6efdcb9f4da435d04cec91e80fee8313ba82d4b23be702a7b813645a9c2c39c3

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c6f87d7d748d346deb564581c1bb16_JaffaCakes118.html
Size

457KB
MD5

46c6f87d7d748d346deb564581c1bb16
SHA1

6fedb2ef2c534c19583a67cd89254488872d8677
SHA256

6efdcb9f4da435d04cec91e80fee8313ba82d4b23be702a7b813645a9c2c39c3
SHA512

a566d18dc4af9092b35aaf021ace56037777ecea7485906fd74d04d72b4e12ec165689b182c08f28223be0ad6f3b96f2c2c9dc371da46c58073ad636fdbc2ba2
SSDEEP

3072:OsW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/HBmGEwCGJrQFIVaCVH2HbIpPx7/:ADAXmNR8pUcsFIVa4H2HbIpPxQdQqz4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
4492	msedge.exe
4492	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
2332	identity_helper.exe
2332	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2988	4492	msedge.exe	84
PID 4492 wrote to memory of 2988	4492	msedge.exe	84
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2924	4492	msedge.exe	85
PID 4492 wrote to memory of 2948	4492	msedge.exe	86
PID 4492 wrote to memory of 2948	4492	msedge.exe	86
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87
PID 4492 wrote to memory of 4064	4492	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\46c6f87d7d748d346deb564581c1bb16_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a4146f8,0x7ffa3a414708,0x7ffa3a414718
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10853883823739886080,4149833991713433000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
8b41d9e82bfaf51825f94b0bc9facf25

SHA1
9f988a1b5c14425843d77bccca491b419f115816

SHA256
c0396130b9807c0b45615aefc58fd118f64899622a1a15e5ee6a88ae3516704e

SHA512
9d1caa1f3fea8e19eb0b8dd6c131665d826bbe85327757f4469b3e41c3c5dc77b5f3ae8bb2360a3979b5607933f7d5f7064abd1f196f7729e4ee90b23571c011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
a838b80609bc53506fe9938d32501a78

SHA1
668eaa2fda311ae5c4ad115407d8d94333fc1d6e

SHA256
9fa3608029bf790d55a53669918d28d33a7e03aea196d53db8f9f42630d6c243

SHA512
652f5a97e69c7baf3e44d0e5051e241f958d9c26ea7113a2e391689ed78824242f167ae71bb187e11b546afb9097f5d8a571c2e21d79d1b1867a21cbd1f4d160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e582604e1b138c612ecec449453d8e24

SHA1
4216c8d98737403abcb7f5bce0965943dccbe904

SHA256
5ba03811424b26b79a750220f82d413283625410d4050f9608df52b7742cbe2f

SHA512
0dc8390d5bd6507f306c9df963ccd12a341f065eaf163e2b6e74113c2df8443a15ac98c22b07676b9bba326567bafdc9e69716c43c1cf15c4addf9ec2c5f52bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
890702d096432e50cdb096ea61d79881

SHA1
f7b7fe49a169496a8c30c2b0845921198e656f8c

SHA256
9072010dec74417a9e771341c0c4926debfff5fda12e3cdca8f8baf533030b0e

SHA512
3e9376c7222f226585f2d983c443c3793c18d9b3ddf1e58fd8ee36e0b073e25ed810f5e9f23dd3b49d2477aaea61a37e822d40bb8e0a97b6b9a66a3da1b996d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e90edae7ab0a363d4f427bf8334c35c5

SHA1
8b449e515822eb7e663a1405e3b0c670d097b773

SHA256
9c82895a9165d8960345f32aa7464ce2524f4817ed7673853a3c339d7c891787

SHA512
fcbbf2c4b464f1443ac909c25a4804811f56387e2dda26a0ac2d602731ae65fef1ea0fd53f13c89cb876f7da575262b81a70b988e65e9fa0c60b4afcc1a8507a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
64aa5f83750c859a44c2fdc46b1e48a4

