a026654a851c0a985050e2010c31d8ab152a4fad4b034ab11029fef7b2cd2bd2

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61b95e47289cfd0514b4e06eb5cf1b42_JaffaCakes118.html
Size

52KB
MD5

61b95e47289cfd0514b4e06eb5cf1b42
SHA1

d0759b32c185a5387af6879a1aad7921f98445c8
SHA256

a026654a851c0a985050e2010c31d8ab152a4fad4b034ab11029fef7b2cd2bd2
SHA512

56d3cdb19f14bccc2eac5223e69907d8835935b3d7eba113d284d39ffc847aafeb89239f60cf28e30194a5524dd75f22ce83b967f88a43be8cc01bc6540008d0
SSDEEP

1536:m8TupB7YdfUVeruIORGyR17YtA2hiZ6lbX49crhDlDQo:wpB7uHruWtRxbXvrhDp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
1076	msedge.exe
1076	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4564	1076	msedge.exe	84
PID 1076 wrote to memory of 4564	1076	msedge.exe	84
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 932	1076	msedge.exe	85
PID 1076 wrote to memory of 748	1076	msedge.exe	86
PID 1076 wrote to memory of 748	1076	msedge.exe	86
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87
PID 1076 wrote to memory of 668	1076	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\61b95e47289cfd0514b4e06eb5cf1b42_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8ccfe46f8,0x7ff8ccfe4708,0x7ff8ccfe4718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1526503813242794356,7580726245152563294,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
21KB

MD5
05da0ba82e7797f5544acefcb87bf1b2

SHA1
42872e7c218983b293da9b8330c621cdbe1a6267

SHA256
12a685f5bde1a018f98b700782377d1640f7a1ce6a7f5da3900911ec382c787d

SHA512
7cb503efc6ce9b3c0aef5a3542c4a95e7d3bc16cdaec394905ebb8c79ca05c4b7317e668201a1db2b7ebee5d79d57ee28c5e1e3159c3b744f3309b19b84b6a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
45KB

MD5
e9d439802e86f4bd21b443d97de8689d

SHA1
43be680996fbf959b86f441f5575251b15bbad3e

SHA256
13d296d36b1cebae0065599048c3a1f181c6dc435d4af2dcbae6d9461ed839cf

SHA512
530f42ee9576c18d8865b5f81b8dca6bc1e657cdc73c3e45cd27588edc201a20a55712ff2c9e92b05e24edc02549ffcc06b3eef1315faa55a1cbecbfac434fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
665040b917be8bedc00ac34264bd30e5

SHA1
b6a190a538c860f0948e8c7158ff530cc49fe035

SHA256
dcb5a6e75690f69769899eabccb1cd05a16f40d900786436868e2d7c2daf3af8

SHA512
bd961f3afd456f1ee1a9585ed398290c9f7eefcd797992876eb33cc2accf443ad3e75120ebe5ce5d8b7c9648cfd8f28f451a0e2d8e053b7d09219fee53cdd33a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
de66d843cb0c0d0a715d79d55f0283d5

SHA1
411f65387946c4ff543f0ecfffc24a410666e6b2

SHA256
a88aee287a4ba5c3e1afbd8da8d39e4c9df31c1456b4835d7d3b09cace98d15e

SHA512
03bec14b9c0cd5aec4bedd9f07e8adfb30b2739203872979a40ac7c1b6b83b9e9cf4278eb8250e6a180f7a1638cda7decbf4b8119f19e52f825c24491fe93a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
18befec6236a42d8f41efff7eb157256

SHA1
97f0447f120cb73c92abf2b0fa3ef52165457e90

SHA256
f39668c7f377b82058339a9c2d98066c998258f1163761e3035054194d5872b7

SHA512
1e4c848c1afffc5ed671664fae09aad4725bf8491f5b0f4a7e3b24b4b3634b7693f7af8d717fb46b2b944690cc7393d4607957347ef6f8d411253029f53abc8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a27d269cab41b6952fe99f71cbfa91b9

SHA1
d5caff342aeaa2056e34e005def5a1f787f03dca

SHA256
a7bc74b58df364a8ab9033d6657d4543b016a62d326b855c3a9f66bb9e805d50

SHA512
e0dbec9d296da3f3cc757bf1233c9d552159fde9e2b8fc9ab4e6803557dc96e9a599e7751c521fbaa97dbcff3a2543cc14a7df832e772c836d41f95e6362ff73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2142ddf9f35d7fde7540cdfa576a24ed

