61b6c2c2cab0d0cdd545e2f97bc77fa1e872101614a0b34afee30ce1d25a23a5

Analysis

max time kernel
144s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68ae9e89f495f53b9a94a6ee5086c45f_JaffaCakes118.html
Size

47KB
MD5

68ae9e89f495f53b9a94a6ee5086c45f
SHA1

2891589b4ff9097dad4a4300e0e10a36e2b1d485
SHA256

61b6c2c2cab0d0cdd545e2f97bc77fa1e872101614a0b34afee30ce1d25a23a5
SHA512

139e463db894628b6a28731c4b067f421c11b639899d4120d07f40faa1c78c374b1bfe1c39435717fcfeff7b3190875316cde42d428412d68228d56cb645a524
SSDEEP

768:PLWwgvQO8s4/KJ8HO36T5FMYqTwTmgYW/+20aS6cgRroij52SOtWKKC3askAE:ywgr8VSeO36T5FMYlTdYkh0aS6cgRroI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
4380	msedge.exe
4380	msedge.exe
1752	identity_helper.exe
1752	identity_helper.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4500	4380	msedge.exe	84
PID 4380 wrote to memory of 4500	4380	msedge.exe	84
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 1328	4380	msedge.exe	85
PID 4380 wrote to memory of 3684	4380	msedge.exe	86
PID 4380 wrote to memory of 3684	4380	msedge.exe	86
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87
PID 4380 wrote to memory of 3508	4380	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68ae9e89f495f53b9a94a6ee5086c45f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb28f46f8,0x7ffdb28f4708,0x7ffdb28f4718
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13744739570901455959,10687201525482295504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
21KB

MD5
05da0ba82e7797f5544acefcb87bf1b2

SHA1
42872e7c218983b293da9b8330c621cdbe1a6267

SHA256
12a685f5bde1a018f98b700782377d1640f7a1ce6a7f5da3900911ec382c787d

SHA512
7cb503efc6ce9b3c0aef5a3542c4a95e7d3bc16cdaec394905ebb8c79ca05c4b7317e668201a1db2b7ebee5d79d57ee28c5e1e3159c3b744f3309b19b84b6a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
45KB

MD5
e9d439802e86f4bd21b443d97de8689d

SHA1
43be680996fbf959b86f441f5575251b15bbad3e

SHA256
13d296d36b1cebae0065599048c3a1f181c6dc435d4af2dcbae6d9461ed839cf

SHA512
530f42ee9576c18d8865b5f81b8dca6bc1e657cdc73c3e45cd27588edc201a20a55712ff2c9e92b05e24edc02549ffcc06b3eef1315faa55a1cbecbfac434fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
192B

MD5
2536c02aa053450ae689538f9da1d661

SHA1
983a1dc15049321a398bdb4637531c71ff92243d

SHA256
664e48b7a990c31690e1c7d88bb8aa9e870e90ee3e0afbd7c2200aa990354cfa

SHA512
3baa2aedae95818f80d6047b41988d9f050c6b67787ab4802ae0e0a6013f837210954d86513cd4e35e926b3520c2d28ed4512ca82b560c27e3949d74595c2192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c6f6148d208a1957a3d9e4feff148de2

SHA1
6410beb378932d069a1f14a4073f73daed2e899c

SHA256
1909bef2ce45539f1b1c27a6899782b503d04cc396a76c7ee27a2b658ac6b678

SHA512
8eaa50efdfc09cf9bc49ed31e2726b82d2686f6a81f56fd913e7f2e1525aebb6b8dae4d9d7a8820c8e893c14fc27b30ffffef790bdc5cd7d0e95cce3c893838b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
35b66b43f81d08cd210d9d7ab87ac0fa

SHA1
22eeae8cfae648704afa6df11d04805f7535fddc

SHA256
c286facba533a015b47f506e77794d6cf06f359fcc71da1bdd7e101c623ab75a

SHA512
75ef64f3115610230948a13a27343c19a2e2a0f2ea77e4b32893ae8a4c938c92439ca8ffda93468a034f159fb460c9c8e667ae7eff4ece5faecc8105a7875f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1019B

MD5
5891e5564ecc53a70d858c2d8a6b73c1

SHA1
076de636d1e78888aa1056d56d1ef86feb460152

SHA256
547b215f90458045afc212bd0ebd39fe7b557bd081ff9ad2d00655cf3e9cbf42

SHA512
bac758b6ad2d10b13c5ababf671bb0790039e04fb41529b75110d6fe44e43768bf2e63a7df2b014f37194daf87f511c20f1cfe2f82813a5a0d21ba77173a01e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
813ee8e943ea5d96842bda90ba6f0c3f

SHA1
f0af5f5be5f3c5d3a69de5d505226e73382f2e3a

SHA256
9149d550b9328b21bc543d8d846b68ff1ea46989a8324f6452669af87cbcd9ed

SHA512
da9ebddb29a4cd66693b03554a60be0dfe873734bca92a8044b98f64154a408b6e7820bb7e92458a96d610f0d1f27f58a1c7921e4b924725a37eda3d48ca84f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81c1c840ad142421f8018a70e4da266a

