14eba72f365e2cdd3a058bb334708f8f93d41bf609c90bec04ab7873ea263ba2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14ab7d7f8570c94493e42db3579eab4c_JaffaCakes118.html
Size

57KB
MD5

14ab7d7f8570c94493e42db3579eab4c
SHA1

bcaa0a347fbdcd124faa0e6bb5279c2bbe4a2fb8
SHA256

14eba72f365e2cdd3a058bb334708f8f93d41bf609c90bec04ab7873ea263ba2
SHA512

3d17156b47190037765193d8ff8c5a3cd9fef64a9a1404798289364369db055debc432a1bd9708b42b7dfadca2eb2e9acde1931548bc0ee00bcb722038c7ac36
SSDEEP

1536:ijEQvK8OPHdyAOo2vgyHJv0owbd6zKD6CDK2RVrozDwpDK2RVy:ijnOPHdyQ2vgyHJutDK2RVrozDwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{0F0F76F3-E705-448F-8B0A-2E5AAB394487}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
3804	msedge.exe
3804	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
5316	msedge.exe
5316	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 996	3804	msedge.exe	82
PID 3804 wrote to memory of 996	3804	msedge.exe	82
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 4976	3804	msedge.exe	84
PID 3804 wrote to memory of 4976	3804	msedge.exe	84
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\14ab7d7f8570c94493e42db3579eab4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a24f46f8,0x7ff9a24f4708,0x7ff9a24f4718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d6269c597909a8e2a93bfec309a0c5c7

SHA1
5d40b3b40f3438e57476a9d976877a8eb9dae6cd

SHA256
2446e3cf383ce17d73efc1952ed3211e13cc1b235b737b3121da1094a8566113

SHA512
5ab6c66403b7c87543d26a0c966ebcf924e804a57e27990897047a43cdba082ce17dd775cbdcbcbe9ed0e8e43235744434b828e71185b0e4cf614b3327295283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
5881469ed04e55552b5ae38d3df5d081

SHA1
f6f4ee6b9fab1e06c194d4c8b0265c99fdf96ebb

SHA256
481dfc453f214f061687fd3d7bfcda77747b6bed6e72f0573335bdb9c945819c

SHA512
1cf850e9b65da327fa4aa8cb5c7476518bbf4ccfc25b35d5348b13b40e719ae3b32e2459f62ead607b2b4c9237807a0f3968f181b50eb2d8328618393e795655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2cff653982d91a061734481909d2d58b

SHA1
902b6f0f30b4c7e95ba7d7615e030a01e7b9dcf2

SHA256
1e76f16458190ebec738aa155a24c52d23f9b436024c49738155c1392aef3913

SHA512
e9a01c832fb479931248704f3f00ccaf16de997f19ea111807749e598743c0778f7fa92b9ce8bb4a84d60886fc4fadda8c04ef6dd6e64f2232cb48f2b258959f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
44cb8a2e0108ca5530dd287e504a2bdb

SHA1
836bca5ca84e8cf5027229764c13f0b365bef769

SHA256
023e8ec1e9a106c28beb5fddac795efae409137b369029af3719325d96804b88

SHA512
91ac7b22daa62dce196106892ba36e4582f56d803c144cc2e09e923de707b59f5cba0d44e4ae8d411dd4f0c6d6326bf2028e65b6c7e5359d3e73b8467a08b27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
eba201ba22b9c604152c4924f76167a2

SHA1
bcddc4b76410b1c27ae96d6731265c610c636d76

SHA256
1f89a5bb3237f5ca2be6e100db506b1a83d9610207d1246a13e9949ec4697192

SHA512
765e9fa6b3c5a113de6edbfb624de7bddc396278ead282a8f13c2784599981f7418e4698c6758f4a3c561e19afa1b42146eeed7e88cd95354554d94c113c7e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ae12.TMP

Filesize
48B

MD5
ae72d57bca1c1c6dae1e29023fefc3cb

SHA1
3fbf2bbde82a511e102e5116051a7632c8bea84c

SHA256
c2de75a6170d6ef3e23c6878583471042650c35d931ebc311e27b2ac658e48cf

SHA512
f39dd0fa9a0a69f3fa520fe34d68d6d66f58e6ac787718bc69cbab40a91a561de90f12e5644a59a55a9f7bf2e47c74ceb7166a3757b55740ad7bde9e91e92e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
caedc397b03b116defe5f5c73f6cef68

SHA1
ca7836a0fa13cbc773f6d2091429cd7c5d9ba9a0

SHA256
d704d16f61bfe246d1e4704afd2cd1afd09498c0d4c0b9b16d83f58919c3dd07

SHA512
e6826535f8013a8e4ee6dc4a5931c676333a79fdad9c20c762eda34f7dcbbaf79c154687995cf0dd6001bf8ef1d867504b7ddda2794225323f0a72de6aca2de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578b38.TMP

Filesize
7KB

MD5
9d0f56e780880214e72465935f261bba

SHA1
e8b47620bf963ff57b5607ae687420fd3a480c6f

SHA256
8f45807047034f667e78c79fcb386eb05ef8fc685d88bfc24037339ed89acb6f

SHA512
3470d74500938cd1065e5faf8d5d416155a1d0964e994e4687da46a174f33032128ae41dd6871d57060b282def50176a8521ff7d0afe2a245b14e9e97672d6a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2788c95a188ec4ef1855f267fbc75dee

SHA1
31b70e342c01222cf33d98658a843dcf7c23b079

SHA256
94f90b521fdf05196d5f2e4a5e568e649364c0a54ecdaa17c01dd762d063ebef

SHA512
1b2bcd1b12188fa23e4bd53b76d9a02fb840bc586bf5f53654363a021c48b5087471eedb69544bbc57bf74e2c74159c2c568384da99f942ce488242849070c67

Download Submit