54253fc1316cbdd88fa7ba54f6cd7f3257260aa81a6e4148b4fb3bead943f95d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

63e3d7409b38e4e1b1701589d137d899_JaffaCakes118.html
Size

374KB
MD5

63e3d7409b38e4e1b1701589d137d899
SHA1

7f3909067158670ef722ba65fad39816a69ab7f8
SHA256

54253fc1316cbdd88fa7ba54f6cd7f3257260aa81a6e4148b4fb3bead943f95d
SHA512

fd308ac6f0700d05ee60d2d40625c96ed4d90ac55a93dbf26e01ea1e0af1601001c1a5645705651122a1da1dabf92eb35d30116c52d92ea9a72379e204106d68
SSDEEP

6144:iP8RPLpfze2x3XtKKp3tKK9KhK/K/tKKo3xKK9K+K9KtwBptKKL3+KK9K+uKdtKk:YSPlfa2x3XtKKp3tKK9KhK/K/tKKo3xV

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
13	sites.google.com
22	sites.google.com
23	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
2864	msedge.exe
2864	msedge.exe
4964	identity_helper.exe
4964	identity_helper.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2484	2864	msedge.exe	83
PID 2864 wrote to memory of 2484	2864	msedge.exe	83
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 1348	2864	msedge.exe	84
PID 2864 wrote to memory of 4320	2864	msedge.exe	85
PID 2864 wrote to memory of 4320	2864	msedge.exe	85
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86
PID 2864 wrote to memory of 4804	2864	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63e3d7409b38e4e1b1701589d137d899_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,10776876371788767365,2138667433936494369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
46KB

MD5
f0d81b309d4441d6dc22bdcb9e9e7d01

SHA1
77e7510fd01735991f8eb242a8a20acf5c7326d6

SHA256
90b890766ed0dfc173b119f625e4bde7785d509a76d27354148bf0a80a09889c

SHA512
79d3758017eb11ff478e0c258405aeb66eeef77b6041689708667948c85c1ff27688491eb8fd7efba3e5d392e299c055b3ae54fd212a0f5caaca3d91c425829e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
19KB

MD5
aaace359b85b7b4a2c7327dfb7beaa97

SHA1
582d8a59ced081f5fcda3e35721f8a3464927a74

SHA256
ed67895dc54bd5d6b94b889380288aa1bd1efbe14dd06ce4fa63794002994ee1

SHA512
68b908c77fb16a195cccfe531060ff7d5e0fa97bdb58ac860ea5d8c0f04e49ab3bf906839a971c4208360688153c9362e81054124f88d2dffb4101a065de1f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
32KB

MD5
2d59be438acc0826f9b6f0ed8c5475fc

SHA1
c248569b512be765b38baba61d60df21b55628cc

SHA256
8969d1c9a3cf687d3cfef6268f61a41443b244530b63f4fb2582a87959caa044

SHA512
75cb97e0b78d379fe8f8e96c90f898b26a72308507aa2c15caba0675609c03738e912c47145e8d6abb71f651b64f3d791046bfc1bcff56be5af35253b44d587c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9545717e6d151d2_0

Filesize
212B

MD5
531dee3024c54eb2850c92c4a8808656

SHA1
f43fd4c297868c477a16af80902086de6155c2bb

SHA256
88da9f2e6970af28e2681473b5e984b61be026e5b500bb433ff7faae2295cdea

SHA512
086f966d52b7ea7f8ec82480ee9d843c33d28596706a494474ae434f6406c729bc81a0ca21251ae0a97f1760d204e53f94169253afad704c66afb2ed3ab175c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
693c6f9354ee9ac848fdc62dcc0f2716

SHA1
cad745a99f2cce734e322eb13ba584ffa5e6e4ef

SHA256
e5f9d6e07da1a202989be35b8d6e8936f654111b9baa3b6929aa6d41a9a46614

SHA512
9e0ef39ebf43576e7c2bf9b3329fc6a1eb9608dde33cc17d365b6d6500bc909cf4f9fc640a53a31aa7b32a5e727468994e18a247837293609bd1a67ec734936c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
baa3a286861fc134c98ec99f5e4aa436

SHA1
d63741f3476ab82abac5bd0625db2a38e48691e7

SHA256
8b979c3b8490e6e31001c37b52dd1ca4d57ce0424bda4f1834ce7b8d54a4f4a5

SHA512
13b7d2a9fc925933c8eabebfe6b49f8d260ec53a1294a2381ef3b1861d5fab1131b9e56ea7a4f1285972073cb78c2b6b5b10df4b40fd9fc40f2b0ce4ef894c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
cac356d61d989409107c632ef7177752

