befc4a0a9dc202d3589167090dd3e5215b233b8ff010c3e1ca1bd6fad8529dda

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e93e6ccf5a928c2cc4690497b9fb1c8a.html
Size

70KB
MD5

e93e6ccf5a928c2cc4690497b9fb1c8a
SHA1

c8001acdbe65eb49a68828e1b89f5f6f0df8ea07
SHA256

befc4a0a9dc202d3589167090dd3e5215b233b8ff010c3e1ca1bd6fad8529dda
SHA512

5ebf08c23894b99ab4d0a13198fe841a92e8ddad67ad807f0efcf32cdeeaf9cf5285c7273c260f42f09be002e17ea839b1a2eb8b65f907925d11df8050190384
SSDEEP

1536:Wzmf0iPXWzWcowHQeB0p1DTd1vcXmNRS7ODB6W6ak1rQG9Tt8U9Nubg/9U6gtWC3:1fvPxcSVp1Hd1vcXmNRS746W5k1rH9TW

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	sites.google.com
22	sites.google.com
23	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
3356	msedge.exe
3356	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5048	3356	msedge.exe	82
PID 3356 wrote to memory of 5048	3356	msedge.exe	82
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 4616	3356	msedge.exe	83
PID 3356 wrote to memory of 1636	3356	msedge.exe	84
PID 3356 wrote to memory of 1636	3356	msedge.exe	84
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85
PID 3356 wrote to memory of 3924	3356	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e93e6ccf5a928c2cc4690497b9fb1c8a.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda8d446f8,0x7ffda8d44708,0x7ffda8d44718
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7220569496714932653,13101244386000989275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
243f52621628790460fe244be48538b6

SHA1
27698ae56cf6d04c96130aac2fae12beab038d39

SHA256
0d47aad19f4ac0d24f98165fa3c4370700535e770d5cfef2b568fdcda3fdd0c4

SHA512
7a1a5362b7a10b74c9f5ed61a88cb5b885c300576125367eefe1857dc1170106ee3d22bd94acd4bff7c5916c80cf42a7be91e60ef0d48610f19f96348b20a16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
597b20485dcbd88aadc1452a2dc4ed83

SHA1
706552b864b58ace425c048740c25b01fc1d8ae3

SHA256
1d831b08dd93c7c43d972dcad286b7235137120a10913e36434c9380097bde14

SHA512
56de4d401f8ca396342f74846b7eae225f6003089c771213cab58da320703f67bec9f7a714dcad06bb4ccd12c688f7e8d9e1d521c4c8f6bf2f449f0642074a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d845415e9a4bb2e9407f03c3aab3ed37

SHA1
fdb517034574842cb7151c925e81bd468c66ab84

SHA256
35629cc7e4e9f776988ef03e860c31fb2ff53b8974bf32901ecde5016b7d842c

SHA512
d34a1b216bbe473457684a74c92585c687066e451016947bb3717e6b99c92b9801de0c7954f6080ed39001d9d19cfba621e8a55554a163b6c2162825f9cdb78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c4f613873ce27bd2c807878cb9812399

SHA1
973d7fc2bc6e5fc9f831767d90ff5da7c79ad106

SHA256
95e8f0f03c6363b747dd8657216ac07d2ca31f7d52f8bb0f8b813c3bf12236d3

SHA512
1f81a22732b93903d09654a48a6f644631a43a57277cd3e52ceb04575f0bb07eec3a31197ead5dd77824009649290e46d520937d4775c0104e530f11037f68a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b2e292908f8409c3e68a51729f633b10

SHA1
e1eef3f1880affb262e7c38ead1e3642bb434372

SHA256
31dd9afbbe7664f0af5fa70d07ff97c378edaf0f4e3c7622320d6b038e87d1e5

SHA512
ed484627e3a363e8d20311a1ec2258b2586bed873ae1a75f93c1c2e94c4a8111f6ca0bd7f415554b782706e01d756907a62c7aefcdca5fc359174ef83e4fd8f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3543941208aea0e798d002c75c639051

SHA1
85af3938c1ac66f0cc3d14ddd4bdfdf6c11a9b80

SHA256
8a0c033cd2013928b24c20b7465571693c9bc14b2a2fb690f206143c8da4d0cd

SHA512
8747f4b156157175410a1397f2a79f3ef1541f9abeb15b65fc1a1f6ef7db656a361b9af55685d4b0b1eab22d1f9deb6058faf280241a98f21027addab3602d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad51a87c919effbb5c6fd8fc95798d1a

SHA1
737afb461d6d3da22634856e10d873febe1c46d1

SHA256
cf2f5b402246d441d983cd7990ee03dd4fe6794625a5b7a3e3527cd30b66a6fe

SHA512
2505fb824d6a2b7b6bc9697585b47b1be5c3c4ababafb083ea2489ad0242b6fef0ff8416b7049df661abc14c60a52f14467bde87409213065636183af538f482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
366a902f9f4c5d709847bea8b7f5e392

SHA1
cc53c7cdd1a2c7ab7bd00fbd9d009ac41560126f

SHA256
08871236892a3caa81e0b2107a1a55f50b6e12faff8e90d6c4e018774a9ca776

SHA512
a385454b649d999acb647b5b7e7a70182fc265432bfde3e2ee55a7ceeca378069e2817df50e7219ad87b99ce78a4327bafaddc4ddcda513249ed83f288966209

Download Submit