31dc75333b1fb8bb3c6de6d77504745c47dde4639a0594d15001097c9f0fdc32

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5035d06a402415504b8fe873b2b3534b_JaffaCakes118.html
Size

97KB
MD5

5035d06a402415504b8fe873b2b3534b
SHA1

fa2a0483fc5abf0ca60f9796a13823c0c101012a
SHA256

31dc75333b1fb8bb3c6de6d77504745c47dde4639a0594d15001097c9f0fdc32
SHA512

dbf6732a6818cca591c2f006d8785f10d81dff974b1ac547ccb35c14d91457a45d03ec55a921e7c4d7fc46641681c4193fe344f0a246c70d3314306a20663748
SSDEEP

3072:qHW4NFyQrT3fY7RPGao5VWbdUlIZe3Kx/URyr03G1LaEYvbS:qHWV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
368	msedge.exe
368	msedge.exe
2232	identity_helper.exe
2232	identity_helper.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1628	368	msedge.exe	83
PID 368 wrote to memory of 1628	368	msedge.exe	83
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 4524	368	msedge.exe	84
PID 368 wrote to memory of 5012	368	msedge.exe	85
PID 368 wrote to memory of 5012	368	msedge.exe	85
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86
PID 368 wrote to memory of 2688	368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5035d06a402415504b8fe873b2b3534b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c446f8,0x7ff810c44708,0x7ff810c44718
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1420 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,3988692750390325465,4860352215549087174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
74d5e8df5551c500b15b97be0af06dea

SHA1
478fccb13b8580981fdf0918167298471360ae9b

SHA256
2219f8541bf41e9e52691b2a1b8d22482d206dde713538dc6bc7acb94f910edb

SHA512
283ab7a19c1ee7261e546c7535a164c07c10c91e3f96a84e077b2eea8f0efc3c8531ca7fbd1b860b20a9e64efcf51da3b2ce360e13f78bc04ae9a15d47bfc1b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
4cf95cda30f7ccbec30f260739e2aae7

SHA1
5e6be5b6c4c135d9af1823035684996cb6a4be2a

SHA256
8b2ae8bcf16b6524c34b4385428df42d4ad28db217d5756f04c1462129e52b36

SHA512
43280a6c0e2b72a779cab7cdb7ddf8136e0a484b39ea75c16e7fccb88b6528e5bd0a66bd8820813b8bebce8e73fff5622ff0bd7ecf7f488058dcea02cacb9c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
5f903a5342c6f944cbc3b37d3d53b707

SHA1
6f8f1a761e8bff3c943391b85332f871ee8faae7

SHA256
e47b476d7044eca038c25a8cd40f84d774fcd83b5f389ae394084310b49e0693

SHA512
2c85b3e49c6d8e43bbb697d1971875f1495670678c657453410a8c9ed6ae8cdd9ef7dc0ceb09462277a7c9b4711dc29b1998fca76cfdedcb3ec41505e9419274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3005f49493b541f0dd646bc291ee9f45

SHA1
a2da26c9588fd222606561ac7f48b40cc2a7ed33

SHA256
56982a1cedddcc1d07bb7077ffd63823afe74b92c7a978c69ffe0616a1b23776

SHA512
d2f77b7970a8a13a7a03cfe1a7a8099bd284739123e4aa4fe5dc358d5514c79a46a71a87fdf797bd2c1eacfff5e677d562dbeabecae9ed71b71ece01e3a55599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
40ca6499bf2c0b006a9b014775d345ca

SHA1
6a410a9f0ea518520f7324219a7e201f1e1e2985

SHA256
29e3917a0702fc3862db1989d675506e9d8b6bd5ce7a2454aad2c2413ff46848

SHA512
38e046625fa15ab4351bb75bd8936b04517a23d22d7855e783ebdbfd8c7935996c5fb0c02db4b6bf6c2ed1bb6f41a5d837cc8bab9ad773454a742f50a7dcf733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0eefeffdb933e423d75c4cdbc2b533bd

SHA1
3ee7f8d6d6fe7ad70d71448ab0bd843e3d8755a2

SHA256
a5c5173abbca92c9dfbfb1f689544e669abe35cd432c804fb2d43db8f3091b22

SHA512
8daa25602ba0117a1709f3968822cb43cbe43b94e34e750248e0105cd3fc58e32f62f8bd4de86aac0241bf66601c061bb0be32cf0d5334fabaaec87885b6be4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\957c98bda99ead403e965ebb553e712b25665454\index.txt

Filesize
83B

MD5
d5ec4a813b491d01744ee3edc7f33c24

SHA1
00e7971acedfe074ba1bd72f1b01e28e09d9e96f

SHA256
d6494d2f13a6445c219c7ff7e966e3c5fd96dc77ff062d939c664794a2482213

SHA512
e9b8fd7d656f8c7088a0455505580940bcb91841bc6f70ce331c29d19a4b4755ee425b6dae8f267f3e0c59d707f551929faad1d188e7826f52b0b5ceda810d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\957c98bda99ead403e965ebb553e712b25665454\index.txt~RFe57f54d.TMP

Filesize
90B

MD5
9756ae32be0cbb8d683e755178d1d9d9

SHA1
12b38be046217f7b8c7a6586d9444f4067671f93

SHA256
89245bef320e457a734a7f7310ceef0ebfb2a3f0ecfd53917d59a41e57a993fe

SHA512
5e229dfa844f5807cfbd957c0ff4f110fcd28d962509c5e591765cc0d6da78e9517f58b76912608d17c6c607f4b07c6f3b7ffdee0e99aa8d72300307987f53fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
266a20a0b390ca5d6935c5e05be9b4d2

SHA1
18d3be7f41f07621916498357b49c5569c35e700

SHA256
85c18270ce27fe3a0b78c04b0e2ccfa0a39f519d3c74a45c13f0854188f1382b

SHA512
976b840e9d0e73f18893ad428be502179d7921ae10f8ff5515690825633496d55cd6ff5a59f8c75ebfc1a0122daa27c1fd4d1d3865988228241ceca8614380f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f220.TMP

Filesize
48B

MD5
cde9c91694d9376b70df1b37518a512c

SHA1
fe2cb8468e745d8af52f44e5bfb8a28e09425b25

SHA256
7cddda930d48386fa2bdf3f0a30dabe088adc13225905ee4ca069230b8549351

SHA512
cd06487891c27e90826d65ad0efec7f5d484a209c66e0726b575dae154f849f43e3f3bc2f04dd9e2ca7797b4d84fa5c26d3de85d8c54e69f83833260a0f7dd68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63038d87acbedd290c324540d95edbdd

SHA1
78c3c21855b16f2c55a1394da3111cd07d5455bb

SHA256
5a56850d50d265c35434a7aa61a761e9ba6d3e172e3e1d2ce993445ce2449b86

SHA512
deeaba244bd3dc5d52b33f71a41794637477f0719fe328e48c4295c9ff2352d853587152d419c9bac41fe4df93a3c557fc433a4eb90f145ee8debaf7b1c8323c

Download Submit