513725f2971b959c56b04b2c4869d05d49867fba05aa7ddb890359237fe0208d

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ed5ee8b39196867fa69c6587965a62a_JaffaCakes118.html
Size

88KB
MD5

1ed5ee8b39196867fa69c6587965a62a
SHA1

eca2ba6b431593397ad449d59be2dceb74eb2796
SHA256

513725f2971b959c56b04b2c4869d05d49867fba05aa7ddb890359237fe0208d
SHA512

3da00fe283725d591041e858356d8f1f4e50d8905ceacf1f1485d94ffcebf7d060a8eac2c644697b59e522f08aed5220d5bc27cb27e44244aee65dc0610e58e7
SSDEEP

1536:FET548Iqsvdf3/GMHCRWc0wHpNOldBJO6zXPvI/zqlNQjQ636YIuzq99ET1uUusF:FEd4Nk+c0wJNWBJ3TOzqlNQjQ636YIuN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
4848	msedge.exe
4848	msedge.exe
860	identity_helper.exe
860	identity_helper.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4176	4848	msedge.exe	84
PID 4848 wrote to memory of 4176	4848	msedge.exe	84
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 3652	4848	msedge.exe	85
PID 4848 wrote to memory of 1012	4848	msedge.exe	86
PID 4848 wrote to memory of 1012	4848	msedge.exe	86
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87
PID 4848 wrote to memory of 4780	4848	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ed5ee8b39196867fa69c6587965a62a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4e9246f8,0x7ffe4e924708,0x7ffe4e924718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12571771340720007033,12195469827885919758,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
7b3262e76a47dfe6c0f09cc782aac69f

SHA1
f515c7e242221d8c4fc031507217f9d08cda506f

SHA256
df00d92eeb126e5acb490f4b882054fc8a6ef2e4715aa64032454d47627cc619

SHA512
8724e694c3053474497abf3c639f28345937f59ed0e48e921046d9a03504e7dc990d3605f4843c5c3b1f18e4710482990d589555f98f8d52242e7254b22502c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
0f32a85a740576b72914c5bfc74d387e

SHA1
b1c1d606319c5035a1f7cfc55bef9b485cdd853e

SHA256
42303dacddcfddabe9ed1cf893400aa66f361ec070bf441822fa57f7d6cef0ad

SHA512
dbb60df823cf7c9da35966daebe5aa4256c826008c51a4e193bbe6c4b2f0b792ee0f0ca20869b5783a64c2891a48ab7b7591177dc6d0c1370e034abd956e6f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6055ae5267a5fef845cba194899adadb

SHA1
fe9191dccb8818b3b7d2d326f045ed9697f48b86

SHA256
646ec5d1583f2991923aaff270b4bc623b0f0e9906b4e9587a2d868199288f17

SHA512
e2afba2604dc0662ba80754f41bf43dc17ca7fd15c575ad95406561938f3cb324d2a2a1f31471deaeef45f7e49141246d6a154ee5476c029ad58af1a5ecbeb86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2e7126078faf8494dad0e4547eb8165d

SHA1
fe933fba74733a35feb90a81db35f136af231185

SHA256
e62d9615b9d050454dc432a5109b7f6efd3fbc88f3b1f1c75be9f122c0c943f3

SHA512
2636ee7b5b4e57865d9e35ef24431b5a0ca3337d85d08efef400aac20604ef0613e46a89b4d1b5aef581ade473ba170e3dfbce43d8550c1b9ce24ad7f3f72c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7e397ca81cfd3d17a07e8d0a575c4e67

SHA1
7769c1fd6ab35534ab4f06708a11d366294c90d3

SHA256
46ee2ab8bd3f95d9dfdda01507651821552e4d6d0d8421cf708f491914ae4e73

SHA512
333103b62f839aa48a150c7b632e40663a4c7c07818ffea34e324f637986cf43f850a967360c90cbce4c8f5be1fed828c38a371ee8b1db541bb366d1d9df192d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
851a51048f6b41792232a436cb669036

SHA1
25dc46fe2cf0d7941b71a17057d248632300271a

SHA256
860dc794383234590c85a84ea51be87c21a93f73f5f5394352f6cb1e10d8997f

SHA512
167d938181284646f3f2e635a6636967f0f0873d3d3131ab2eb52257b617b2f7611150dbcd03e95ca1ad3c0791303db30bb2d08dc5f6c793fe50c4e409a9b737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
baa5a82634bd60506a79bdfadf9a566a

SHA1
08269bbe3f1f3b774755096ceb7c1002d8e3a74a

SHA256
7ffc72a76791bd304f1cbcce4886de1fedca631d2b3152b22c51ece0095b6781

SHA512
25f1b49082e28a8a718d4a8121d6f5db264890a08c1af09cae163afb0be2f00e1a21ff96c831a10562bf6d8ea55b3e43ef6f01cdbf5c1816f13d1722cb6363da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
683cd9e6057513e5b6eb53fe6708b312

SHA1
ccf51465fed9abcab5d78945ab089643a09a74a7

SHA256
288b751cb476953b6dd9fb69878ad59832c425f11ed191b938a8eda6b2f9e3d3

SHA512
4776a0b4a23cb04cee664867ab22171915aa1adf6c22c81d59f1dacd21e005d1eed794dba1411c4751e78ffab1200cb685869d617041fe8bd78f9323b8e44177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
1e58db56fc0cdc4e17af9cbac816c6b2

SHA1
038ac9d3ae8731218604007bdf8c745579816f90

SHA256
173b4ad9d0925de6389289016900d8d95551809d35dc96b87add8fa5c294172b

SHA512
5df836d7dac00235afcfd8f2b4d8e7b5fe6417bba33d3fcb16434f176a114db395f33aeda3ffa2ce971b6f5ef2ac5fc1daacfc5e15aa79d4aae736b41221cf2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c0cf.TMP

Filesize
371B

MD5
fd7e0ed3988b7f630dbf1f2aac8faa3a

SHA1
0f7f17e4649877f0255fc1007b2987f1c80f5fb5

SHA256
e30fe475231202c5433d9fe01993a238688c0ca74aa7207b7e06b351b2ae0b58

SHA512
f5c8f4d9b9a1a0ec60f3f3a565adc9199c2c85dddd95f0457b13db7b8d73a5d95e5bde77c268d8e2465a08fb5f1103d32976f7aba1545026ffa4b0e4bf15634d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97206599fdb4aa4b447174d94c35f814

SHA1
99a30b050b93ec977513c2385dd04b9f58162f9f

SHA256
aaab83a4c53a8e020a3d865da62004b4188f8f5a1939c531e77e431a5fb9698e

SHA512
abf31411c02441556ac881988f804922f9542bb34f03fb862057bac3fb97f9451829d51f12faf1cdf23bce042de18b222345c75129e604ff062e92005984db65

Download Submit