2e30e9a0dffe6719d6d911b37a7160eb055de039cbad09d2843fd27979463a0f

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d04af476b4af8c8866c563e627f867e8_JaffaCakes118.html
Size

491KB
MD5

d04af476b4af8c8866c563e627f867e8
SHA1

88262bfe4e59674f144d53e3331102f94bc3a9b5
SHA256

2e30e9a0dffe6719d6d911b37a7160eb055de039cbad09d2843fd27979463a0f
SHA512

2cf54ac03a830b1079d22cf4692f765c9616dec14c3321bc63cef19c17dcee8d8c5ff67f24fe0150544d0105ab5ff267406fd12af21476dfe438afef15123331
SSDEEP

3072:e+Y2MYJ6rHfgaToXdYKOVrdomGATradYj0yFterizcgF61f1a4J3KtIdnXNByhkE:eBoaTozdrBJa44tIRDyj

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
1644	msedge.exe
1644	msedge.exe
2864	identity_helper.exe
2864	identity_helper.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 4936	1644	msedge.exe	82
PID 1644 wrote to memory of 4936	1644	msedge.exe	82
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 1916	1644	msedge.exe	83
PID 1644 wrote to memory of 3312	1644	msedge.exe	84
PID 1644 wrote to memory of 3312	1644	msedge.exe	84
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85
PID 1644 wrote to memory of 1384	1644	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d04af476b4af8c8866c563e627f867e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab96846f8,0x7ffab9684708,0x7ffab9684718
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3079145496167106378,5504604523934147110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
e36ba52e4f473bb26ad76ef6eaed2f14

SHA1
1a4ef896cc6734c24eada411a7fbc240d3628fba

SHA256
267b939fdb0fd3013551c08640a8cace30cdcdbb5749ce6e8a36841c528c4915

SHA512
b877d995e5b18da327cca1286746dee4957d6f2bd06f71c8b96c2abea7d989ebc454eff11d2a40fa20d778784e027190edd49dacd420b9a95e6152be079bcee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
a65a8d2be5e6fa02a469bb800a94cf0f

SHA1
c3aabb570df0fcb9ff14836dee387d9817d8f4b0

SHA256
12e6aa5f977388eee7b0253c7f22201615cc62c3dc8770052860ebb028628078

SHA512
0467ae7e8689217a1c73bdd3e9eece2679aba1c91595c427a81092d467122847aabc9f5e6caaf3dda9997e3cbbc5d78988d6626f19216234c1644938f604bb6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
03a5a1bcabaa2ebb7afdf7c6bb0fa727

SHA1
3f7648a2735b7fe05c6c570711f9ef113835cc63

SHA256
2a535f5fd9869e240bf730d5aecde6d7b9db7e377ffa12d97d729e4e0b72a275

SHA512
58801a3fbd2747f430af16c8d77174fa3ed387abf9aec7359e1b857158f07aafd089ea08020f27d78ec4b7631c739b4eaa3bae01796963c9f388d093e10c86e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae9c53b8c54106fbc8fefc708d2207c6

SHA1
7e0786690034d6feef84af4b3508c5e9f5c2e75e

SHA256
588621297f234fff80c83018af56f06e384f72232b7704313fc04403c3f367cb

SHA512
ff9d7857358e41f70ecf6a949ac231fac946b50fdc00990f8df2f8d5e8ee605ad37d6c20e0ccb362d209579c5658cb1434de9523bb6d42197678cb869e1a8ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2b144166531fa6c1d4710333fe4e106f

SHA1
265729220ee002107b9f402bc5151e14e03aea60

SHA256
6c850a8941562598287af8dfce4cf42b6daba6de69dcb122d547a68d74d1d5f5

SHA512
277e083292992671cf6f368af379ec02d8bd0ed22e8e85a6a0f76caeaafb66bd8343737f06eaa9bcb5f75ffb8ee313ee8f62294a5f17b4c26071b9631515ceea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
502c022cdb9386da7262f88e41c437db

SHA1
d2fc9521e10ae17477bce4944d77d44c742affc9

SHA256
332b4f4dbd4bb084efc3acb10a521c3befe7d4332768355e6ff8a8c7e7423876

SHA512
61d222c9f77bdc4d56f57aa47cee3d4d0a375ba2cbed5d4736d474db4063c3f94da52d758248db53114e624b43416239fdfc1e28fe111f6a6e9675b7e95802f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69fb0a34490830846501862662553144

SHA1
fc3ddabb49f0df6af8f839325dd0bb5556dc8d81

SHA256
e971c5f7a927204a309a57244ac2d26896fa67ae739e468a10e2325abba4a58f

SHA512
10c1e2246598d259a0c3b98839f2a3b621ae8ac95ac7db7310e83af84023ef64d9bd6bba4ed889268246d7798d9855cf0c71e8e34dba7a1b520fe6b6fde921bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
00fa2a376aa0633152f61fc9496ce2dc

SHA1
433155df37733644fc364ff79d4b5d05806a3cc0

SHA256
7bd0c3fe68760caa1e661d157513783c9f5e3c369e4d98575ef60db03f9722a1

SHA512
0c5dbc3938f9bfd548e086c98981bc5206574c8bd634ef9b330de1f82be24fa9b7ebdb348373b1a6c7370abc08dfd2a8520714f39f4b724caa105b61bb8c1fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
a33d64ad3c9528828eda32d46357e3c4

SHA1
beb1acb68393d66bb73cf9385c155d7e82d61e6c

SHA256
cc32f14d490cd9b192cfb8c7b2a402361365b25559e0270927e56c62963f2bda

SHA512
a8006291b586f255a2fdc715c910a12982c8d00f0dbbc23e43f78be281b691f6a8b18a528e721e77e68cf9374b5c6059f0b80a1ae1b76d54bffe8e095605af61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ca7f.TMP

Filesize
370B

MD5
1f289795029f79d8664f42d1e34aa5e7

SHA1
7fa75bb8a18081a08b517f312c5df1af9b69f35c

SHA256
094800035abdb3273b3b2fa9084d8daf0f2092640a20eb49c3c316f659669474

SHA512
0515c15d5c51ae3ccd7122d157d3e78001d4ac9c19f2b03ab1a6c7beb63cb4529fd1186040d27f6488e85c952a56c9b727487427b152b2dc422e6d76c76c3a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
48b963e875542239149b8f5cc33abb83

SHA1
646b2fbd38dc039f5c377ca9e2b21bb80829e34d

SHA256
37131b5bcf9c9c41c084c0523fbbca8a51c86d1f20296706c15b41dae21f1fcf

SHA512
ca2fd3479072307417210c110f6d906535bad924ca7e83aa6197fb237dbd317036a5c4226c9c0e4d85229a691b3950cf9fadee1f0a64786d42835a5283b87c86

Download Submit