9bb9d194b3d878eccbb8a093e8425d10332526f96f09a1a2c53ca65a2c805545

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed3293b5ce4174752880f59b0ecde27_JaffaCakes118.html
Size

50KB
MD5

3ed3293b5ce4174752880f59b0ecde27
SHA1

fd5abcfbb0e5c2f690ea833e41c43ea9c5effc1f
SHA256

9bb9d194b3d878eccbb8a093e8425d10332526f96f09a1a2c53ca65a2c805545
SHA512

9d29034ce844c2d67c6c16f8e05d5791c91a96cb4e5b1ae76c65dae4d3a5c8120e77a30233b89b55d28ff78222bc14dbeca342011ab160d28a2640b0760168fe
SSDEEP

768:jBdfrlXgcrQ+EbxejK8bQpBA7eGaBjNgeqXQ1agv8XfKDIGYNxS/dT/vNj8/IGBP:jBAmj2pBA7eGaBjNgwC8YGNgPB8FVi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
3896	msedge.exe
3896	msedge.exe
636	identity_helper.exe
636	identity_helper.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3124	3896	msedge.exe	82
PID 3896 wrote to memory of 3124	3896	msedge.exe	82
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 3644	3896	msedge.exe	83
PID 3896 wrote to memory of 1836	3896	msedge.exe	84
PID 3896 wrote to memory of 1836	3896	msedge.exe	84
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85
PID 3896 wrote to memory of 3340	3896	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ed3293b5ce4174752880f59b0ecde27_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc284846f8,0x7ffc28484708,0x7ffc28484718
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5869206101153071499,14629954294451556797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
179KB

MD5
575e42a695a782c950bd57d1cd413c7e

SHA1
8549b65a7e35bd251ac277315a063c07ea288a2e

SHA256
c3f62bbfcc26082d78406d7f36866969da709db71ef269081374aee5a5b2cf21

SHA512
f73bdef4c31b07ecda8e2274bdcf20fc72a841537ae4058c57a01e1f56d527cba02349ce50ee7d1ebef2e9406fea4e023768ff22dc0ffabfd91530cab5fb1121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
8fffc45cf431ab7e5bb46e30fac6f61f

SHA1
63ca3b31b1a5551f4b71c8a86b0b5b50e2517532

SHA256
3edfc09f83e09b7a0b2abcae005b7c900976b98f443fba10ad2741f315ca8af6

SHA512
6ec986ddc50dba04fccee2ff2bf695ba9edfc6c5ca7ecb2af56e9a5b8a8fd6fdae14c3af12ece8ab74c56a77d06e1120f7a797354b198a12a24fbe7852b24ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
794f1818f63936b4969ed31c122b87c4

SHA1
e5d6fbcd4cc0784ff27101894bb1d203b65e8612

SHA256
382ea48fd1692bd08c39809b4412f8cba69972bcbf073853ad46fdb00965e5bb

SHA512
fc84b7be113b186275221742c237d1937f26e44d2a79fc9e064fef0568308893debb8b8c03df3a60cd4c896f0f8cdcd8ecd3b942cc117b8f2d1d519ffd4f4e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ffada57aa654031fba287e2859d9f58d

SHA1
4f695919b7848384c9e8456ba380c9be63cbe4ce

SHA256
d982a3f6663c255143c1b7d504357428315ce933c678f58d59b7a307e99430d1

SHA512
7bf86abe982fa339376819150b42d58b4d17ddaa4b3336ae933f10a34a910dc67a3087ebca40c9c13fb83288f7e41b15d7ebd3753d06ed8b90015810a402c882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1709a142b731bbfad8511cf9ae5b20d4

SHA1
3250121a2d60473ebc95970634bad47bd359e07a

SHA256
d2def603f53ff4dd5aeef668021b5ea0d72236e979bee54fbc6afae559736718

SHA512
43bebab8a99a2ffd601e297a794528d4b4e2fc7316d55e5784d0a80c1de7977adcfd0f75c574d95308c4d61065135cb3f5bee5535e68c9593433aba67157d529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5779c936e0dcdd91508a4d331d53a421

SHA1
b08f1b3471c1c8723fef907adc03afb8f28a7f8e

SHA256
3eae4e43b1fe5bf8867e59dc14f58b576ac72e4e4ceab44e2543ae08b1d01ce1

SHA512
32cba929cde8e3db3bf9a01203270d39520bdd0a9ef6fa11440918229ee67a64506ed74438154e23ed245fbc69f9604fecbcb868d411d157b3178a7de558dd0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
1dfc33339e133b5ca9a30dea398f6a43

SHA1
b26d0a6076ecb963783d56fec20b3bf27bab5949

SHA256
33fb0fc56f628bdc8938d56e43688e36e1db8276d7d5707448c340df606b14f2

SHA512
c34f05dae6b1ce57f6447699b9fb95456a6f9dfbabda1ba33cc18908fb3bef7e6c79e89ba923e1b0282a2b9588b2b1c928b47abff651c2b29d0eb33fcbe6e484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
35B

MD5
343859b4ad03856a60d076c8cd8f22c3

SHA1
7954a27de3329b4c5eefd4bdcb8450823881aad6

SHA256
8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

SHA512
58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05565c88fce741c1a6d31eb7dc3c3b35

SHA1
e60a1b5e2d47ee70f359237402c009e1d1b58d5f

SHA256
eb99852ef302ce34dc793512c021375414063d9ee7d595a045a43be2481be6bc

SHA512
72c4d15808e43e94e539320e868713429a56d10f33d93f4a55854ea68d82053de0e793918c7e661a5089a801a910c2905425d69f84bda6eec3acfe52d174ebae

Download Submit