SHA1
d4d50d99d7ae7cbb2cf491dfde1270389176a0c2

SHA256
41a85928540ffc98c7bf09ee7001bb656ab62c91ddfa702582ebdda0e917f936

SHA512
26d3b2d6a80418f8765e8139406f33efcd9e6cbe23880b6956eaf2efd21e6f576b1e6ce663c7629ad0aaec113e74ecfa39f0bdcb32e30f8fc43c31cf14c81689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d0637364489c20dd1e0e6adb2f1c15aa

SHA1
5c5352f220d972a98447abb34ada6b5024d01061

SHA256
01189d937be61755e6f44b987bdce72fff3f57b59940f0b2b83ebed4b000c89f

SHA512
d120dd3d463f6f160e8090e402a842c1c2e11f2c4a3cc61bc2b48b0e2d1454a45f38097e28db682d5a9ebd2c76dd89a1dfc6e01a7a5fb0411f74b5523dbd3c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c3c57b9b360fee9e737454c7401c389a

SHA1
d04b8d25e1b6216b5a0757c1673d36884c0a166d

SHA256
b7088c48d5c135457621ee8200bc81d6c968f9439e8ea41a81c1739b58bdf268

SHA512
33fbe9c387a6fe9cd64f0c72ec6fc20a4c6a285253bd67271691af997f47d009400cc7e13fd09b61bfb431c69c9d1ca0a17bbf454a03a084c8481281e407d177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
c55f4cb25782d118e426badbc245ad4f

SHA1
0569e8eb979cb57a08f92db913cbc9ac62a5340b

SHA256
4b905fc0e52d49bdbf0dcffc63a3e24b2590cd4c626e50405bcdfbc46507b52d

SHA512
ac19c2e5acebc4927ec3fd442b4232af8c77e6d85b9253efe07aa340dc0b1c977628acc9875dbe1e2d59df6fa888f043600c848c94215fe394ea97801b7c96ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
793791ea8c5aa9f88d6a926fcc2f939f

SHA1
49b5340e32ab21e7aef7ddae59dfe777195f2fe1

SHA256
0a9c948e80d873b23c69955eeaa754055aaabad3f6c86efc004d855f4c21a2c7

SHA512
a90f783d51dd45b4df9826efba8d86792094fb522710953a2edc8bea6f8e5957603aaaa3b22a13b27b93d982f92789cbe66b1ba32bccb2a701c17fc302d70454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a4615068da175ce5ae771d4274baf3da

SHA1
f6def95917e7d15c1ca2ec09401d455b4faceebe

SHA256
c06c08a9871f870188b66073c23b8c4e72dbbbc837694dfea72de01fdba1cd45

SHA512
7423d9c1175c7ecf8ff9f0747c2c7e911a34a59169ec56c74893b34aeb6ea69d7596159af45e18c80a5ca2cb0e226ceb2868649deb4c467e3f7dce83f8a3e53d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582536.TMP

Filesize
203B

MD5
3b726306bb74cb843f86af20e881182d

SHA1
6a0cba166c29086860b3157d368402d87f728fa5

SHA256
1a1308285fe3d75866830b908c305302a6c570a429049e166b6526d23a213f41

SHA512
44c035509f9fd29d40ea6bfbf12f7cc9425551e8c782ed3a0e2b254c587c9bf2f3ced7806a26334573cc18eaa8e51662d3a572a9769cd84363bd40b0c93b3b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c84a96963de5d3143602b82a38d85ea8

SHA1
f33b260bfec04fcc032b62ac9ef3e617224cc9ae

SHA256
5d476a2c805640c159600110ee61fc9fa03ae33a0c4d3bdf4414bbe165eb505e

SHA512
e2413a4583abce5c4722f066a9fdfb8e11241f631efec9701ff1afe7ca5e981f8d799f2aba8b19be8bf33dfd81ee50665e2aaa0bc458f2cf406f850e1fbb8e4e

Download Submit