SHA1
51fb05792236a5cdc29a6539c2e22e3f7dc95377

SHA256
1111547cb08520477723c37a87d5401cd554ec1d7fb86b7671aa45925f9a09c9

SHA512
46130bf7751511d732210761c3860245bde19da1e8f4a95582098a720a7e84e9b0316ba9e4879d98cba86230e4c6f03c1f91d7478d207da682c8d211250f1ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2954bc6a0e08187435258610e05a09784d24c3f7\index.txt

Filesize
104B

MD5
37369c818e73a89af85317c37597b9fa

SHA1
f837a594135227d35eb6df01219b1a92a7b36436

SHA256
77962e8e37d5e83c450ffd6330dea9f52e90000dc890979a0699d2f35cf6f20b

SHA512
a4dcbcddced953fc72ae29b0a3fc8036d15c059a3cbc27b6a27a036d735a1bc23eec51b59732f1f880c3b7f34f3d52be0d9a9c2f7ad39f443c7da0774cd66975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2954bc6a0e08187435258610e05a09784d24c3f7\index.txt

Filesize
97B

MD5
88ecaa6718827e6a223100288954d620

SHA1
0c57030917cb79e8471f92cb27bf42c77a92a506

SHA256
5aaa960aa4fd7774f513ae701949118a874df1f4d0393375bead4935a7bfb7a7

SHA512
627bf0b365f378028e496bc5a1c4c24102a0589b75f2d8c281a0d7fcab70b6063d9775fdfe2e0547cb29409d95a2df4226dc9e08a2b61f9ac62d4f66d45eb7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7143bfd19bbd503934b69fbf6933f555

SHA1
568f90f4abdbccd64db16b77c459780c6b620466

SHA256
9213f9e1276364058df1e2bd202fbcc95d71192b4aa0795fb3a2d6edaee124dc

SHA512
e1d7c3f42f55586c017326c6df0394a565411da7143fd9cad073acd0eb5d3614e8eaa78176aa92c77e8365feacb341d0e82d511ab44662451254cc5720079aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e697.TMP

Filesize
48B

MD5
f6256824abecffac10b0480b24daade2

SHA1
6a5eb892c4f042c341e7eeb10f2f7305f04a7b26

SHA256
cf926db6e3587e72dac8e4b03418dda62b2595fb4ea896a8da3dcff66901e435

SHA512
297859b3904b5a2b9944e188845f3bb88b2507b1f6f599cafeda403d28e8b90c2bfdba1a6e74d4521e80225fa2dc253a2285378f5f4c8926c51934d60dec614f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9c93652b9560b4035af0a2242d20d09

SHA1
1c21d13dfb34eac65c7df7b35c43872917c4207e

SHA256
0e949ee5ce7e99f6278b20b6d89c75696558be41750dce13ed44b2464dd84eea

SHA512
9673f00163559c40a60437f621b27b30c8f8dbb88c932302262679a069bc95e94a7e668a8c50af343c0fbd6fc7415384f176a072e80cf97bd2a3ee0a2755b3c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5858f8.TMP

Filesize
1KB

MD5
6105cc600b1c9b45995006adfbf5739b

SHA1
3c708ddda57d9f7e9674433e1881aebaae49bfd5

SHA256
57d2a916fcc4cab7aa2531720048c53a4fb577414fbaa5cf77eddf6f2a4b06d6

SHA512
4b178e612c6a08d2d6175c16e2b6a62ffc181a4ec35c9e461563ec6717b4b2a2c35f34c8b4c09a384f524793ae31e6450930540611e08bfd70e2d9360a7e1281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e4e77e9e80df893b9bf8ac2737e3961

SHA1
bd2ebe56ddb6942861bc34c1a68f365fab95335f

SHA256
6086d342d6d8288d1e78f83562605e231f82a65ebd24f4c67464ec0d2a027bb1

SHA512
ebd947c871bb08e290a6443eed5aa5b36b343d2e4c3c478f8db77dbdaa6c7d84a73d26ee531bbc82602aeaee8433201a4cd915701e07a30b5e7c2fa05aff9912

Download Submit