SHA1
96aed5ebf019b5287811566ccffd7087df187a12

SHA256
9e2fb919b1d735333471663f032578397f80bd7ae23111fd05db0da98e7182b8

SHA512
8405191fdbcb64766b4651c83df196c132274fe3e589fbe024cbe8782a53a329bf619d7f486bb2963f15a5fbedc49a7e80463638cd09609d7d6132a082d64684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
732611a4fd0206cf021cf1c122753bb2

SHA1
4ec0041d90bf75ab7edabdc1a418793c64865984

SHA256
d777956cb72b68d371662ba82bcedfadcc55453497b6be8663412019947700f1

SHA512
9edf97d63d28e454aeabba1b18378d6c16338fefaf6a7414504bc60be07f2abbd5136862d600d50410f9da0e6bbbe5fc6dd29fa5faa6ca9802aab2eccdff69a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ea19886259ddcf646bbd222cd9bf13b

SHA1
16919cd3375dbac20102c258946ec18488c8b5dd

SHA256
aaec6557a310c74211ed34fd8d98ba79325a220adcd70f2ee0bf054491c96fac

SHA512
ee1eb5478814263d3c71bdb3e1681ceed76316df287be459b4d1eaad1591c522b1175072ee96bbe6c71ffb1aee15ac142abca3655916d6f7e6cbfef76f16d52a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cbec08fe87e43f638f6b654b80e196a0

SHA1
8f56f7624da844231311344149cba9a9c17e9fea

SHA256
ed7a55317e9ce1ea04984aad4e5323d43e976e703f9d449406ba083802249e68

SHA512
a22c6c496970ab968988fb17cb103fe0cae6f8995b66cf453881e6dd5688dd064797f23a6f5e51f38125999a12dab467366e629fccf4f51b2ab57600968c6d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d11fc0dbe8e1d16fe4e0088553431402

SHA1
153eae50411d2f6e2b3e35b226ae9dbfd2589db1

SHA256
9ddb6c3a7ebc57bab3e683ec255e1ed43fce6a5c086c1ad62bc71dd1e7e40089

SHA512
f1ee1dff96c1f79bff16023f865f3ae48e2e9f89f35356d1fbb2cfe5a97c7cdc27507b95565cbefca0831cac3f5c25a87774a9e8294cdc2d32503dccec065578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a9ea98b7b83692fe534135c198bfda3

SHA1
9481798620d0887045243f388f52a2a832af5889

SHA256
f6e5535bbffdade89f72d9b6da3400c7c09ff63052c33a8fd7e79f71344df538

SHA512
2a1bafaab28fd31d738e8bee3517a4a78ac9ef1ea08aa3c9554e4748f74c42a99c25f767517c44356a9f05c81ce3503edee2bd15977e2a534ba66b2f06fa1c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b9df414eebec509a3391cc2cde72597

SHA1
9fa171e517e814f27fdfb5a96b48f7e058790f24

SHA256
284415a5ab4398da7139b6eb3d68bbca1b3a06e0c033838894f2f841a3133beb

SHA512
bb2ce4b50b1df988fc8a5e432b3ebc1cfa26182ea144003efb163daf776aaf11b475980d625a6260e3d9f2e3be0080d912a75735bd021b5d0d010c6835e9299e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583e1d.TMP

Filesize
704B

MD5
3b4d34a2cf6eaa92170659e80f31dbfa

SHA1
b2d6d30aedc3651c24b2c5bd1c0532d785dc848f

SHA256
d878e70aa55416fc389fdd83f4ffe37497f42ac204840644d5b088c59925a4e5

SHA512
4b055b7eb791fba8f82f6d53c50c913d214a23427da135a05dfc60f4e6f7c01f71dd26a971edba2397ca9bb958b93195f4e6efd6174e85ba9f25f7a7efdd7d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6744045ccda03eb5e76ee332857a27c

SHA1
0da6470d05835c6f3e264bf91012cd97360a65b7

SHA256
221b63c156b33fdefef40008b32c31286339351b032d6a36008e91e12dfe0713

SHA512
5576194bdf164766c912b1a19cddad3d07c12d9eed1232b24ad9d48c6b22f68c8a59c7cac1e3cfaf52776f083f8a54be70a2866da60b3cfb01f8072d0d8eff70

Download Submit