8820a2c1af9e40d195cf607d784bb82921a142fc2ecae0174797943054e142f7

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40d97b0a3e4f36f693041257a2e327a6_JaffaCakes118.html
Size

201KB
MD5

40d97b0a3e4f36f693041257a2e327a6
SHA1

a0c9dc85a31077b9a64c30d88f67b98ba4aa2ab9
SHA256

8820a2c1af9e40d195cf607d784bb82921a142fc2ecae0174797943054e142f7
SHA512

76c09d3c0c0cdd758991d652f0a8263a57bf9868b68d0821dbac2378a5fa4758dbead311f1c30c173cc921eb607cad9287a2978087b2732b80a8fa7d82d4b1b3
SSDEEP

3072:z/3GpBNnuglDJ96dxiTviqHxZ7/u5uQkykDXMdzEfgrOjrZZELsp/70LKc5w2UTe:L2pB0gNHBPb5OJ

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
65	sites.google.com
71	sites.google.com
72	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
4220	msedge.exe
4220	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1812	4220	msedge.exe	82
PID 4220 wrote to memory of 1812	4220	msedge.exe	82
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 1756	4220	msedge.exe	83
PID 4220 wrote to memory of 2148	4220	msedge.exe	84
PID 4220 wrote to memory of 2148	4220	msedge.exe	84
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85
PID 4220 wrote to memory of 3804	4220	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40d97b0a3e4f36f693041257a2e327a6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8030d46f8,0x7ff8030d4708,0x7ff8030d4718
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5475968183159924930,8565094673512657123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
32KB

MD5
21fa9f94e6db3dc9d82763e327051778

SHA1
474d7a655ce663bf5fb8c38bcd2e1858a02716da

SHA256
b2af0c5afbb5e3506142f095fcffa34cbdb966531c3ba26c90e6967768f15223

SHA512
f96574ec8edb333b194b3cfdbbc6c07f10202da9c8b5d1de928ee894b24f2bc33d3edce14b1e21e9e9cdce3b684e0dcd675e4bb2cbed9b0d5d2d25bc6b253ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
19KB

MD5
99914fee9faaf0da23228235e0e18605

SHA1
13d588c78b8a25c19b1e3618a2377329561bfcdb

SHA256
20d2d61e4f8fb6115e1568e5d5ec890f946b99f7c705cce27c8055c47449258d

SHA512
e6d03528fa50a6745f2f283f8ac49eb1d2bb6dc413e9b561527b9510b9511c83b2c1edf145ca4ca9fb8adf4307e5b22f32aec4a41e951ff08597a5a216164028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9545717e6d151d2_0

Filesize
212B

MD5
ba1c622b7425d3867f556bc7799f5105

SHA1
6e3d1612e9f512d7cc6168e6882e603b2d28b954

SHA256
053ed99910cda9dfd4f672197a51613057cba5d4cbccf57e86b6e7c7522a6da2

SHA512
dbfdd26495ccc698b91aefb3435ff9789848d04873c0b4439a66a5cfe0f74152923e2811abaf8bd470a400cd056563e4c1275851cd123d387cf9ed5cf39751e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
d2e52d409a002b258dff971c4cad087b

SHA1
14ed3cfc3450600f170dd00772b163fa3afd1609

SHA256
667f9f02b14ea445fc723a136a09cdc6ff4c23134ea4dc2968f00ba469d85642

SHA512
cf5a18be7ec0e0ab0e2f63a5861e44306d8c161a798ee8d04bb53415566bd93f62cbe3852860adaafe73efc5c5ee57ced3bc82b889cfd34bc406940e8f50efe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
ebd50ba9d180a132e3afc5ef1fb1151d

SHA1
67fc595a6632fb1d1363794df08939f459de6ada

SHA256
32d0e3f3dfe88738a1cbd5755698e58d69dcc41fb41fe456961643a21615e3b5

SHA512
10ce8307d55fc81f29b5263bab83436669abe60123cb9047f763d9368c77ff948ae8a8756ea60d108a24cd91f3d8ad71beef26ad6bc8c8968892152d9f26dc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
8aa55f3c4b004d465ed1ad81a6970fe1

