ed5957092c5149e025db69ffe783cdefa9ef2451969e09ebc4efc367f7ed2336

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1355a8fca32487e5a7876d9864c6324_JaffaCakes118.html
Size

217KB
MD5

e1355a8fca32487e5a7876d9864c6324
SHA1

f90b825976960dab963b44a68f20e67a9e2ca34a
SHA256

ed5957092c5149e025db69ffe783cdefa9ef2451969e09ebc4efc367f7ed2336
SHA512

604f33fef3e0ee203cec30c5fcce85ef7f8ec3dd4f64ec0d0badec7a51ec34ad0a3cd430083ee35fc3220c1430cd382f3ecbad6e8c4f1cbd85596105270759fa
SSDEEP

3072:37tqkqImWpBSHBtl4ntZaArTF3PZ1WfawgZY0sLpFMEte:37tq5ImWpBSUtZaArT1PPWfawgZD5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
2700	msedge.exe
2700	msedge.exe
5272	identity_helper.exe
5272	identity_helper.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2112	2700	msedge.exe	85
PID 2700 wrote to memory of 2112	2700	msedge.exe	85
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 3272	2700	msedge.exe	86
PID 2700 wrote to memory of 5000	2700	msedge.exe	87
PID 2700 wrote to memory of 5000	2700	msedge.exe	87
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88
PID 2700 wrote to memory of 1316	2700	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e1355a8fca32487e5a7876d9864c6324_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dba846f8,0x7ff9dba84708,0x7ff9dba84718
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14657880951005864564,2569630951542962677,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bc46f28-152a-4465-859c-9b896a0ac02e.tmp

Filesize
3KB

MD5
ef56e02a4a625b68a8af72acaeeb1954

SHA1
d4420198e19daae19d594cfbccb79c076aef3380

SHA256
bdbbdcb6963224da618d0b88c475ae06b42baf3a0da3b2433a6c788e3064d8e8

SHA512
a9bd0511445103d95b853de64947a58538524346c4884ed13d05aa6470a4b87f68ee0901541cee266c061d0e4229315c07068e4637bb3ef9040473425dfbcba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
9a61984f2d4bf56aef9dd959666bb2c8

SHA1
8d8b3219ca41abeb5cb14eeef7d57837b1033f28

SHA256
cd94f9d4e2fa142b03b1b85544a2f245c5f2c87decffa2ac21ad30798fb5a11e

SHA512
3a80f53d11cd4871aff1e91c209c7bb99b8717e01a2da003da9fc294bfd82b11a24b5fa854585403046772dfe3d97b11fc61b1ff056cd8011de98e5c9cb973b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
8ec5de2f678fbbadec171f920df07949

SHA1
593cb40794f9c5cca526dd1b1dd36890e7da11f8

SHA256
bd4d98109d8f16f1c0c69abc0fc4cafe5869e1b423653fbbb3a2d7aaa3a02c3a

SHA512
802ae2ebcd4f2acdfa8c3479f132baeacd8bbbbb20b74c408f98f93da0ca813279c6e96cdd7d3c281e5d9f35f4c6eaf2d31b76d69944398846187c97e4622b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f5c6b4a6a2c3e76828ce9cdf77aefa72

SHA1
da3cd75af587f102ca2ca3e67524e0d4c9a0d675

SHA256
c9fa1fa6031874e217dbf1966d1f519876d5c18064a83d6cc471c46d94557b4a

SHA512
6c4c918b617bc4dd442998bb9ac8ac780660bab6039648cbc859c2d5ae0846bc7e192a3cd9de4e0121bbdef0ef378305d7790ef203074dbd479fc10aa4dd358d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
858babcc1f58d1630bb617300ba36f46

SHA1
d0328ef4f43b8b4301c88973540cc0d86263ccc8

SHA256
96d98d0e892a5cb51b8d84f8f9394e9ec9be943f6f733dc5be0089d4418f8f8d

SHA512
963a238090f901194320604b38e516a90261a94b5556fc7b665dad671236e260d3f1461b1b46b1c6a52b4e976e247740df5e0246eeb6c26580051841737e6563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a3c0c5979b15ffbafff04b50f7a9762c

SHA1
05e6eb46ec3d5aa7bc3c0367db93a2eecae78ebb

SHA256
b00361ba27e5a7308ccb4bf447f042a8995e4b2631e9ccf5621ed84230ecaf4e

SHA512
011d684af7199c1ebef143c704929d1d17a1ba25e27c3906246a078a6cbe07f637e7447746ec87d8930b5c8f047d870a5ad5e91ab93c18eca22c18eb119a29b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8022eb4fd3f2f1eab743e421fbee986b

SHA1
9aa8e7ce15d4764505a92337a59666689b426631

SHA256
1974b00814cd42f59736bce2a4524eb41b519fabe213aea8889b9004716b59c6

SHA512
6d2952d7c3850f9949785be379d6a372f08053268da140edb7d7af7077caad17f3f900dec3aa4ab1a0fda340fd0cee4fd4051d7ccde061fd0fa79ba834ed21a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec00462b335cff062e21a079f224ae3d

SHA1
da74b44d7ddddf345e7100441a99d86d57f2f7b1

SHA256
a21d3230a001d2070e0ac0f7b5a6d98ed77b86162f8705e5ee99c687374b03b2

SHA512
33abc08da17a348323c039f16e890791a5874dd8a0c2f91182a35d15c83a48fb9b2d07c0d4f8fefab67e84f687b8d06b24ab75af7cca5013ba126ecf6367a285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f87b762de85ec7fa4f1ecb23b594e60

SHA1
29c4d2b427e7b84c0f01cf2240aefec590dbcf70

SHA256
f2f74cdd3ebd24993f43a7ad81386ca908730469dc602195c1449677442635da

SHA512
7700a835182d303bcea58a9a76a1ec794f529bc6f46480290843c56af37f020467b6a590a6a4b16ffd4610697ca624c989b5d8282d8ce8f2b58f9e02c88c6348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58aa26.TMP

Filesize
1KB

MD5
e71ca74d3d19953a6054643f60d124f6

SHA1
b6226552d82d2dffa274c7ec91c1a42482e0be9c

SHA256
6601d8b9e6158b77bfb1c7d11229af5251ca4145f473c30fd75be5034feafc56

SHA512
73fb91c1b4c7aa2c00cb2426b1d0203799a63790157719179329be28f2cd6ee7de19ea0b4228f1de4a8978220609d572305db4ceacbcc634d6085f1975ca847d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7fb47396af0e20ac994de5e4258c7ebe

SHA1
ebdbf54f26343742606e4647a5d38c8b91a08387

SHA256
7d4656c6231328af7dce78e9ea67c473ac495eef8e6314d14ee39752a51d7296

SHA512
53b18d6873bf63c52326b3a4fc333fe41405fec3d8d5f2d9820ce160883bec11e636399c9cd0e94243de388d2ac40cf63a519750aecf4eb79c8490c58d190d4d

Download Submit