SHA1
180606734bb23c1efec214fb21e1894396c22965

SHA256
a4e21d5377c02f149fe7fcf4a4306f0786f9d6599ec632c6aeeb3556f122fd31

SHA512
8450734afe18ff0694886dfa9c1e84b34d93edd65095ec9e148a9bf46d44a4a9ff95d8b2a7090df3cbd438332d31604ad511c8a2b94a22a816d9f48bff8eacc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d06721ab9947d64b045eb1faee75307e

SHA1
4efe3236bb2d88e90d6553d7284b85e0a7850191

SHA256
616676bede203329bfa17b95cc410635dda71f1c09f8155e572eb89d4287fa13

SHA512
570c7612845c36fd91b19a0b41955e6093244be27f801a8f9fb188a7b4d4c56cdb79926f8372178a6b45ffd52d0411f6acaf9aa724315a56f420faf07209e46a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a62873b5c794f49aab12f573369f302

SHA1
1d73e0d695ab84a1da15118c3e16af76cbfc39ea

SHA256
689a5383352aa52353b4e62bca7edca1bea968b3ae0a0ffb2b67988753a9d7ba

SHA512
08f8c8f208490081010b33e97a75dadb4ec04fca9852072b39a0509220af69be3680fb3e3d490e853b7d1ab6e8a4fcb1b99df319d0e3e0b756b3820cf66d786b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0778da432669ebed20f5922f67cd7571

SHA1
e212ba8b12ee5acefda61f35f7507a005398d78e

SHA256
d23f0a5452b1507a1330908dfdbd67b2cb4ac610f8cb32834b7403786259c9a5

SHA512
7fca65153a6f61ddcff4db4129b952721a0744784f9ccfc9114c416cf8b55d0418603de71c53455634373e3f8bdaaa3e9bf3f48f36c9629f5b7ce7fe2e98d003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d95496f5957c418499786b00de99a056

SHA1
7c7175906f1bbba0cd0640bc270071d2eeee141c

SHA256
abf2bb59565bcc7b83e191d4e23aa704460d01afa0532584bf0e18b48ee8156a

SHA512
71b8cac2a2e553f9edb940126f56e36d7e7b04aa85bf9a683c103225649dede31f914e49a1060a91af57e779f2137aa05452f0a4ec8f7e7f343dc88dac2c68bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
0e92af1a6638a0d88bd8719067a7a50f

SHA1
4208293d63d7633b6816a4b3b4949189882c6d93

SHA256
8ec5b7abe1c885528dbb901852de9ffab46356c12006e04cbda626102eaae336

SHA512
e46ef9c51ac7cdf22e0c539c23f50087876b86a04b32ceb226088ffe1c3282b9f98f669146c8286703c705f993b962fe80487f95465e97e77b5228af0b5474f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
886876701a8fb9cac921d8a0ef7e1dc2

SHA1
091cae5a28789edcaa8c6744c86f36d745e36a53

SHA256
3a8a611cb8f4c6d8ba0211b024f37f1cb51bcc2f54ac7b2d4bb4026fd20a0c61

SHA512
70cdcf717d5734384f0df52fefa492fc78d6bf042b9e9b2df8c1419c92f77d7a4dedb8e52c7ed10e39bc61d2f39071918c38205c8a50b0c69457278b7c1d04b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
827e010f0ce546ef8b5fce12832fa120

SHA1
05a7461a17b9cbfabdac82a760ad0c37413d88e6

SHA256
428065d8b1107505a7a12a5eb441cd8ac04b3a5c00eb68d96630233647f8ed32

SHA512
c27ba65376ce36c17f29f228fb352515bbc69e031d8f4bd08835e5a023c3a91d25d2af9afbf82abd7de47d6a2440ed843a03cfea38e5bdff440b3492091a5897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5897d6.TMP

Filesize
203B

MD5
5d3a8da2a8cb4bca1f0960785adb7e47

SHA1
f21db5e503e4a803763be359115b0110ed17abcb

SHA256
830065a60e7a03d32859b04f6653bf3a5f9f5aac1a0f7481142beee555e2a118

SHA512
043ca84600fb29ee5a1d677a31df0200d2d048a11ea7738d57aec8f83178ffb73b25d6de999156f2299d5ac99d3e55fe07f52d4626d271892650ebbe37f8f8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d8da571e897114ad54105be64fd2b5c8

SHA1
be43f3dac3eb8063720ad04c1202c38625a6c299

SHA256
44952cfec98476040fab3a316dac1245d6c6d7faf8251cac0084feec87e74ce9

SHA512
229b0b56745bb3e0f284cbfed35f1c210e6a9794c3c97d021cb86018b7b6c3f7959bc1fbaa978abf7fefb57fe19811317d74ff53cbb64292a55c144ebd1a7e1b

Download Submit