c989d9c689f319b236aebe2627b03917f9677d0de49dd81f5d328bdfc6f75e0f

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756be6085041102c3c7f20097a0b4500_JaffaCakes118.html
Size

85KB
MD5

756be6085041102c3c7f20097a0b4500
SHA1

73da4f9e3cd1c68085bc3d6d680f2011ce7f0906
SHA256

c989d9c689f319b236aebe2627b03917f9677d0de49dd81f5d328bdfc6f75e0f
SHA512

488662c85c2979d8c1b3e7aa2dd56cf78173ccc7ee69f77965910c289e0123f7a04e098108655b3ef7cafab40b75afd1c4f19efd48f747c25c7806c93fa27514
SSDEEP

1536:eNScdqYrO9U61X70VtME1KuiCvWPEuDt9S:4T8EuU6t0VtME1KYcDt9S

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
2692	msedge.exe
2692	msedge.exe
1628	identity_helper.exe
1628	identity_helper.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2672	2692	msedge.exe	82
PID 2692 wrote to memory of 2672	2692	msedge.exe	82
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1524	2692	msedge.exe	83
PID 2692 wrote to memory of 1728	2692	msedge.exe	84
PID 2692 wrote to memory of 1728	2692	msedge.exe	84
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85
PID 2692 wrote to memory of 1528	2692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\756be6085041102c3c7f20097a0b4500_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16370921940455914337,15378174738922549356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
c63e137b3ccd177026cd76bf33712ba9

SHA1
ca36367dd4481da977b2b578a8a3445d314e2680

SHA256
3fe71f18f54dc105dddddaa7aa3e8924900b164f3593c6efa533aae50f2ab464

SHA512
81788eca747ba845aa9c2a216c0e67553256ad0535e393001bb1629b27617c32e7bd145478d621c7b47284b5df59231226f846ae6899332e8d9dc301b65a53a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
b76893a805133ca29830760a559cf5bc

SHA1
c3882a730b364766c1f5a6e7ee2d78f50fe2f42f

SHA256
ebabf3c8e2107297beffd1a867870cf084f53af6518b095edc77b08340bfe73c

SHA512
295ac252d4b59c4b986b63db75c938fb6faf623ce9a19a10715b0ab02a8cf52e1e8a26454babba63c2877a759fd6f2432d391cccf99f42d199f0fee90decd8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
3b51053aca2a8f6ee3e3d88523b3b316

SHA1
fa5c8c1f7d2608df7307730bb570fc67a01f3633

SHA256
7eb00b6895babe935a5dac0b53bafe39434faf6d99000bf54d0d73647143405d

SHA512
c040fcfe081f3f6ad1d8b140e35052c8d6b9a4bb92d4875a5505448079f1c1100441df04cc100ba632f2e90c4d9c688e6313eb9b5cca3a50c46d051c931112c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
dcafea13e8c612bf340b2c2157b0009d

SHA1
e26915e88480cc6cff388c2c06450f36904b4809

SHA256
d60e0de28d6c8cee444d7181e8ac013e31ba44a38f70d696b99ed1757444900d

SHA512
082714ab844615215b3ebd77fa6207c6e01a669509a17e540c3f9a33eb677fa834d0f4db65b10d87251bf818fb5042dfe78b8b7770ffae23c70a34ea2fe44b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d19348b4ee9b45717e3b418302f6af6f

SHA1
514a4b34292fa017f2b9097b095e55dffbce6afc

SHA256
7daaa88ededd9e05e9d9eb703d281b07be236a776ddf5117f0667830ef009bc2

SHA512
3939ce6951b46e937474a9ee00f8a7f661ec47d38bfa126965453b6472623464d0196eca5145a5be79ac2cfd38cb787600171ef6ddf09fac7974e652595b6e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
614f4ba37f4786b267f455e46bcd94e6

SHA1
b80eb8c63c206f5da93f04c5ab9417d5ffd412f4

SHA256
dd84ff123773a1c5b6a5b4281146c753792eb83d02b228af8f4b83fc671d2181

SHA512
a7ae170d20173bb32e72b3e8462956fcc8e1d4400e1eddcb89bcff20a6fcf5a23f247f5fbf78e4f29802162a9f6d77a9137181c2bea7330933d3134d407faac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b1958aa6b1c35dc950ddedbd5a134c5d

