cd7a6f67e7ac23ea2461a40caf0e6fdc09552abe2cf933b859f6110f5830ce12

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc5ee08341693c046337248557a6bf4b_JaffaCakes118.html
Size

30KB
MD5

fc5ee08341693c046337248557a6bf4b
SHA1

a416bdd0b0f46978f495f82e70cf4291b2f34628
SHA256

cd7a6f67e7ac23ea2461a40caf0e6fdc09552abe2cf933b859f6110f5830ce12
SHA512

61d9b6527846d5d8c59aafcdf195bd2e2ef82908f934f8e35db69a8e8e973e266fa8b930734cfe535f75b8b8f6b28dccd6fa8ea4c2a546cc837278229293580a
SSDEEP

768:gCCIa3G03FdC3AsiCuuzlgvA2IOVrJGlm1U:gCCIa3G03fC3U0oAA1U

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
1064	msedge.exe
1064	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3980	1064	msedge.exe	82
PID 1064 wrote to memory of 3980	1064	msedge.exe	82
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 1756	1064	msedge.exe	83
PID 1064 wrote to memory of 4716	1064	msedge.exe	84
PID 1064 wrote to memory of 4716	1064	msedge.exe	84
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85
PID 1064 wrote to memory of 1352	1064	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc5ee08341693c046337248557a6bf4b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccaf746f8,0x7ffccaf74708,0x7ffccaf74718
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13653127549695017139,12968440724081566346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
bef5e67eba11b9ffaf959f9bfc7d5e18

SHA1
604e32fa227581f8c3a3d08f880871e4734a06a7

SHA256
085dd032123df0ffea546d1cc749462d98d9b5c82d1e646361342a963fd3b7f6

SHA512
baaa68ae9f35c7c98b4202469ab11b3caa2a0d813f7d15005e9149a74e57e9043c795cdd0e7f220778835e7f7393e058ee31e4891f74bab8e1b6aaa80b750395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
2885beb7eee225d27d2260cf9909d61f

SHA1
d820be41d9c9c51e48ce9315d71a58dbf1b27f55

SHA256
95e1786f816fe69dc0cbe2c139d6899b2d6b23232f3db632585e57ffeab805c9

SHA512
6a378c7948964c604410c191c50e7c8733ae5f75ca9b694210e9e5a4b8375e04d546078aa80c3d316fbbcd18d35770f6e73c63003a353886c9f4a1f9dee782dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d2bd3c10517b98d5c8e1a199d15e8cf8

SHA1
1dcece08caf73e9a9e391925e8c82e6e20f8dc9f

SHA256
a4a86c83a3523dafc24774cbd0502026fb570c04db894b513b854c122d264c39

SHA512
161d71d53d6ea7746ed01d8fd4cd38e78a8afad442a3630b5613b34ca06b0bf663917bf436acf6ca7083f74972c74890d86da04c1662c4ef7b86b38dbb29be94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
33d4d674a6bace334532a2c3587fe427

SHA1
e5c7b727523b21a291bb18c15f8bf1c444c3384a

SHA256
93f514263527aa563d19a8fd4c77fcd4b0d21eaef6cee198bd8795290702bc59

SHA512
d8937e4112d55c5524e73cf74845932438db74684983696f8ccecae26b27b7d39aabe7831a0a0ac86af8b852c764e60163f4c3eb9c09341266a15e82b4bea43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bd97b1c0ca63438001c531b995d84ab1

SHA1
bdbf1424fce3d867d73eacd228142f7a6679090d

SHA256
b7323b0220f494ed2df090c79f3b3b186c6e06320cc437afcc2774c04b1d4f8b

SHA512
3763f193e92bc53cd89047fe0d18e523a1ac66542bc40df18d4f6ff5f54314edcd5509d1158b7b9cea599027adc4a2029cd1a185309dbc4da330ba227d2035d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a92392e6cffa656ac4d8594a5e73d0cc

SHA1
8ccee8a0aac1db12519c916e6946250fc61a3e08

SHA256
687e35686dddf1d59df1bead25dc04638d7b372c653d4aa37609d08487bc9eee

SHA512
729ca4c591bbe6d4b811e6c012530f1947359a9e9e7c4b157881175a81967c3e08e0bf47d13bb400ba368b3e8de1c9a402771f0fa4a050656ebdbf1ecb8a288d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be04c11bdf85e95da24858fc6d2955d1

SHA1
e3e27f70871a825dcc38c8d62d27a0eea3577e30

SHA256
856eaa0c04c32c5ef121808b3ed0eb9d52798ff8ea4ef04925bec765350592a7

SHA512
34c8d74cf85b3a9d4af62aba0f06c1bc90d928676f82ac752d467d77fe77dd95b51e7e39ef4a16688dabcdccc94b89aacef7f1e6e70bd12aec03435002175bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
3db2a90e4d270d6ab3e5475b3a00cf48

SHA1
434da7207640e9a54dbb55a46a4990bdc697ca60

SHA256
77e4e1f92c02f1fa85bc4fb5e62688ea8235e07df5de6f657b8e24cf2e146bf8

SHA512
381d4c1f4ee516637268c1fb80bd2e2dc1dfe2c9552fdfb3f185611001d346b44045bcda7b1858b03ca43edda56dcef4d457a0e208cc372811ac018bfb5e2173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0d02237-fe98-439b-a008-9d8a262606bb.tmp

Filesize
6KB

MD5
92290f9f1f038feb791a771c3ed3d7f2

SHA1
ced69ecde61fa68ce66232647f8422a73df4426b

SHA256
6b58d7d4bf60777dab047b9899eeddced0d010fd685778a70fe8e01d18df9f43

SHA512
a30d0216503a9c620ae820b5dfede4243f41ecb5dd588b7583bffa23bfa6b754ed95cf43e0f9256c0d961f1fe248f9f535d656b6d053039df01790e5c110948b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d3bb93af3551d57f9db099ebd502718a

SHA1
e6b4aaf24b42abb5ac2ca5cf0030d4af3d71a18a

SHA256
b594a1279df50ebf8df955b67f04dded545c64ae27759be9ab05d66a107e6a87

SHA512
ba728073129e3b652b774ba3a1720e2606edeaf000cb1bf0ee5b89ac97119027b026429508dd2e9787a0f5049c71a68b797e2a4e540db44170ebdd758d064612

Download Submit