df34d32e75925cc1be392dee6f330eb1a6e5bbebffd0c0906a93e925e0885eef

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d80cc408291a4ab02d4ba5a233b4c0_JaffaCakes118.html
Size

265KB
MD5

62d80cc408291a4ab02d4ba5a233b4c0
SHA1

1fb998c3aacecbf8f7aa81fa6ed8a0f7861f43e7
SHA256

df34d32e75925cc1be392dee6f330eb1a6e5bbebffd0c0906a93e925e0885eef
SHA512

05f44f0284fd5a679f47bf618478766060bbad3e55477242b8f76cc41f4c519d42ed2ece8a08378e42da1655ac99997a3a8fba83c7e75457884e69e702b67ab3
SSDEEP

3072:TtBS2NCftfdCftECQUpRWXOXTXPXvXwX9bTxM:u2NCftfdCftECQUwE7f/G9bC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
1828	msedge.exe
1828	msedge.exe
1924	identity_helper.exe
1924	identity_helper.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3084	1828	msedge.exe	83
PID 1828 wrote to memory of 3084	1828	msedge.exe	83
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 2952	1828	msedge.exe	84
PID 1828 wrote to memory of 4760	1828	msedge.exe	85
PID 1828 wrote to memory of 4760	1828	msedge.exe	85
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86
PID 1828 wrote to memory of 1144	1828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\62d80cc408291a4ab02d4ba5a233b4c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9f2146f8,0x7fff9f214708,0x7fff9f214718
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,10337318110380601911,7994266058230013945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
46KB

MD5
f0d81b309d4441d6dc22bdcb9e9e7d01

SHA1
77e7510fd01735991f8eb242a8a20acf5c7326d6

SHA256
90b890766ed0dfc173b119f625e4bde7785d509a76d27354148bf0a80a09889c

SHA512
79d3758017eb11ff478e0c258405aeb66eeef77b6041689708667948c85c1ff27688491eb8fd7efba3e5d392e299c055b3ae54fd212a0f5caaca3d91c425829e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
aaace359b85b7b4a2c7327dfb7beaa97

SHA1
582d8a59ced081f5fcda3e35721f8a3464927a74

SHA256
ed67895dc54bd5d6b94b889380288aa1bd1efbe14dd06ce4fa63794002994ee1

SHA512
68b908c77fb16a195cccfe531060ff7d5e0fa97bdb58ac860ea5d8c0f04e49ab3bf906839a971c4208360688153c9362e81054124f88d2dffb4101a065de1f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
95KB

MD5
153d60394558c87594c259c5f60fca0f

SHA1
fbf6d8173b162b87def7a81b5beb4eef4113ec10

SHA256
c0ee0a1125398bc5952930082120228ca070aa5b386626d41e7e97998688db21

SHA512
a836663dc80c0f3b8686a2edcb77fc54187f2c7079afef65165a76fa4aa56e5484bc75a1c219901f141d9a8dff9f282f6cf52b4e63ab8773d2a0c82d846e0623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
32KB

MD5
2d59be438acc0826f9b6f0ed8c5475fc

SHA1
c248569b512be765b38baba61d60df21b55628cc

SHA256
8969d1c9a3cf687d3cfef6268f61a41443b244530b63f4fb2582a87959caa044

SHA512
75cb97e0b78d379fe8f8e96c90f898b26a72308507aa2c15caba0675609c03738e912c47145e8d6abb71f651b64f3d791046bfc1bcff56be5af35253b44d587c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\29b81f1dbaf30d94_0

Filesize
231B

MD5
e0f972ad19680b146b2b361d7cecf952

SHA1
3e15df1f5f24f5a82a251387a35b425018ee2804

SHA256
62fda5a4e7ffe346c6adb29b04baa4fa6f79bf08cb67663888dfaaa8b6dc789c

SHA512
62934e0bc52f168630c208864cc81d45db24ec842f84fb7795c9debcf619510dd260f60d97d983325d5b3031bfc5a2829a1a70fb2afdad59d7f43a35f4d3ebc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3185d909163ad2c1_0

