4e5abb0bc8ac18335ae75a5d2d8da99a186792ed51f1b82c673bb63200e23236

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01d6199d29355575149ebe0dbb2e348a_JaffaCakes118.html
Size

108KB
MD5

01d6199d29355575149ebe0dbb2e348a
SHA1

da9adaa7535d5560758f895c9305f72c9333d98c
SHA256

4e5abb0bc8ac18335ae75a5d2d8da99a186792ed51f1b82c673bb63200e23236
SHA512

fadfa02eb84826e75847f09e2aa7489d3a1c4c62f7751a4d7ce089abdfc588fc2003b7638b8acea30ce492b2b6115d3d304396ee933176fa10998ed0fd9be7ab
SSDEEP

3072:qjY2sYJ6rHfgaToXdYKlGwJ1kmy019FtdS/MDbA7AlJdkS:q4oaTo4rh/MDx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
2952	msedge.exe
2952	msedge.exe
312	identity_helper.exe
312	identity_helper.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2060	2952	msedge.exe	79
PID 2952 wrote to memory of 2060	2952	msedge.exe	79
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 4784	2952	msedge.exe	82
PID 2952 wrote to memory of 1832	2952	msedge.exe	83
PID 2952 wrote to memory of 1832	2952	msedge.exe	83
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84
PID 2952 wrote to memory of 3792	2952	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\01d6199d29355575149ebe0dbb2e348a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa606146f8,0x7ffa60614708,0x7ffa60614718
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9278738241985919760,11001221752840135648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\151e9e0d-4f56-42b7-88f0-66b3cc02e0a8.tmp

Filesize
537B

MD5
f22d15f9515b3d1df4f85e0e7e1f2d75

SHA1
3f2b33d296dd9ebdd16440a05eb014856bdf2349

SHA256
db588e161ccbf67883edd3dd63bb4a5973a9d9c408bce946009eed91f26adcad

SHA512
73bb37574bdafae38ebfa65dbcfc948bbab928310c58849040cfc16b0244aa333360ee2c23774c7b7295c7bb893a989df93d1fd4e4db6b32e1f5cd0aa5c37e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
957da40291e5cc10db162e09311a59f7

SHA1
90f9af84441703ee78c30c323e45cdc0e7f002ff

SHA256
66a556fcccbdbdafa1aacf6f76e07b8cc7ff53dcaada7d5268576cb3d1bccebd

SHA512
1dd49a1e716d80bfe548622dfd77e9da73f274f803901b28bd16fb4692034b69d28275f95427a22e1ac39db2edaf8a821fde308f38ff456fe25ebaa8e96c645a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
007d125f562e453af7da7de28a81aa93

SHA1
72d189d4a557f651d60d0f3a1b680b2e28d3b25f

SHA256
8c8f7d5826c4f4fa69b166bc847f13a5aa79254992c888649ad4e846026e53a2

SHA512
94a67f906318c727158cd7500e7e527b99821a7f152b839a74abf51a64bc0705c49772fb0447aaab505b455927258203349adcfebf08c7c03f1f5fc5a6de1f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
7d9564043bf012f5d2c830d5ef10c127

SHA1
5cb4f28d855290047a36da4044afd101357329e5

SHA256
9fcca9392ce1e6588f0454a78e81180f52d6cfc90e07974c17146c128cfd45e5

SHA512
520194d8ba70eb395c162ad7fa675bc99ac471245a8a8c46f5a483902dd87573d51faff907437421dc13847a35fd1488fb09427c6fc3390fdcf84fd3241fae01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f689d256da847f3d93b8fb06aa57d05d

SHA1
bb350db041652bc9c35d0f88ae21155e18449847

SHA256
a06f1e1848a4a0f0859f26b35e63d05485c13f40a460898cf78233c5b9f10a94

SHA512
f7a30c513f2a2256493f2de47f2975711a9f6b4358948f55dd8101637272aacaedd17bb5126c383ed25fb483d5e8f1ef3782e2cc2691a370ca1f23af2c201df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f826381ea2082c030d8297503d826424

SHA1
bc2f877ed0aca2e8d7238634b6713a04809561b1

SHA256
a2a98309f79fa636a89a6b6b6168392225c0d99fbc43b8ba211154b1e4408f17

SHA512
053d3c18c4db6c6707b9d9614470432a824ab16a3ca5794067a29fe9d5f67bb9ef70280f28b2ba02a61730c489a2420109adf8e9cc43ae236c106880ffbc7356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d54c10c27ee8aaa0a58b3c241e92cb9

