cba68a4425ea573e303ab0d2d026a019cf8baa091e9434400643110ba1f84f6b

Analysis

max time kernel
143s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d745606f580a166c6119d9468cdf919f_JaffaCakes118.html
Size

202KB
MD5

d745606f580a166c6119d9468cdf919f
SHA1

eaf3362f11bf0c8b0a912313ddb1fbe80d0e5735
SHA256

cba68a4425ea573e303ab0d2d026a019cf8baa091e9434400643110ba1f84f6b
SHA512

58aeb7d2775cc6789bbcb71c8981a64d6b8f42a1ac91d17b4d40ed223f9fb9d0f7235b9c9aa6aa1f47d802c89d69672c20758ec72b67d2ee450c6b4cca615677
SSDEEP

3072:oPDpjyVgLkGtGX6OPFNPO9ifQNMQpdh129ImEM7zTSCHmcrqmQGzVA:oPDpjyVgLFwfQNMQpdh1P5

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	sites.google.com
23	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3048	msedge.exe
3048	msedge.exe
4868	identity_helper.exe
4868	identity_helper.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4636	3048	msedge.exe	83
PID 3048 wrote to memory of 4636	3048	msedge.exe	83
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3044	3048	msedge.exe	84
PID 3048 wrote to memory of 3732	3048	msedge.exe	85
PID 3048 wrote to memory of 3732	3048	msedge.exe	85
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86
PID 3048 wrote to memory of 628	3048	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d745606f580a166c6119d9468cdf919f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39046f8,0x7ffdd3904708,0x7ffdd3904718
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11639416453952116626,7648587317447581395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3670f3d2-ae12-49d7-ab3c-31e338ad4944.tmp

Filesize
7KB

MD5
1deeca8591481e69c1675403e031b6d4

SHA1
21f352208484e1bda04b8a3b021aee82a1e2798e

SHA256
1f35ec7abcc46e8ddd6f2db8ebb4e5882dab87fb23e8c3f30ff27dd204d3a2ff

SHA512
bf4369ccc035fb6b9652d0997b640898001625b6b465968cf76b3c35b84418864149d23b92b22d9cf173050e48ab08258152632d16726ea9b4582bd6375332f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
41f29553695c4034908d8ce8af273062

SHA1
b6c462dee56441d3f27b84043e5b504c13a664b4

SHA256
4413965b4369ee1ac4775a0807d6e392b9e527351a788fb2842c86ccf44cab21

SHA512
40ddb918792a64b173f6288b108bb35d85bb99156bbe19d839e04782f4eced5be5d8a468c7ee5cde2ec2a5ef070c3cf798f33ef91cb402be01a6711d6a7bb64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d10a563bfd6cfdc9b940223d13b4b96b

SHA1
75b6f32e184face744dd6136d7f8a351a48b28ce

SHA256
2e82e323f3ce1c2039c5875be3aa50690e8ea1c8c838a78fda9d67e103ed0565

SHA512
6aec8da33d23781d53c5b1ae7be661e68f7f46b09be051491aafa6e31e7ad86e1ca375170ecf9bbaab8907cf352660a35890bc68e77bc84814d6916476d8de48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3d971b10c0b0702da35f88075f77ce9b

SHA1
3c9e7d21db45346266ef3c69f460244569556418

SHA256
a81ece210ce061fda09bdeffaa7d2eb5b9315b7db263bfbce43d8004cef055c1

SHA512
62a44e23b9612c4ac8e0e48b9dad840afb43321236f83b456c4b18b0473ee7613e1a8143d921276f0d6cf333053d0d0aefca6ce4d186ef796e6ec086d7e4572b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8255e4dcf10971a0c463c344726c9710

SHA1
a0754391907fdd151174a83025d8901c3be5cafc

SHA256
bdffb07332dadc4ed6d70c39e59043f0b9c6158eef8e01506cc0a4979802350a

SHA512
594b5f68fa40ec6f0aac652f95c07c3ce5616f639276d3b9239c975b66ca330d2ef1efbea3c8e7d3d371a0e2fcaa8c72dfe1ce16f5454b8bf98e7a450747abbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9d97e7314ab8a248d7695eebfe64c8c

SHA1
b21960ab2c3b855a1cddd43683dbfc108c450361

SHA256
b7048fba308d41efeb19a92cb01285ca4311b647e6fc970d6a92155543b3b1bd

SHA512
49bd500c1f5346dfd6f7b48d4daa03901edd65c3b1595143e8d6d83493749ac832e239bba1cd7580ee9943250773c0f1ebed40fa1ccbae27ddc61783a38e40e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
b55a60296500308e8c2368145f0cd86c

SHA1
f33db6b62a0fb675c29d8661cc51e770a249354b

SHA256
c25026b47d9258acd1f9b8e467ab5b950d87fe6c45bb36ec3cddfbdec901b938

SHA512
f6e839c29587cd903e75ab342acf2cd2782b2153b2d5a03e286ba274df2f225897d733eb1b56eda11b07afa009d2b301d567162900a5be9effaa0b40b723a3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
58db62c464404b6bf4484c9d4c9be09a

SHA1
5c7819735a27aa9953aad3107914098baaf609c7

SHA256
10ebffbb60f185adedb719cb07c3a3ee1951cc78dfdd4d237e075cd8aef55baa

SHA512
2b87cee63372d92c1b63b072cca6c42912a0d67edff5f3209dd8d268d8b2ea999c2b791a6d8f4f9abd97d9e2eb16fb200ab7ecc936e841e3515d50b4cec2d0cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
c421c3aa5fc929dfa9c4ef95b3e91f48

SHA1
214064d37fad7b167687f41b950ebf78e8014841

SHA256
78ab24881c685bdaa8387fbf4cc6e053ad6ffcad9c6071bbc4a14325297dbe4c

SHA512
eb2714e82b2f09414582e3055f38917aa4811618f08d2faed56617276f26392a37b6c696978c3807a0f0baa8e683e8b4ebf8fc1146e6c02f4c8400d621a223e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58585c.TMP

Filesize
203B

MD5
202d607e0f8192326e4ee2cb085401ef

SHA1
d7507f6bd07ea74a245bb5c1b6aeb54fc40e7a4c

SHA256
5632083052096dc36184e6e32da64d533632009b561193934649b0fafb1c715c

SHA512
e23c6d1957ec5c4c16023bc5f4421250345cbb4b3f7edf311e7100dc239cb2082cfec2dd14dce7d215627b92402f9df959bd3d35411a5657ef23d7e27f13d2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0da4323b85117c201470ffc564b6379

SHA1
04f2cde06475cca0764656038ad865484676a082

SHA256
52c1fb9bcee52eb1b9b1fed4347c3ef1c28ed86785d8af6787202f77775d1778

SHA512
4fc5625f54b7518ffcbbefae0fee26bb1cdec5cdfaf8a84427cc217b89f01966bb038797df33f276ec1247186cddfd5c197e1d12543baf296096d1f52a359a00

Download Submit