3ec82d47a78a103e542f378a9119e61b6f9077baf5d00b8fbd09da8afd687dac

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaac6327cf5a4bb380257bf5904bd551_JaffaCakes118.html
Size

161KB
MD5

eaac6327cf5a4bb380257bf5904bd551
SHA1

344fc2c6cce40f130a0db115e367cd9dcb5f1054
SHA256

3ec82d47a78a103e542f378a9119e61b6f9077baf5d00b8fbd09da8afd687dac
SHA512

2efad87eca1f8854c0665004e692391247a3d4732604b6b48dd746e8f02cb438e45755e0946302a9a74a41b5ae9710d95907302a08f71283cb0fef41876d1d8b
SSDEEP

3072:nGnjZrfJmiGal0aHizQwE0gj11IBXAGQuWKt4RdAvADAupHJNt8zRd:IOgJ/hK

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
72	sites.google.com
86	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
2628	msedge.exe
2628	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1636	2628	msedge.exe	82
PID 2628 wrote to memory of 1636	2628	msedge.exe	82
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 2912	2628	msedge.exe	83
PID 2628 wrote to memory of 1500	2628	msedge.exe	84
PID 2628 wrote to memory of 1500	2628	msedge.exe	84
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85
PID 2628 wrote to memory of 4008	2628	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaac6327cf5a4bb380257bf5904bd551_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db84718
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17712765252367342602,2930815025155165591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
686eb0b2eb0edc6fa6c063271f6ac841

SHA1
7eec03d895769bfa4c42f7287562e552c0b6e2ca

SHA256
b029c03f271c14d3c13747810eec9a27167520ed657ef0702f47581a2052d3a9

SHA512
ec02272500b63315887af2c2f0d5bc3c8b5e14ef44e2e5537ee637d330c3414bd5ce854c06d502b5438661e4e4ce21c4394e50feed92381411d0a4c60495f43a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
2310b4a2d49187b455e0a827037741dc

SHA1
490f63e31af3ff4012941f60e55dfd4874f70a4c

SHA256
ba585de1a151eac800985cdc439b706cc7f292f7624ad6aceeea5e32a0213e82

SHA512
d3d323ff3062b454734db702a91337755e39fdb0accd21c6e26b53c923b91ca60deba369f0bb26b38a449316d6745b5450f33f68133c06aa1a87be17cd49091a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7082bb4cf216e3bdf0c2e3b6168b8b97

SHA1
2195eba51f3fa50b499f577de3eccd86dc44228d

SHA256
35902075b8c1d561fef76e585d425a9bd5f744b689971e888056c865cf949187

SHA512
08e9981afb6af83fd6b096cc93e75dfcb43c6f363757a61d0187b08ccd32e49ce4f4b2b684fa6e3bc9803443f67a486bccd75fb6915034f1dcff6375e596accd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30e93b22b6b9f7da9e0bcc74f0b9a247

SHA1
ef0e550f74b0bc35505e8ac97f03bbf60fc5afd8

SHA256
0697a58a244fe03be7f0ff563075a7691e7f83f283ea5c722ebd12cc1c95f4d1

SHA512
949c2a4afb08356c2f15957da4d4e16cd35fde15cff8cd71fecca96ac044e128de03dc9e999af769c1b054699e253692e40f1a24e6ea9346f60696e2947c1403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
78ee5fb0e48d4bf707e51e57d94724a8

SHA1
ac1132a74dd07e6888c9a0eab755accf145ee416

SHA256
37c332d66392f54a1ea19dcee681b567d30cd7b448021b7df1aba1703337d605

SHA512
0f7dbd9a9401535b5be12c2c9b99398a1fa358f63356c22d7d41990d2d56f8a3af985d75de75005eabfb96968c1b939cc5a5fe377a0294d37f212e1eda1b89bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d9b1b19fdd2a302cbd754efe452628c8

SHA1
c18a4f18faebc5526ade78baedb1a2698cd597aa

SHA256
e3b50eb661ac270fec0c2403fca4d775ed8f7e7f4286742f42a3a7f8ec7f8230

SHA512
1a3ae4d010e92360c4b7f851187c99f052ac17b42cbac058ffa47809b85a312bdf37148c56c0ca8f6bb11bad330340d562128401dc87ecf1b02d4002cdfa82e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9d14b4e803e21226c34c9adbcb954ee7

SHA1
4661cd7fa8f751f63661c7af51255ba3348e82b5

SHA256
199ce2d76ecdeaea139f5534e678babdbe587275bd6cbe30955030e2b7c0063b

SHA512
6d04f81e46bcb65b63d02fa0138fb7611eb302ab48ce468ec8faf5a0ae7f8004436bbd8d8574dff0d29648b6ffc8f4455df808899e8371bfc04e58db27ece9e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1ffc57d125e43de7fe4b81e68cd6ddb

SHA1
70ec600157062b1a5297b66306cc8f1e8603cf49

SHA256
af644645820b20e94b35c8e571126ec5f2b84252c58b7a34693725d7f9b323c5

SHA512
1986423ba98c2c3af2cf863dd77ece0ec1ea94521d341dd26aa039cd43e0c40f29ae231947f52563caf67511d1760943d4a1689a24e756d1bdc6fef5baa5d310

Download Submit