SHA1
4a4598cbbef22c42261669e97860e762394db46a

SHA256
e22e3a36f500e78842faa45be6121a101aa7a30f64b41f90e71d178308e7c4a5

SHA512
2a9bddb7e2967a0ffa75b3b7ecd7ad3e2c624bcfbf8580fbb25a46887d8591799c33ccd8106024b05fcf1a7c517bb58e893ea11209138705babf404e555e3737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03a9bca669f4e2a344ffcd2a4a2321d5

SHA1
d35af3d4f2a50b6ad3711c938ce2e17f54459478

SHA256
55cd51f7693822a97c200913321eee6afc69413a743d4fa0eb5693a39294af57

SHA512
bfa981d1514daaddfc8ac997f7b0dc6445db4220e1ed7c92def3701480ed44cf6bb860e98128cc2bfc29b8f180e2410b22d9106130b6ce386d7b5957295853fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3883fdbc04047438a972662935b395be

SHA1
331bb4a5110066bc44ff25c1a64440d16fb7d287

SHA256
482237e2ec28558236c22dfc9c30dc2e7533b8b71bf8b2560bc940d851e250dc

SHA512
28473ce6602a6482c8a9c2275a5598d6daeff9fab9816f9240808f8fa2e520cfce718c1f7cd52301bc28f6ef9e4a956f92e79aa295132b0131d4a2eabd2217fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
530d80b919ab2a84c42020c2a09edd99

SHA1
dd5376bc357ebdfb047a4b2b71d2fccb4ccf9346

SHA256
32e873251daeff92a5d99c13666fd9815fdfd0d0d618c473703e4c9df039f970

SHA512
7304fae18048e08255b6096be771767150a638576d664a7e3aea7677a8b251b612ff588395b3011be66df97f574319821b4f7696165e3ec8ccbb7bc22e11824b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2a3c976cf9693258d13e3f439ddca06

SHA1
767b978150bcdb1654e10f1b9b5972a11489488f

SHA256
5e1fd970cf5c7a95ec4502f664a74be2df24f3fb08816cba377f2f3d0a7fae31

SHA512
58446688cca306f185d3932eb78f9be3489b70eef03a56dbb3c88445bf570e8fd8d1b0645bae19c1c57187a05fec53ae1d27f62f5974cffb6c7e3e811170a32e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
5143bc18e98bd87afce779a34390ee7b

SHA1
d3e44ed91409eb829460df4fe04a844bd9151ca6

SHA256
72b0994479e7a52252d80e0bd07801d94cf9653657165e4125ce8cddc576bde6

SHA512
5327850bf9eb610f8bb7a2b369ee0c1766d944f43f737245c2d4d78927e7d39fd1c9adc3d2a90ba6a1bc8181b23d6506ee22b00713b5a06fbcd6121be27cd599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
30d9b58746423edea1648d14dfcc8db4

SHA1
e6e9beacaaa6900a70a5d53b1be08d7fecfe68e6

SHA256
4fc1d88bb96bfe2fbcfd6a4a8403df0e9a4b3e311811fc41ff0b380c2de52237

SHA512
8c65a5661754d780d1d26b9a276e77b55721947cdefb774301a1fd484fb05bf6ba3e8072e8173d01f15cfa0680c9d30c1723af85f52427f34888a9ec64761eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c237.TMP

Filesize
370B

MD5
c61bf7d930f1cbb7a87c7e484ba76d39

SHA1
ce0e7741d8ac7a04b823e0e689fd79c1f8bf86aa

SHA256
a58e0c4c50e7328d570c3ab547fdd7eb54b40fd9c0846183df394ccb532a9ea7

SHA512
0639ef5309999e2c0ba70628c88eee50ce56c56acf95feb86852bda5cda307f53f9647cc563ac056cb39e00b25fa147b3a9dc084f7b14f8411d44dc4c4da7dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73e12cac8bfaceac321f12f87ef53866

SHA1
b6744c0c7750509bc55179cef26f0c3f26a6e132

SHA256
f67ec6c974ef8f0d9d8d341ab02bf8fc55c95522ed3797e2ec5e0ba1a048ce54

SHA512
0661e5f6e2906324558cae757979dd7bf4d2b6ef3d7158419ed865ff26c90984f38bb59a877a3537091480cec245cd836884dfd7aa260323390c4c46866833ae

Download Submit