843057c506dc31889160d82db9c54c26d84c5f28e4c960d7b38e42cceaf24801

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d835050c5bd642443358ea6cd29220f_JaffaCakes118.html
Size

49KB
MD5

4d835050c5bd642443358ea6cd29220f
SHA1

2eabf2cf0fb833ddc53cd813324a6a1e2579f385
SHA256

843057c506dc31889160d82db9c54c26d84c5f28e4c960d7b38e42cceaf24801
SHA512

43ffe0483180107bf0aa9a0caba3550b14305a73edb542f9a2720cc24816bc323e3bc0689834d0991f1cabb86015046922282d092cbe85a1dd4940a6ce1e35d7
SSDEEP

1536:zXnTupBvHuZSzvEedxxzVduT0sVu0NY87aw:zX6pBvH+LsxxzVdC0sVu0NY87aw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1032	msedge.exe
1032	msedge.exe
5008	identity_helper.exe
5008	identity_helper.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 556	1032	msedge.exe	83
PID 1032 wrote to memory of 556	1032	msedge.exe	83
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 5068	1032	msedge.exe	84
PID 1032 wrote to memory of 1048	1032	msedge.exe	85
PID 1032 wrote to memory of 1048	1032	msedge.exe	85
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86
PID 1032 wrote to memory of 1016	1032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d835050c5bd642443358ea6cd29220f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc833d46f8,0x7ffc833d4708,0x7ffc833d4718
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5430632446473491405,7901441584523216856,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
45KB

MD5
94019c00785285cd78d6da8a1bdeaf80

SHA1
33ba11bbe8c91eca17a84c3dcae4667638a61b57

SHA256
2ea5a487d117c082ab04c8b2d979adc04c18f496af90ef2caf9910d9902ef8a9

SHA512
b58d23d9333290e203ee3191cbcca4686ae1f9b4c135ee8a8e0f014e7db4efdcffe6aa82b502b2d8e63bde705895a04726d799a4c6b0e22783b6925b4d297d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
4280262e173b4e51b382a30f64480944

SHA1
c9d92f6343803e2145cd4d39a99377571ef92a2e

SHA256
4ca321f4deff5cc2479b3a9fdbc0284a61ca4cead02314c17f42f4cf4d8b8a75

SHA512
1e33a8f5613fa2cc0c02b3623fdb1cda9c1dfa248c6e175a84f67f410fe6ad9e1e19e13c9eabc4e2097e57ca1a28c16624ceb054a443c16f8282fd9c5b153bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cd70d9cedc35b660d0545e7080d20cd7

SHA1
379aed622c4e9a27ece7db27963d7a60c836fd07

SHA256
c2592d3f27f034c212ca906a4ff27e7d5458cd23e45cff19597af5a48f740967

SHA512
f765542bb601d9b6b82bed2f80e0042008a6ccd60ff0b70d3f08db8dcaab8e13051783469ff9f7cf33d897ee05f2c81e2f17aeaf707a81de52fc29caa0f19354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8ed08f34c383a8a9ff289947aa2be1e

SHA1
df27364ab0ff7e94b04445381a0a4bad24baed9b

SHA256
9455c94466e49460f5fb1ac742ba52b9a13e06fba9504ac8acc2b5376c5c9139

SHA512
ec7267aca894d0b385ff6a5919eca68ff62105025a62aed97f44f3ce64939a1e3f3a288a4a8fc77f16892051d71c47994e0514977ff640fabc38693b075e3754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5cdcb8aefbd2d9f74b873a720e6af3e5

SHA1
3eeda7fe393fe5fe8089ce576fe908a67aa287a5

SHA256
ec4f23a378e721198526332e7bc2e4823e0cae4a4c64333423266e401c3b9266

SHA512
2f479c4a27b009ef15b9ada76a114f2dee7c7050ea236fd50ca897aea22ec684d9d4c51fa1efaa0a83d0832e552fc9b817282df79bce2af0b472b75851726172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0703fb3cb64863b0662a00030624459

SHA1
c6f1a51d45344316b8cbf8e8e6989b0a63794852

SHA256
7bfa9d7db29f849ae4c079c5b37b5170c7e024f0da2bcd2870a4fd200afe15dd

SHA512
10da135988f45c6f40bc705605093d0570f6ad27b22a62b7fab73f6d8a8bf5f790e26ace0b3dd0165fcf8d4b9aa5f8b8ff2eb794d65d7752adb938b3c1bfadf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2954bc6a0e08187435258610e05a09784d24c3f7\index.txt

