6499d7a2a4084af4516a03924426eda6e7cd209dbb1650a0eb623218d02508fd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e16b34d708f00ea0e9f5de847cd53e0_JaffaCakes118.html
Size

28KB
MD5

0e16b34d708f00ea0e9f5de847cd53e0
SHA1

fa43720448d046837c35ea2287e314c304ea21d6
SHA256

6499d7a2a4084af4516a03924426eda6e7cd209dbb1650a0eb623218d02508fd
SHA512

7381466c6787891d3e5114a1ed561d50b488262b6197d46952d3cab856db2d7f1b8b93a2316a05ee58f86bec20664d67f962db2ed47ecd2f62ff6126d3f91017
SSDEEP

384:wNY/Oeu/s28LcN6kUsQuIf/p4ZOgJPRK8X:IY/OeC0LlkUsQffx4ZhPnX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-877519540-908060166-1852957295-1000\{896A96A1-9FC2-4E37-9C09-84DEF593CAB7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
3704	msedge.exe
3704	msedge.exe
3772	msedge.exe
3756	msedge.exe
3756	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3248	3704	msedge.exe	83
PID 3704 wrote to memory of 3248	3704	msedge.exe	83
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 2748	3704	msedge.exe	84
PID 3704 wrote to memory of 1256	3704	msedge.exe	85
PID 3704 wrote to memory of 1256	3704	msedge.exe	85
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86
PID 3704 wrote to memory of 992	3704	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e16b34d708f00ea0e9f5de847cd53e0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a5b546f8,0x7ff8a5b54708,0x7ff8a5b54718
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5988810095262346198,11246475879533418861,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
78dfc9d0a165bdfacd7143e076c47710

SHA1
97fff5988e1bf56fb364cc0603f5c960e1c4bbad

SHA256
c5a2fad91819ba4529809a9caeb3408c709f3ad12eccb032ed69a53b2e420604

SHA512
a1f9288f0ab3de2af504fab305360aff4e45a244749e7a5ff294199a9213a424e183a634673694f9433084a20e81713f87ae63f657940ef35d817dc40db52bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
75517e47e9831000800c8e0cd3c183af

SHA1
cb1074d1fd9f53562a3d73bda33b36fcfc9dc2e2

SHA256
bc1d72c9732b524ce9ce891b3a633f60409d75200e89e8c2dcfed2afd3f3235b

SHA512
046084d75e0cbfeb6efe66427b1367d8a09e4d36d089f41b91aac22029c66583a8ed1791ba46ae6f1537a12adc810f102db30dbefa10b0d56be59c06c24f667d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
10cb2e01f0c7a4bffdb929053728d688

SHA1
a3fce82c28722027ffccde8ed15d700747be4916

SHA256
523e4f7782d7cd5a9e21341a8a2860eb08dc037ee24baa1680456e84c008de0b

SHA512
f4ae926bfe3812e58098f4d8356f7922507ed59f47caaeaf0e2107ac282e1ec3688ef4dc5aec5977f5ee3d1fc081abfd6967126878c7077eccf06391784b2e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
11314fd6dbf0e7e906bf401e8a6274b7

SHA1
8daa742c23f9336bc3796812accfefb4f299f94a

SHA256
d01f957696e174d034fecd9ff4fde96b8be77ffbb25bf98ee15bc8a529b61391

SHA512
e8bba66c1fc400af7e2d95497506c91f49b6f537bd8fba31fa089c7121d53b5941bd715a43848f9be6d708110a68f3336ef99d4f3026420fa02ca3b94f39674f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e59864c49af61492e18d9f477468a4a9

SHA1
2a51f2f915eaa71f484f65e8a13f40b72ba0c291

SHA256
e2ead2f0248c8e74abd5c2402346ffe307d4adbf1850f2924ff2517bb08aa924

SHA512
1973a0ba7f62e5f89b7fa73c85b75c16fae7d81d5970e5a08eff962e44eee9902e9fb4b97da0a1456fea3b6ae75e46cfa323a94f0aa517235474b8e3ddf2579a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bf0fcad1e4752785f777293a5e75756

SHA1
f88e6971379b493bbd58c3e49598282e934d2bfc

SHA256
a277988f6302f2db888be4b11435ea6e760c83ce3c5914f0f1d282d8792bf21b

SHA512
3c013a2a1cc8d6b8d460ffeda257894937910fc48e47262d2f6411ab092dd2a5e583fcc0f1979465b25c1bc4f68254aeb3e86482bfca19842cb793a80c25f075

Download Submit