3dd7c64bca6d701776cbcf1a862c9bf895858c3177245a9390135387730f5bed

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

380e75d5ecf3e1316e841c3e39dcdab4_JaffaCakes118.html
Size

29KB
MD5

380e75d5ecf3e1316e841c3e39dcdab4
SHA1

93220f012b32b83681ab7113f988a04b27963954
SHA256

3dd7c64bca6d701776cbcf1a862c9bf895858c3177245a9390135387730f5bed
SHA512

5ca00728ea714723840ddd2073e41821a3fb66ae43ab9b34e0b20588030e6ada7b0b751d34f9a41d9c71ab88a3d77f4d72632810754d5abc91c795ad5468b818
SSDEEP

384:OcLqpdUh7sNJr24V+Uc/ZrOmYZrDYlrlYxgXH5ZULYOYYIXHxWZUu9Ploy1VlzQh:FLdANJq4V+UcBrWDSDYlogLo/PW1yqdq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{C4E042FB-BCC2-448D-834C-E99E73A913D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
4604	msedge.exe
4604	msedge.exe
2812	msedge.exe
2812	msedge.exe
1556	identity_helper.exe
1556	identity_helper.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3788	4604	msedge.exe	83
PID 4604 wrote to memory of 3788	4604	msedge.exe	83
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 4560	4604	msedge.exe	85
PID 4604 wrote to memory of 2820	4604	msedge.exe	86
PID 4604 wrote to memory of 2820	4604	msedge.exe	86
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87
PID 4604 wrote to memory of 4160	4604	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\380e75d5ecf3e1316e841c3e39dcdab4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff67f946f8,0x7fff67f94708,0x7fff67f94718
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2983409682902147515,11478447111991279413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
85KB

MD5
008d0ae10f41631bb124d78799baf5bb

SHA1
cd5956db2574b3e718d8e87f3e4af79e2a3b5e0b

SHA256
a0aee1664677fce87357ff299c236f12803be313c1838a312d779ccf1ce0e590

SHA512
e4c1c5a8d88b6e0caa60b3c6ce02c05b0b2653c478a788d9d6c330d34439a5f91acecd67dc6baa4f40cf8f4cf21a684a13162562df8e2406cd06ac3145c6216e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
95abfb812b34c1e273582590b4c4f345

SHA1
708a47901b4e7423d24fea5be5a0cfc289956604

SHA256
0fa7aef9e4302cc305a9f555a44f7e1fe44a136b797933abfe529b60333bb1c5

SHA512
40075b9e63aa0f5eef1b9144dd8fa39f8eccecff241cb11d00f8b1c37b39d03636e48f78a89d53e4f6c63b6c3b102970904f2650011db081f91873e6c72c7605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
56686e87af81517bb1c2feb46d1de856

SHA1
d8e7019c07973de2e2cfe635975b1d49271b796e

SHA256
df7e1136ef1890b17c0c7f9645dbf7ea9e40ef1dbec4c62962f0b0f1f03c4012

SHA512
0c516fe4e59f863c0f986aa77732d7fa5529dbed5b1a8ffc4c9049dbba0848ffbb513fd8b116d4fa4f215c976e18209cc467ece70430f8b054c8e9934a369987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be0c71d884891c0040c5ad67e08ed1d5

SHA1
69d654aea5adeac9fb4176f23bce9f12595c20d5

SHA256
90248d0438893a970a34dec0ae1ea41154312badaca8f294f4be1a1886a8ec2f

SHA512
9f3397488c04ddf0c051486aa1814e1926b4ab8f3b76f80a51585a7b8075dab5b6a2fb3418f3504ee5920887d26ff47401dca9a0d737df640d4073c0defdee9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31a4c223461704008ee2d701da8fb173

SHA1
e0867d08a3bf8425e94c9fffab81459f3264ec93

SHA256
b26a24f922e044ca5a39b372fcb73d4ccbd54f7c48fcd1ebe9b23862ae3a38c0

SHA512
db0ee987e36a517a2a4e61f0f675cdaba9b4a656595ccb69885362304e77f0a8740c5e52f77fbd6cb7b9e0b81539a9724477f88eeb1cfbf8cbfa1476b9dc2213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e5593d1b2ca64a01e3bff7184312f229

SHA1
ecc542dd95cb80c47624f290966d946aa15ecfb0

SHA256
5502988f4ea4b668e1b92f4683d0a9a31293c56124e48d034e986988a18a05d8

SHA512
53f95b44633591bb402472424e9ff4a09917986be8de3e6383378c2ce1edde038aefe5785953efc8cc37c430fe00dcfce059fa098d8a8ae287ff7f4cdc09efe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
83342224db35d75b196d3c399299aef8

SHA1
b9889520a6dbb041cda8658c204dc4ed664b96c5

SHA256
d83c75883d6e784f2cc3fb609bb9df09dec87c71098c4ab3ceaa9f60883d38da

SHA512
2e7a2c39aff13c29c933f2de3ec04df3868e1b9ed60293437cbf71161a3def847835ae95d4b401e4d7e4721588f5f88b19b12d8df8ee8f33d92dce5a87b44576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583757.TMP

Filesize
48B

MD5
af8094e81affc4cc84f1f5f942897234

SHA1
402d47f0114df863c32d0b1063ed5301a02ca454

SHA256
a7e24f942fbe81ddc68804e859e9f71f19c08657032cb989611accfd3b7a22f0

SHA512
3de5f4ff9028d1abbcf41996936ed9ab4b9617cc4303e4ba4e64aa2554a8d8942c665c2a90ac0c383a34dd7fdb9307504897ddb00a69bc3ade5d93d1cb462b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f35706aba7e82092b988dc86dee3a0c4

SHA1
3ea9621e13a8929fcde2d590c731c4e1ef8ee03d

SHA256
6a119c44d6b0e5da2eabf85b85655e1c1b26dba9389688d73a70f2cdf9dba4c0

SHA512
83ab0610a4a512add10fa59b185b2d514ff4f741f395a3fab43f2789ac6a6d9ef0184040a306151f085a03b574aa95484357f942903a68017bf43b1e453e6c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58122b.TMP

Filesize
2KB

MD5
f5157409ae0547464e6087c6a10dc7ae

SHA1
46420b80fa265ad7f802dd949b8e0e863ff84bb7

SHA256
f16eab94f196397dbf5b9d639b2d96b6d10eeb7e0dde7487d00fa3e371d23943

SHA512
bac53cd00f3b4503aa105259d3cb5f2e58c4ced2e431edd80bde67f9e4e3d941a60da5da516b1bf316b74e31ede2fe602be720a7dcb64fe0b61567dfd75309fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b759ccd0b5c84ff3b8a1f95d08adf55

SHA1
24b9bf0c41d9f4e1e0a11c772330abeb762ffeb9

SHA256
57aa96d10928ede7da0521938d94d98a4c6f62cc6497595a341d2d35f4d4ccbe

SHA512
6dcbb378f3e452c550127fefb27d253901a4ac2edb32ad6cd23c854146db8f45c754dbeb4743b46d3fb63e9283c5fde100db6f2c82b9fe93b883eba567a2e672

Download Submit