SHA1
22db82fceeaa0a07084dfc7420de7b5ad78c2747

SHA256
3e093a823ca80747ad9d63dbaa4b9eba791b9dcb2fe884dab2b28ec0489af656

SHA512
f8aff67853a799c00f7c6745452bd22f2819ee3b7832661fd593a513f03b350654d7eb60a03d7e5d0f48fc388a04fb60fcfb2b71ba5c2f6afd6e4e79dcf0d0b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
437a85183864265be3315bd88465d93d

SHA1
ce55ee9b3ab06642a3fc41a85faca456fdc01959

SHA256
dbb7474b3e39285de17dbaf7e7ffd32c7de99030d35921fda2098880f39ab1d2

SHA512
dafdf1b52b1bf5144f8254e2a2acd97831f6db7d8450ccd396cad51618d03cfbbb9daa218821e5ad14bb7f1d77c20c2a1186133608b0e7d9f1e513cb6d4851f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4981782081a4fe643b4608fdd0e7bbc8

SHA1
7218c155898ff273f57503d97a017ab5c4646b2e

SHA256
b762d25c25004753b3003376fed5b2caf3c03e458a97791f1448536c6919bbaf

SHA512
afd13d78b7c9c7534f8618072108979ed16bf269abf9a59182dc731ac6252e174966e75461d119c5d62704a89b714cf9751c93f9124523707cf220be3618b6e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9f72913eab47ea6587bc83c3c2f3b032

SHA1
dc50fa918e02962211e58ecc20ff6769f0a8062a

SHA256
613a69e3c2c0fedfc848f6a150ac84fdda2bc242f9a8c0fb495359c459fe3b64

SHA512
feb4574a41a0795c922f60a57e73cf7a3d1301b4f2a19e4673d97291d943bb6818fd78464209b5e3becfe2eeecfef6832b85097e514d753dc7c4d23b25ddd13d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
109be0c3de050bc3d46a1495dd2d5ffa

SHA1
dab82c79ba2507578e1f0152cea96b7f1083110f

SHA256
786ad32407ba429dd47ac2fb02b709b2c3f60dd5fdf6385a0f0a3aa10307377a

SHA512
12b1ab2acca772d76b4ec177f5bd6afd1cd4d053af5f632ede2342776f88706316a9b4818d3c9f9a5f0b729d5404826421f6fb00875bcec6754c5b2045c694a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
947e40cc12e5e21df16f2e86fe2c39bf

SHA1
da937612c08fbaa4f9b417296da1d37f97fbf042

SHA256
421d8dc6c7b496ed0bc93e0f86c20130a4d156434cdd5948551d63d252eddd8d

SHA512
50df37dfa46ff71a6d0116edf27419125aeb18f418a36fd250a4063bd5774ddb1d798f71db89ed934e7ab86a5207303c3b88644bbd802a33bd6ea25b850c8c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b73a.TMP

Filesize
1KB

MD5
d52670376235954966726e7e4a036166

SHA1
fdfe50a37e7499f574ad84fb9cac1f3c27babbae

SHA256
b577ab1c003ee818d379d07d2810aecb7061cc2af4e3f810d968d8095ce86275

SHA512
1e8a9026d59f4d5e86976cc431e3570925c0b1e0cd2910d594d2195f41f3f4a316c37df7a88a72b3f7dc1fd1a76088e52c190b689a2ecf735e62b45fb1564f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b87f25c0fd24c1b4f8f500ddf12206b

SHA1
68a60131b8450cbeca83fbfaf0b6549d6e17e85d

SHA256
b8dd3d51f3586801f03aeca2b731c1928b746339296cb00aa559f4aaaad541af

SHA512
e97e7616d47c9df1bb59a539ef65f400eb124ef8d601a423ef816584163ad31c10130e6f1314ba83ddde9f7e33f0c53396bf2afe4cab2072cab4703fc2b8f605

Download Submit