c183a8e4a094f6fa2852391c344d98749d782cab83315da1aa658a219fb0ab8f9739cc8d49ad154d8fb0fbd2d49b730306dbcc6e3273b5909ca36cd7a89cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e2b7700e888827990aa3bf6d3a5498d1

SHA1
f4610dbd815612e279887ae5f03b5ebd6daeff89

SHA256
3890b7145a73565325717f2b911e63121c453ded40872f67608cdc2118039411

SHA512
be8ccf0d1eb955e63d755eba3dfab408fe8ab96fedb43e548237ce229bf221fb63b5030f1b6f775a5845d2a5c695ee916cd2ab30df0e7857802822586456c2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2db47b24301e176096e30db68c08ac63

SHA1
d18f9a7485d259edda0cf2ba6ffa3a761d6e095c

SHA256
0ff26e6131b99f40352639bf18c8e60ba8f3efc7a002d86fa93abb7673636f9f

SHA512
b2f70d5009a2a1e34988a64395ab39f7e4c23b1e0803b1e5b5a5e162eb6e2928ec587c6c0b57fcc5e511e3710ce50cc0bf439aaf221cbb3dd175d4b81e989897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7817655aac8630ee601feb8504891843

SHA1
0d935550300b446607dd2c014912770596fb15e0

SHA256
a92a884bb2989f3a571f79dd39b176b2564e9a42f3308787fcecd984364a6cb3

SHA512
153393faa1ffafbc7da9e2652811525d46fa2230e98ab49a8269e8c5fca9eae7f0bede1f5c4818ccb47b415ebb057658dee613a94083db31002db5dad3a7babf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\957c98bda99ead403e965ebb553e712b25665454\index.txt

Filesize
83B

MD5
e9406d3ed82b11671ecc63e55be0ecdc

SHA1
cfa6e5d57cda301a8f496fbbc350e125147edbeb

SHA256
70eba697a1b521d8aaac70d5ef5943cba89fa6315df3921fa805298a3034a560

SHA512
2bc0b8abc3ae2fd990f9997ea57679565bef148b3071692f21ce71a00a5d2557acc2123e796b099dd335b8c28df82446cf6ea28e2772aaa24d4ccf60ae8d8d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\957c98bda99ead403e965ebb553e712b25665454\index.txt~RFe579f2e.TMP

Filesize
90B

MD5
c3e91aad213c619f719209eb3dbfff81

SHA1
6a2be3de6e7ea6256ce392093e68e0de99cea50d

SHA256
fb5fab87efdfe5a81a3462540c197a77d19cef3d0f69031b1dffce2788649f02

SHA512
cfba565bff60e66dd98454c2a2a6161755a0e6968e6c57bfb787d34374fca721c30906d6c79ef344cabfbb54d6de83a9ceb5d2da8c634e768246792d617f40ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
26d45323fc7aa9801a772ca9abfa91b9

SHA1
31d38e3cd5b489849b4a6f0564e4ed68c26d227c

SHA256
eeca2f0d183b813488aa62da69ecc2316ecb5294b88a8fa73559359cae8b9117

SHA512
b8f52fc6cee8bd8840743f6f51f4c47db95e7c9215e9c6a9ecf30529e5bfab9d8e048766029021713f163db5b3bbc3084783509b79e947da0c8fac674e66fe74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579ba4.TMP

Filesize
48B

MD5
64d5ad54c87fb4462451ed2de5fa2c97

SHA1
8d5ea3d5025b0eac79bff8e12ae704211bf60930

SHA256
5410bf25c8f0a6c7daee75f273f9e0ce2bf5e8e26106ba760aeea050e97c6a71

SHA512
fc704a9c303ae557a5be34b028091ed80330b97f2d4375347de0bb974397ed5efbeec65d402b6c1643c2324f355d29923137f56735764b46181bac7cbe015344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9413e2c85eedaf0bbfc8fc5caf29bd9

SHA1
158674bb4804c0f7de04b81d4bc010e5dad5dffc

SHA256
534ea8e6e59f32242ae4f0fd0c4edd30c5812a07be836d6a8fd90698a46c394d

SHA512
76e871394c7372a26117e1e0ab69df8ff5c85d283bdf1efb395e7b6070cc0eabf4066bff96ec05a1f6825a983cde7e574c9a46680b487e5b750ce5b8558a2f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c767.TMP

Filesize
1KB

MD5
273b982afe6d3649e4ba6de68d23c1af

SHA1
7e7b018a977e71809ea98f884cd81bfbd4822dcd

SHA256
66f3c30d7c63903c0c26d67f6dcd43c5949644a7447e36dac6959ebd5d5722ed

SHA512
882fed9d267d8b731015f5c68764802d233ece6e13b09ca8a5c4d4f534a5006fd36848123170367ba88a28983aba9951b774d487ed59635b38bbcb357872d47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1503b680b925d0380bf1738e307a61ee

SHA1
4af6ebae158c671c7e44ac44477747098f666523

SHA256
0a605f2f0b338c912e8c3aa8313b9545d445ca2f62eec449cd1fe6d509fe5c75

SHA512
c46e1525cefa14eef05c63ed2ddc164f7bad82647eeac5681834a47e4ea6e2a738c5d5b38594a01f591e50675d6881d36dd18872b165363f1653a44a209157fb

Download Submit