Filesize
243B

MD5
b5d44bf8d648e84c7c50659785003992

SHA1
2b07adb09f8656765f429df2e2949512c935e297

SHA256
0587d8d938b5e8015c3c9fface8af7a221431c684f6e17702dda67ee1cff065b

SHA512
8968c00ac23861b5e90f9f5acfa2a41c936f1160154a2d4baf61725d5bc205da8e0005e5da71936b4eaa4bd950c28ba8483ddc44e01c80c22ab014db9cb4d880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\851d81283f6f5b25_0

Filesize
233B

MD5
dd4e0f1add83f5fa659d42e003348704

SHA1
bdb484624d1e05e13e70f81da9a83bdeb3abf5d2

SHA256
63632dbc6fc8610f1b2526e73b713c39c065ab167dd5129379ae3e0312201f36

SHA512
87bfa06749a526d01e7afcafb5524cbc4ae1ac1908c6c722db7b94fa762e1a7ebf087ed305b3c6d461882cc44cdf91dd7fd689a86f4c028111ff1b08accaa45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
b8203bdd6f3c726cab39a46e864410ad

SHA1
dbccbba9cf96c042f02a183bd47404761dd3122b

SHA256
191d2f3311ded9c000429897633c9803c13a64ca2a4617ffde5549366d933dcb

SHA512
daedda136bdab4b9ac260f752010dd13458fde7a72da628c841f348e3d639c69a501eb79d5e36b09da38a3540ce314b6c1088d5c2ba8a80a703b4c19b8feb91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
e2896dee8907d7bc5bccb76751844ad0

SHA1
6edd6b27fe685d1158e22ca3f91b794162b8efb2

SHA256
3b8059e899590c98c98e34cc6a29a926d1aa135f09b525e81b6497eb541995a4

SHA512
128390a6fa1ebe4f4ce96a1aa4b156d53d4c24cec8618eb31a4935dfa180fcf97b2fbf3b793970d73a2d78257b867903912ecb0b11d6b450ae2683d47baa5c27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
19cedecee2c9298249200d81eebc0735

SHA1
cc79fc5fdc302258ac7659bfcea1845c89488188

SHA256
bf023d12c7922ef945304854f707b050404faca23ad4e6a25fe9c2b3ea92ab7c

SHA512
bfaa7d1404226128b8b61ac595a4eb48842a1338b89b985857f11d77c3ead3a669ffe5112ac9c162862bd679af1ba48849cf08be817426a5d0f57ed37c294a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0ba5a0bd08828e5b1e86711f496a110

SHA1
ae783d3a405c060ade9a5abc58bf63e9bd574212

SHA256
092c8a7f2fbbc758b1698af6ad0e8dec4eae7509930bc318a7add9c2db5a3086

SHA512
1fc4357ddbd020a48efb241b0924f89d9c6e0f0cd3900f6135d31403d8db79b5e4bdda398b1069c87ebed5ae02e0ea6399cdec24a95bb72c6b62fe33446ee621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5bf8a1ba5aca37828a0d0b482a7ddc20

SHA1
5eefab4164bb5c9bf6487111bc42f325ef6169f4

SHA256
7239b754d0e1fd5bf33019f38b4ec48971730bd744ea96a4a24dbd67d57b1422

SHA512
40ff45b8257a497f823299c0b330572dfc99a0c1ca0e17acb8f78029e19d6cbb9f1704c4062328f12ef43d2d81acb018b91cee49dfa92ebf826b20882d649959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5e7c8ed141e70d301b831d9205ea9c3

SHA1
3b656f53909bd23a06ce135addeecc5697863500

SHA256
ccc4020c1c455a62029c77499be770cc3e480ab56b84e659ebe24c7e65c73ef2

SHA512
b9af418900daa5e8d981746627d7588f800beabb939b7c48d6a5c98b7e9cae11fe7aa8d3526e1a6313d791beedd60ffae0b1b927a69a1e101d869add5f692938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52b4098e6c1c3c818b9b6825588ea6a3

SHA1
54e349dc47d7a6d0725a9eded4fef449b7b12eae

SHA256
7cbb633b28854bb48634c25b659ae5ca19a613a49b4aa4b52e1d32ad35b74608

SHA512
42e9cbfc5dd0c48d3dc6cbeb7206fd26146def6878ae0c6ec4b86eaab8611bdc38bb2053d718419cae3c69994d8a33d4fd59f3f095fa134757708d86b575bacd

Download Submit