b4f3d62f379521123c7f6ac0e088ec62d8435ec770a7bc0a1f6f8b34ecdf8b7b

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a5d1bd8a2212e6d1d3fdbba9de32478_JaffaCakes118.html
Size

64KB
MD5

6a5d1bd8a2212e6d1d3fdbba9de32478
SHA1

f6764a0de597a65111b80b72bff1d82826b50220
SHA256

b4f3d62f379521123c7f6ac0e088ec62d8435ec770a7bc0a1f6f8b34ecdf8b7b
SHA512

7cb52cec44b89044a0470349229c025dcfafd509f8da6fb1aff81e5541c6f861b41e84f114aad9680ad672ca8a358bdbaa3fe56942cad165a16280f21d6f4926
SSDEEP

1536:eBVs+PLpSFOjGVk0/s0jVBya657mnlqS0MowwmgzuuBeVUDDk1AHvJrUeFy:IslUjGVkas0jVBya61mP0MotmGwAHRrC

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	sites.google.com
28	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2900	msedge.exe
2900	msedge.exe
5808	identity_helper.exe
5808	identity_helper.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2400	2900	msedge.exe	83
PID 2900 wrote to memory of 2400	2900	msedge.exe	83
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 4204	2900	msedge.exe	84
PID 2900 wrote to memory of 2308	2900	msedge.exe	85
PID 2900 wrote to memory of 2308	2900	msedge.exe	85
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86
PID 2900 wrote to memory of 464	2900	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a5d1bd8a2212e6d1d3fdbba9de32478_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13404871392755058390,14696363298652576273,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
a32aac09d84905e164b5b732f4cbece9

SHA1
46dfd6cc32868308ba68524da3b8508169a4e25c

SHA256
b0407d70fe33d7da189d2ac9502befda0f773f49cc1c3a9f36c49a7defb8d320

SHA512
4aa52494b3889b13cd4b8e6c554adeb274a01f20fb6217e75ae739ebbb738a92d94e175966320c447e39209d0bca572e395ec3c9105428efe150d1751610c1bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
1eefbf1dca17d2654f92ee011deed247

SHA1
9b1428ce32a288fd4f8b2f8ebe9cfefc78d7418d

SHA256
285c1981e2aeda7963c0cf93db5ce3190ec1d9f2ab3d9b8f6168353a69b17434

SHA512
2b381bd8d614ac09ecb847ef1a74ca7cef87d56d5517af56cd5de200f082c21a010d4962920e549a0ef9f55f27036bf96f4f2b4764f27eeb87c4094a97c783f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
244dd7343b0f6448255271a2b7a4c70c

SHA1
0562169bf2773ce989e7338b4ddb3bc26b636aba

SHA256
3043e12794920e15f1fb205caf4021387da4346c37ea8f6ca42f2a8419bf5090

SHA512
02887810a4877b22cad2134a16182a7d01bc8fec71aa8c3efc7ccdd3a0d723e5db06f218f694d21ed2645cedeefe432cd5ed7089141391852aecf7e1250caaff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c376b1b07d32536f362e9deb6e4783a4

SHA1
59b69afeb917b21c2802c6c13ead2f05edd76346

SHA256
65fbbf3e9c5f340a4afa72c8fa1c453fccd9bb1753482f13e86bd61d57306900

SHA512
64378458b2588bd4309c19af380a82ebf9354694bdefaa8b9c69de790d48b0b9b7e27f028109bcc391f04c535288a3616066bf1213e7b0ce7373697b736a9fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84249ac59112dac7b4ea67e8f4675557

SHA1
7ee4c702fa00ab36b02f0215f5ddfb276f63082a

SHA256
f2e458dcc065597df4e1f18481b4bdd853b77d346061042b0712294805505096

SHA512
d6533ddfc695c96c3411f329866f5ef43045a811e4dabe373c317635748b279198ec83610ddae46113e6f33ce0fec42efd1a301821fffb248d97772aa97b4766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd49754a0fe4326f34608b156955fad6

SHA1
41be4dcabb7a396a236835c76c9cc19c91796f38

SHA256
263f1c2cd596c7d05ee86ed9744ae513f6dc8bd90a8200769c0e983899f93b8e

SHA512
6d5168f13e9388e1f015ca469aa6b1716358b8fb55357fbac6c631e2186881c8ce90f2e3f0b8128c319991e7b8d8a7e7165f7400f6ab6e5b1323fdc9aecfbbf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7ba2250ddd3a511e68db5f28fdcd7fb3

SHA1
29c60196c2cd47831cded2b1c8f68d7bb3d2f25b

SHA256
709c06007861161859a5fb26b6454fc7a803b9b1081f89d91f33bc0e917dad33

SHA512
0f89983f1e1a5945c6ae84351c1be13d2d9aae086f7fa1129462686c4f24dd12c68b67f7b090fcbb3c72a1a34b180452d8ec3311baef4ea8c603297af9469e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b6d4f7df6b60175e4dcd042cab8d5250

SHA1
204b1bc7d7ffbfa6c6c8a6843964fa76f6e3f471

SHA256
3c9e76a97f5d71e4945f38e4757d73eaaf872955a37e0f3fc25a8fc46edfc096

SHA512
db9cb58cfe1a7a1a144e74c6a33f6a3316c11e33612b23a478ee8afa460fd832ba00be24cf20bbb5ff1601d6a1f52f7c6e5f8d6266f0dda5b999b95ca8d9112f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87818af652b77b6641436583c53ae86f

SHA1
25b81c9b8973af81926a933f5c35b34a3de970ad

SHA256
307e276210c6bb7e32a5bfdfdff5f1c17d3087aaee445d71ef021f5fae1f72bd

SHA512
6dfcdd0b59a94363031a7e10ecf6567865ebee8e04592a4928b92218f89a1566623afaf4a8a527ed938bd70932da41c64aea597b74e251b1dcf903efec7cabfd

Download Submit