Filesize
104B

MD5
fa5fb1fbd25bd009c806b91ec8c8afee

SHA1
4c572fc10f6f8e084ea95de01a00ce02df19b47b

SHA256
c903a1b936b25be6d52c5eb3b4a3dea31218512545b8908a4891ae1fbce63d6a

SHA512
994a240d0027974683a812e2844d2ccd2af1132843f2e88dde82655bb12fb7ed3988e325207a080d8aa4aeab2d7122e78e223b23bb5c6fd0b5da0bb37d046921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2954bc6a0e08187435258610e05a09784d24c3f7\index.txt

Filesize
97B

MD5
455495538e579d9247aca002ea415301

SHA1
2be680cd9798c31830316d13396854c15533db4f

SHA256
4795e1a6c36982cc9b8f8548c2206562fe38a2b25fa9634c54226af26a1deb86

SHA512
07e5e1f4e9671f09293184d496e80850b3c857c9131d03dd608f824df56340bea64cdfeece8aabeed3f7d16fb032a92c54a108d9e928f61203d8e6a310256b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ba485ef3099ca5ba7b558b185ae31195

SHA1
e935fdbb8a69e75e4dac0417ec6e8ac1b3f6e02b

SHA256
fe7c097186b7ba5b8b2bc9d0e095443544b69d4406a6c5061bff5c16a83712a2

SHA512
adbab065a202e6452aafb64c60f771f310a5b3935fa85ad6229e3f73362a6a53d90f1c0f373eb5dd5586d7b6f4494b09567a4753a55331e3993f089619756a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581e60.TMP

Filesize
48B

MD5
2c948a6fdbab0ec9e1fcd46f4dcee7e7

SHA1
237313d5d911a3a65a434a6ecc8263e1b47db003

SHA256
5a83719ccf6a21c6c3e1b953410668dd52abd53db65fc2f90f4c8168971ae971

SHA512
b40405d308cdf4c268002b9e470fbed54bb8bd771e71b733cea8ccc765643a9cda759f081fb85d28af68f9d225b661753ea8886cc553a1fdc9fb44fb52e9de0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3703b06cda3075e9a39fa69da9663fd

SHA1
b1baad1a64de5c98b1849afccb24b17daecd37b7

SHA256
799c70fc8b237defac26c633376627fc7f9a5ac11ad6d50417fd23806fc36661

SHA512
7bdd5de81e510ca29b7f28c257faaa350993305962bb64efa527f0d2989481fb5dbe2f360bea3d78242b95402dd7e83ce31b2d21bf90f4924095c9a2443ddf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ec0552de91e1f2606ed0a81a288e33f4

SHA1
b78bf9cc41118b9474b77f45593abab71e9695d2

SHA256
c2c6bce185a295b90f8fe2a735cee270714bbcfd008e67fb29879db349a11778

SHA512
59a26fbd7c5a59000102a887a5107f373490c7a85600e0cb353307015a20e9ec0722182294be2f86988f759b0324178a850617948fb825742e96c9661fdc95d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f741.TMP

Filesize
538B

MD5
2923b89add51079f229357f5ca498930

SHA1
d88b69a52d3342f7b6353543ad6a8c5f8df1419c

SHA256
e3baabbb549443262a1e46240ccb02a6009f60ad2efcff268d1af4def8bd89dc

SHA512
19f8b113d5892e535f5bc9f06d8c7cab16bdfe4383f22c306bd597b854e960be6fb7f1f8f70c29c89a1e153968f83c93552ffd75a33de039f230a003eaf01583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9900180b806e2c658fac37dcd5d428f6

SHA1
9579e4ab7a5b8bc1a6d665c052f28fd837f85505

SHA256
e19c1b3c5c3560aab10aa101d55b1878fa0e3b34d0c9e4b740fe615dbb5606c4

SHA512
be6e2f8b6f6e64171605bf2177a6f0c3c792243b47efe5c600d6dba0f6ef0c62f20ac407e6c85b1bfe2447a36bc63bfd8d935a274c7f699c06c1f89a37770f15

Download Submit