5882aadbab740d3b65fb67af37f053dcc0beec38bbae85ca1a8dce9a52324be3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59c82d88e756d58de5c3b7a75a11922c_JaffaCakes118.html
Size

168KB
MD5

59c82d88e756d58de5c3b7a75a11922c
SHA1

1c58dcb79a05579de4b6072ea72364c6e1df0e15
SHA256

5882aadbab740d3b65fb67af37f053dcc0beec38bbae85ca1a8dce9a52324be3
SHA512

47e1eac90c583e5989c37a5385ce3aa76a3c4e1b630ef7e95a864e5ac4e7c580efd24601c07b37fd7c717e26bf91974214a993040b75ac1caff45ee06a8d89ec
SSDEEP

1536:6GkcldArATEJ5usGosf7eyY4JXbC1eQboQFuFaYBH5HSzfTZ3S+THtHH1SvTtbfN:/kclqrSEiXlVY4JL+55TAAwT8o8OwFqd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
1736	msedge.exe
1736	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1756	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2300	1736	msedge.exe	84
PID 1736 wrote to memory of 2300	1736	msedge.exe	84
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 3824	1736	msedge.exe	85
PID 1736 wrote to memory of 2128	1736	msedge.exe	86
PID 1736 wrote to memory of 2128	1736	msedge.exe	86
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87
PID 1736 wrote to memory of 424	1736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\59c82d88e756d58de5c3b7a75a11922c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7f9846f8,0x7ffe7f984708,0x7ffe7f984718
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3592509350365617180,17519589847153558395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x29c 0x2dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
24KB

MD5
0832b892b2d69eff80c5446855079859

SHA1
79e6db06f7501d468852628dfed399b8b5d64279

SHA256
535228038cf1027611a1a9f02387beb2ee2f26089dc03ff6eda7530fbf942db9

SHA512
06e2dd0f731e9753a9f138bdd587cc2d85280165632da76e243a1d6652f0a334e9d7b3dff07d5fd1bf7c8553bee452f6dccc96b235a4cda771373176ea089448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
41KB

MD5
9a25111c0e90867c7b8f41c5462abfaf

SHA1
0619625d479f31cf145c2e3714de0df4a69169d1

SHA256
41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

SHA512
0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
110KB

MD5
70e972e930bf9ff5459ed118cef9df5c

SHA1
03ac4a2cd850145f8915c6af8bcf3691b9be24d6

SHA256
fc2e622c116132753464b1bd6abfa49dbd3195a7c82cb9a629dd0c7c0bf34423

SHA512
e447773814dd78699bb98b6c610366f082ccc9dd7482c446b3e19d390f46b96ec19688e36f5d3a6d11b3f281e4546205bb48527dfcba851fad3d1497aa6370e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
89deacf4f4be255d77207bfc6be89de8

SHA1
ae56a5d5885330235f982552b189b1b7f4454d95

SHA256
1b23b063b90033997ea47252393b244feabeadbfe8cfbb288c0de771197b96c5

SHA512
510ea511bcbd037b19c69ac0835e6ef14d3863c9dde54256703b6ef689c0db8ea4d9f62294fb270d18027b5dde2a23f5e115506af284bdce7a8003d27012927e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6fe08d8e7c9be80cb8b31e660eeb8ad5

SHA1
b5ec2bd2fc80ed75364d2f71b8d98dfaa80d4eb6

SHA256
92f4ecfbf4010b6744ab955fb1a63f23f1a36c822f1d18cfa23b7210cd72ebca

SHA512
4f77d78da54c77ceaab442bf8bd7105c2e70891988f8f4b0f98b08dd21e9b6d8a36e018a63bfc695aea798f95cdea6877e99957a82df6fbc2f27197b7ee530d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5d7445b7d48f01f1da3e254fcd358dd

SHA1
43573a04b853ea531efb68a603c28ff2a1ca921d

SHA256
d6a12ff59761da55777b4b75b5dc64231d61e6bc7ca785689dc3b4bc5381424d

SHA512
48d24f5f13d7dbdcdfdea64f443a85c1aa932c32bf4da2518876e59dfbee4a5a9d83364b40455e2367fceac39024b2ce9c8ebec1d3afc9a9a4c034238da71bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
979d2b151ac1e87ccbaea3fe1d1852be

SHA1
a212b95dd80816eef9babfb8e24a9dc72ec0ce45

SHA256
58d02b445790180b36b392d987f622397a4f74fe65ac38fca7793f8a7d18779e

SHA512
710cb81e49d726e2dd8bb376fa92c3a23e301760c9e6defc5d2098efa87465af2af81d3290a433095378ddc181d209c6962d25771358bb8f4c22d638e7ca4ef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87ab3e1698c6f4a0efe25190b09e4ba6

SHA1
6ca9c69ec3666db02da13ff383eea14375492a7e

SHA256
c93a8057b1ffb75cdf030ca7af2cdb21f111392bc531e464c32177366fc64c25

SHA512
8644a95b85ff7494e887f978444c99b4fb6c356fb3ecebb72ec1ede787774bfc32b70ce76191cd834c3cb2afd4fdff131fca22437d5ead66f28050a3e7de5f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d3d7c93f7aa04301faabcdf44fa259da

SHA1
04dbe2e5b42ffc9d3cf84dbbbe9da679bcf2d2b0

SHA256
ce274fb14dee927bd745033795cdf9749fe313f25ff575f4cd68554480ab2b76

SHA512
f1050b234f541ed6e071a2460ab315a555ee6176f1a88293be76b59ef9a6377535c3f21f285d75b5eda8940e1410a286c6d195c1df7d7442c6773092515e6033

Download Submit