4cb36d2895210f25661f2fe0188b40926533faeaec5e2fa5a3fc49989b34b5fd

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b90247c658ca0bcabe9ac050428db79_JaffaCakes118.html
Size

225KB
MD5

4b90247c658ca0bcabe9ac050428db79
SHA1

673635c3474d61101c269214ed61f0538ce281ee
SHA256

4cb36d2895210f25661f2fe0188b40926533faeaec5e2fa5a3fc49989b34b5fd
SHA512

47d21f03ecef288625fb8acb089bb750a78e5e81491656f8f9d67631f99d5e820c2caabbc58827ab5d3f80fc9be4af9203b3c8551270b2a897aea801104612a8
SSDEEP

3072:BwBUcjvG8rMdcXmNRS/RmpYrlaLBGIG3pRkR8pkvU:BwLrXmNRCRkR85

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
3112	msedge.exe
3112	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 3172	3112	msedge.exe	82
PID 3112 wrote to memory of 3172	3112	msedge.exe	82
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1140	3112	msedge.exe	83
PID 3112 wrote to memory of 1572	3112	msedge.exe	84
PID 3112 wrote to memory of 1572	3112	msedge.exe	84
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85
PID 3112 wrote to memory of 3640	3112	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b90247c658ca0bcabe9ac050428db79_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7824 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,4693782731711874971,17481066699255530927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
b741f0cca56b48e9dbbec0b042a62cd3

SHA1
b06f4fd8bd47cf166a7611860c55df9f175670cd

SHA256
88f74cbcd1bace8fd223fb08755ba924900ffca74e50f7c4f76a2410450d3560

SHA512
7bca4b433b2e337e19fd6621da781035d7c0bd0278021d64dc819c065087d9f45de10851dea2c78276702905cd2ccf4192e2c42cd597c95ab67809feadfa05bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d248870339cf9da82be7708ed5b8e3d5

SHA1
ecf580d209ace7648fbdf6146abebf2e6a8a4795

SHA256
ca1333281340a8ce9cb82b8d4114d8d48b89afdd66bc148e38388386d3e14ef1

SHA512
622406e19700820ea07ea2e86839b8cfe5100b86f298940bfa6ae80c279f61bf7b31fd4f341f3f487618df0d95c212e291b8e31e6508c0e12998e8279c72e37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6df98c3581f4720e33b845e51b1fdc50

SHA1
b4475aba4694ddfc0a5600d97244a776e4c53cf7

SHA256
c1eb5194d3e0fa3c19faf07616f619595d5a6abd079652a1ec82eec6087bd8bc

SHA512
62a30b0c963754cb99d3c23e1ad30cf01efbf02255e2b58954bc1175e632525a6eaadb743828debad4f55d78494021a7e8b3d927a2eddc43c359cca95761e540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d28f060e5455b0134500d0ca9ee8d7b

SHA1
0d2464e2efe46ed740afab62ddba45ade71eb35f

SHA256
eea38d6d6f7e7df954ee167e784a5d54c3d44d9ccb0f16f9d06644e048f287dc

SHA512
27bd8fed3afab64da09112cee5c82a5c00232263ed5fbb144ac6fa8192e973bdbfa1da017a71fdb7222d7f14cbed89b39a7bbb994e7b01ae34bc0b91ec6bccb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a52e2391e07d7943e85da316f049387a

SHA1
e672a75f14711d4d1798238bc10cc6c9f0efb36a

SHA256
74f8ae1bdacd16c60ad476e483c662c1c640597e1c81fd6bfc99e6495a19ae7c

SHA512
14605327fd9bee945a251ddbe281584a75fa9709a6057e7402781f88742948010751d2e5ab37184e84f690f33444e1ba6ab595c0d55307386e596284c4fab6b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
178545fa0766f9db0d648720a7a2d114

SHA1
5d05b263228b3b20eed48a52bc95e6e29b93cf49

SHA256
05d757f56c66a6f941d262fe52b53df2d8e2e70c2021d785d53c2779892e6c39

SHA512
87e5f84bca375792113dfdc8f7859040af7b4195eb6d0dad8d8416c753e02b1ee32c7af0688edcb8cc0b786f4a47709d04a88e75b8d81a82ca6f7cf258cc4f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eceff73b4d9f68fbea926c93678e384f

SHA1
14e2a971b9da03bd5d9caea762b6e3b983ef53c8

SHA256
b702894eb4e1e9c66dddf42630c9cab03006a6a2270a3e994536b5f07b26baf2

SHA512
62ab5546927080232e5e43629ab3420ea989c5aa129d46d9e793dfe304a37b2f49e89637eb40ddd18e8af38ded1ecc2652514722a5a849267409b8ba1783400f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c4ebad6e52c6492bca0d244450f3d313

SHA1
0ae7418312c974d0e483f57027b3f6df02d66dff

SHA256
3f2b8e0b01605a3d6d4fd51e2edc667e139d5149541f867a7deb3b226bf0b429

SHA512
eaaaec479029ade8e9e669da3ee3f909ca6a2dc6b9a39831bb1c702aafee775a9eb4cda6239dfe6e9a25a41ac8e45c29f3330e719b6e87766c2a0fa923fe6739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584adf.TMP

Filesize
48B

MD5
16d1f64c676b56650dfe920bf6b692fe

SHA1
22bbb89f0c25b4d7885d25fd5efb84f7b97d2445

SHA256
e18f9d3ae1a6f0e9425c1d7ba7c720ed18a2c26bd62734dff4bbcc738e70eb61

SHA512
b72bbe0fad4a4a18b50547b0a95e509a3a93c5d071620b3f9b88cbd6422c5aaab2359c4af8609eed09aaeb29d2958bd2a271c3c39ebbab8875f8eaf8f403a397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
600faaaa6c6110e9ed31e0b4aacbd66b

SHA1
8b5498db385d48959ac94679bc829ec335a397b6

SHA256
8c4a94ec640807d2ca83881b64a9239458b98623718e3c96dec55a428e80c356

SHA512
d8f4db036c8b4f39d535e28754bbfdba310a4e20a833053ac47f7e22a4ab82745a8de82754028ba0a88978fa7e5bd6f8139b6ad3dfcfd2325268aabb55f0aaef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d179.TMP

Filesize
371B

MD5
0da8eb13473d1f951a5a41a87d23ee55

SHA1
b0650fd117172119d84df4973361bde2e69779b1

SHA256
0b8ba5c6ff829e0febc251c2a7c75ada819c2a0ce3add4d7eaf9c374bdb1874d

SHA512
5ac4b30d5f73b44bbc6e5aa9c35d7743d877a18bb3cfb371c84d21b9d401202cd764ca0f1c414753342bcb5f26a6dee072da3aa4e1e1a283287814307d9584bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10ab75a87d532857b2a3a9804c02f1a4

SHA1
b1765011f84e128de96a904ee12c6141f24204cd

SHA256
f8257c5a8da4533d45e313c4a58607e29c8b06fcc446e76c3fde7a4155cd0519

SHA512
c4740a3fae6b05f6df8e0d67288200ee4562575b378c056d78f44e7c9aa49ba2dcbddc4c7a47e95177c2aef659b8cc58529e26eb0cef067d1b3f6d8364ba8370

Download Submit