1b8d6922ba5d97a20987bd3b6db5e09b31b88058a782a8ed7aabdf074c63772c

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11acd77d1c5a3cea2086fb30fd67089c_JaffaCakes118.html
Size

50KB
MD5

11acd77d1c5a3cea2086fb30fd67089c
SHA1

6ce7e25e25ef2adede51a71303bcd566c61c9160
SHA256

1b8d6922ba5d97a20987bd3b6db5e09b31b88058a782a8ed7aabdf074c63772c
SHA512

4a356369ce5128b40bebc4f83d8bce8bde24a04ebe8b64f33a4dbb539040aa8b4223c7c7954ea438fddd175602d3b6a52e844370d561ac32654a76f9ca11233f
SSDEEP

768:S8enmuvqCHCQPCSC0CtCDybwV3/i6TAmuEXl2L7pjLanb8GKTw:S8qmuvq+Hl9gwDO6yp6AGJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2412658365-3084825385-3340777666-1000\{1FE58244-7C29-4DC6-BE2D-E96ACA2B87D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4848	msedge.exe
4848	msedge.exe
2016	msedge.exe
2016	msedge.exe
1628	identity_helper.exe
1628	identity_helper.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3136	4848	msedge.exe	82
PID 4848 wrote to memory of 3136	4848	msedge.exe	82
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4080	4848	msedge.exe	83
PID 4848 wrote to memory of 4568	4848	msedge.exe	84
PID 4848 wrote to memory of 4568	4848	msedge.exe	84
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85
PID 4848 wrote to memory of 2992	4848	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11acd77d1c5a3cea2086fb30fd67089c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafe8546f8,0x7ffafe854708,0x7ffafe854718
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1795024305017149405,12715829149844467576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
ba2cf46d24ba22ceeedabddbfb1e9a01

SHA1
7e544b791c8cf5ed98e09c5dc35aefc3b6e0ba22

SHA256
a2afb0ed1adf85ba460f9ed5c22853c164c0f8d0d9e34ae0ece48ea691a2eb6e

SHA512
ae3565f9e434cdf68c5f682f2dd0d9091a105c3be9add5649ba8f176d6f4e465100001dffedbcebb6e7aae25dbb7457305fed015ad8e7e20da1ca801b767c345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
40075b876eaadc29ebb12b561b9a1f73

SHA1
af3ba5921a2cc9e9ec7e953db666420ae6176e2e

SHA256
2d3ca8687a874565f95b221bc92be01b9f2180594e13aa048b1e136a211afd9a

SHA512
09fa25b71eb730fcf5ce2ff010a770b221e6da56ed44c74b937a8914a7620d8061211c370d17dd0c7529e0bae7adf8156e9d07c614b2e9ec3e31576c75015f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
9ab496d0e19d643c7feffe713c5e9860

SHA1
09e9b88334d34a80a09d06cca88a55246c86c975

SHA256
291be7db20b225904f01de87da8d1f4679eb1cd31c42a5918cf14d6ed7f0210b

SHA512
6816fc99299b79d1782090ce2298f57b412e638beb5bd9687acbbb97af5b582b1242c34a89417a726398300d49ed316a7cae1300835436a62117f8567b3ff355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ae50c4a8fe4de23a386af54cac6130bd

SHA1
13f925ef72ce8345ff2cbb260de968d5e4666609

SHA256
a8b9cea8c0f215d4d7f529dc49abe865b5df85b325000ffe9afd84e6eb3ca6b2

SHA512
f397653235aa598bfa497f59b9d698ac18e69421460834e17cebfc1a0259626bb3e39761cd6e6f608f27d03ecafa572ef319e8516eb70c21e17809cc763d3390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
58c4bcd79504a68c09d0575986212ac4

SHA1
bf1b4cfa98a70bac35e44b61b65af775b2866f52

SHA256
b9b06add2d4318976059a75579bab8975d31bf9deb6d978b2de5a483a2323254

SHA512
93dc25ef3293abc006df11db388a8b1521238f3c2b39327daa907495ff7fb6e128ebfe7401f3bbba52a0a4885e7d3dd83d611170c5322d71b4e244299d654e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6bfbbc614db866e3be91566ed5d9355d

SHA1
2737512c625c58efb1e55b3885ba0aae1c1971fb

SHA256
9e9ae263f593810085beda0544da07cb618768ee35316e8ef130be2e108443b0

SHA512
a953c8160fd269039263004342565c993c7e44d56619e5a7b14eb5535701e823e6aaa2b2c2077ea3a37ab1f4ee56e3061f79660a80515b5a9051d5ae707ff630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6a375bee5d208ee23f30132a09b78085

SHA1
b87aa0336f858248054e93c682b2216975545d1b

SHA256
327a6554b24816940c30ab33904c76ddc905f46e9680161cfa12c1d2249b84e5

SHA512
fe0dc02421c3fec1d1271f2ec3178e25fece02e1df1aa16cd22abc1c06f088e9357408c86e51044db5fe1987da6055a7f49bc8cbbb3f118439ce3882f2b98e30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c6b590200dc373fabcd75b0ad36a497

SHA1
d92cf518cc6d31eb62460b572c653972d30a9770

SHA256
9c0ee8f9b6d3dec63273b19a908ce30099b120fb8c996438ec632ef6a8923a55

SHA512
ed3e8a5403be8b1ae5e9fa78ba83a446f6acf49921e021cb5e20d04dd903549e446143b20b7a66f36d868d66a1e24f43bf08665892c5c0b8c0ac44820254368e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58336f.TMP

Filesize
1KB

MD5
a959438d44d2330f16219d67c58d6e86

SHA1
9012d921a95fb25dec34650b7f1cd7439f0a8910

SHA256
43a38ee1af5efdf607bfd7bf25542004d8ff96b1f02acc5a87184dac54bfabeb

SHA512
7e4bc358590c6293bb055f6354fe9e8873bca743f6d34dea2826838fae43a0eee1ba6e5797b51aa22b749858d5b2ef562694ab1d573a94249f6d5e93c0e71f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab51c0a8-5e48-408a-ab3d-4e63f0058e74.tmp

Filesize
5KB

MD5
10138cc1d1c7839955af1afee493aa8c

SHA1
c4b981caf9a9fe6d8e072b34c4d7f8bd68eba547

SHA256
9b65de9913f57b8f6cc0cbfe11394b36e4479efb15bbb03aaca4eb897af35028

SHA512
11bb5209fec8f99952be386f249590524369d8bb69fcac4ed1b64022f4d5ff801384c1cfe3d14f0ed7d206f19f6593c9d76a140c3ad50bea7879510ca835a592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa55c0813510bce42184deed3bb5d2ba

SHA1
ebef549a97e5e96bd453d1cc10af0506b25aa746

SHA256
3bf64a1bee354260985d9520f6df350d3d314c11d137d6946ff4a08de74a0f6e

SHA512
1eff050a4d905230b3e97b53eff8ccc85c524fc73868327d7903db4b8a219caa9e7b3e4dbbb4b11b653f11b4a434b979609653c4eef9705d31aed94493d388ff

Download Submit