1e180aab15413ca0c79f58816f5804736e5e637c50ca80d514de5094c2dc87a5

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c94034e2214cb16073399bc0e8ebcde6_JaffaCakes118.html
Size

191KB
MD5

c94034e2214cb16073399bc0e8ebcde6
SHA1

1e1fb3d3ccad374e29dc032f7d1bc457bd2f6ed0
SHA256

1e180aab15413ca0c79f58816f5804736e5e637c50ca80d514de5094c2dc87a5
SHA512

1e810c148f1ef59b7f9e43f3df436784d23d7348887a948e299a918c3e25b24bd98b7c2c62845cdc79255bc75794d5df8ce07fb31041c43675eb185d6a80b767
SSDEEP

3072:wKZB+CkAAD3tosD1fPtzjHlICRTAECGIRfuLVXLe9rCX7Ce3sc9rCX7CeisZA9rE:wKZB+Cg/Vfl1A0LmeoK4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5832	msedge.exe
5832	msedge.exe
5384	msedge.exe
5384	msedge.exe
468	identity_helper.exe
468	identity_helper.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 4828	5384	msedge.exe	84
PID 5384 wrote to memory of 4828	5384	msedge.exe	84
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5320	5384	msedge.exe	85
PID 5384 wrote to memory of 5832	5384	msedge.exe	86
PID 5384 wrote to memory of 5832	5384	msedge.exe	86
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87
PID 5384 wrote to memory of 1740	5384	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c94034e2214cb16073399bc0e8ebcde6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa10646f8,0x7ffaa1064708,0x7ffaa1064718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9651296756925718641,48039206136615755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
2ab425d473bb5c28fc0f9890619adad4

SHA1
f6d295a006dd8741ca74f37595aa1f172aa62d08

SHA256
76429b9670461241d36b7d4d5aa7d10d0fe628d804fd7e90ba8dd42981f9a4c4

SHA512
1ef2c3624287abad683bbbdbd485a21c4fce56cfe23807e42f0e7ffa1f57e5e966cc11bd3e5381762e7b751708fc24be512463756923c9597dc42d49e0c11096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
283982b6c55d5a2fa56e2647aa0aae10

SHA1
ebb384418d55c25e28fa27f5329ea07fa2d7dd82

SHA256
f84f52727456777f00e61dcc0994f425138047cb3e3b5c278482e76b839ebb11

SHA512
4ee747a3d3691cb8172bec28386d2613110f5b054d85839d59f2e3a11ba1900f4be6a3390638a9a060f9e165dedfdb9f808c0837d5a041a97824bddfcdc918e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
905192e3ac19920f3141a74fd7475903

SHA1
3e321054506a435a87c8b2b00803b90ffef4f11d

SHA256
54d773b7ab6d3ee435e17a3ac60a78dd252a799b2580c242e43b84fb92b2d308

SHA512
b7f3d7fb1f93bb644eb50451681965a89f08bd330667b42e299b5894483f100d46205dddee62d4103c9b23936fe315d0166e78424d58491bbc2f849f783024bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e555286aa00a53c5c83ffac0007c1c3

SHA1
d2dd4942b91d3abb15578d31e44e6f1b4641031d

SHA256
1091a45753993b48f84f9ab7c9ce2167f8e35b43eeaee48cdacca64e9cb23fba

SHA512
dd6a6f1a695e423497e99cffa12db9ea6588487abcea9cad16748279bba5e5df8fe565070618e54cd6b39086db08277dd474da53ba8d4b3f8c14aac54324d405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1da75f16da25fbc26f70128471f4f1c4

SHA1
6021302150cee188d4abe0b1d2a32e6768427084

SHA256
00691d2ef989bceac96a15d064843f9097c0fc4fe84e0d7793432a213e765616

SHA512
f56686f63a6e80298414cf638b4bef4a87bd8d39f947d9d6144f0d71c941580d3235c18a9c143ad9aced1c427f49250a3a1eff76006f10909f8af3d55255686d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4c18de41adfbcc59b32694c300be8ffa

SHA1
a28e197af74b0067d90b1903ddba4a95ecc430f5

SHA256
58b7516e000622a1d48aa2ae2272615db10ce9ba0934edfff239711d740710fb

SHA512
cb6e7f3317044f3d6ae5d4f7830cf3c370ef6bb84a9bccb96235075f858f3871b38365cd9cd3dc9ddcbe2e2bb6eba01bc4dad84d757ce511827dad39252656a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e59e733a0b085314d2e9853492d329a1

SHA1
b5186f203232c1eb8b981aba9e60dabaed719808

SHA256
54b063e398314973e7877736383e19e50d67cbcbe21cd80e4bea5f01c2042a19

SHA512
b837dee6abe83076d42bc82aa27f6c6824e298d070b5cf128cafede19796d198ecf41e986c4da3e037e7e2f16395c61fdbcbdb0831c5fff351d1c5b21179f931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffb77880f654a313072468261b5a3f49

SHA1
7291955f2ac5c58600ca0a0d5ac41ddece054d86

SHA256
c5e387d74e963f1a7ffe09ec4ac2484093f51c281b163c416739f4312c885eee

SHA512
70ef4c62927e8ea62d35258358454c6e63d975c8eca4cbad65b98490d495329eae8a556a778952f89f9bcd635c6328536b08d29f3787917abf843a6cc5367377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588fb8.TMP

Filesize
538B

MD5
82348db8a9a1ce6944c87fbe4f33a5ef

SHA1
afccd29fabd65d5bcdd9f68584e53ad8211eaa3c

SHA256
1b29ed235cb9d6ef4a39febb18e9bca64e1f55770f7feb13cd7dbe2c745e0b35

SHA512
804170983584aefb07efec084d0408e5c9698985ad6dda7bd6673b06c75dde95cd17dac553f6f6e83fa42bde22e91e60237c1e78d31194769e43b11d29d4c833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
db66636209990e9c507a5f08d07fd0c7

SHA1
c70df509614c106367d0791276d06688cf68203b

SHA256
963b9e4c731dc8d8122ee39108e2016bbc637ce77329b1cb98369b7d25ea33bb

SHA512
9da5782faeae9c16253b2f7d01e63d03c77228210cf8d576073e854105d881a13e8e08c8664c3817e91e9a0b4ea22e97fbcc10ff40b3c75a972dab11da598edf

Download Submit