SHA1
8721e7b6c3f622273673273f6b0da6b1273f9070

SHA256
042c9d128c955dd3d94c52901c5aa4017aebc3fdc1d3f7c065f47b6ace49d6fd

SHA512
8df9b741d0c3a38b0a6463a32fa453730ee1c888494b3aa080258455f698a89532064d9099145aa799c653d3d525d71da3f28ffaca80bec9902651e37ec74af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a713182fa448b81ec048fd2f0f328fe8

SHA1
2088b74692d3b11c05c6f36f10550caf8e5a14e1

SHA256
b93d551f6a16743c736f0a5deff5ddfd3aeaa88a4e77b2635e4c7a891adb7b0b

SHA512
78d2c96fbf1f1885d13adbf92ed4fe634c7892b951310cf1f2a9d42b7277027fd544cd53867999e000f1273d510fa1e5ae45c95efdf8957c5085830e556e1e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9d2b08134f4639e019313584dae93559

SHA1
b7531c1c36ef24572584f28d2925bf112983fb74

SHA256
54dd1d882eabfe20736fefd1e40687a87cac667d6336e639cf60d11b4045e265

SHA512
2f544e92980ac4964c1c8cbffcb13a75215a6b6a8e38073749ada1d9b80aeed9a6e587c3864dd2b261199baff09fc0427568a9cbd754d907a4c3e13128ca4bbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9327cc7ab8c45728899b75a579c21026

SHA1
3053c8d8128492316a4e25e8a51745a7817fc1f8

SHA256
b40b746b893eac75be5b0e84bfe7ca70416b0351b0da4a8f59a31b87d7cbe938

SHA512
084a5882db99e10174bd950667a83eda287a18391d9f1c8ed20eaff3cd4413c05a79c548140b69ef6f3f612ebec68fef91c7b254056884a3a46ff61a931e268c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
238b25353af23e3853bc42b499a0fc90

SHA1
4d5e6bf158cbf94a6e7d301f55368f9ff49618a1

SHA256
ab7114d03ca4f4dee10fef8864a2f8fa0ba303c07adfccbbdc666f72b9e81bf4

SHA512
3b60fb034bbf8b7f511d4ba1bba895298f509d4af1d98db3571f41b1a3c2d6c11ee58c7fd0bb9efceaac0bd6fda6a78604c00e85ca201e95a0d09cf4fa678ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
7302374451f3712cf6ab5d5441e326b7

SHA1
203fb894df96495cd1b0dbd5652fcdf0a1e526be

SHA256
d159fae57e8f778a5390ca4025ba69152d84b1856b198367b07b43f29b1cb1a3

SHA512
1558ee4f3fb0a83235a74e17d55b1e1f2d7a4da2873c214cf658df8257e71a14ea3768da16447a558a3d75530445c4981f4cbc2a47de9c9e42340b090b9e6e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d448.TMP

Filesize
371B

MD5
5d09b623eb49233e4b1fc17cde5b6ea6

SHA1
ca1893e23805993a2bbb7ca9de56cf4f688d8148

SHA256
fd447bc16589f4bfa386b0814487010325323ad9ad1353e762b48af32eeb4e7d

SHA512
f5d1f4138fdb6478a9dfa326bfc18cdff4e7cb5cf05f6ef6fb7af824f7b2648320858aaf836f982b37ffeab2d7678fb6042aa629eea9e3f2d0fdcfdf60b93dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
568b8b60c6bfda8c807e285b09246084

SHA1
132498bd2302ebdfdd74e5fba1223d8cfbca847b

SHA256
97aef1e96cf085fba2751644112a2f1d6f3fcd942a6995f53648547769f33f30

SHA512
daa6f27572ee14a9d90b0acc209d90d753cc8b41a14597c0aae0cee6659c474c0203c67be0e0d951b73937df48642346d47e340b5d205c23b47f58490b8e5abc

Download Submit