351cbef622484e6f53cc18d07167f39e6f5526c2154fe34805841b12c33368c7

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1170a1e5b8600c9eba4728917d7c020d_JaffaCakes118.html
Size

152KB
MD5

1170a1e5b8600c9eba4728917d7c020d
SHA1

2052b2dd12d03d1595600912efd008155b608eec
SHA256

351cbef622484e6f53cc18d07167f39e6f5526c2154fe34805841b12c33368c7
SHA512

2beadec19a48cb376dd50f70943d2d1da0f665429f8eec32aee4d00c6ba03b499e8bc63d5c732ee77f0eff8fd087184d92758ec46a0a2100203aff123c56c92f
SSDEEP

3072:gbZUJN3nI5Pi7PTviB5M1ZSkeZK+6SQor:yyJRnI5PeHQr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4128	msedge.exe
4128	msedge.exe
2304	identity_helper.exe
2304	identity_helper.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4644	4128	msedge.exe	85
PID 4128 wrote to memory of 4644	4128	msedge.exe	85
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 2180	4128	msedge.exe	86
PID 4128 wrote to memory of 4444	4128	msedge.exe	87
PID 4128 wrote to memory of 4444	4128	msedge.exe	87
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88
PID 4128 wrote to memory of 4396	4128	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1170a1e5b8600c9eba4728917d7c020d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0xdc,0xe0,0xd8,0xe4,0x7fff297346f8,0x7fff29734708,0x7fff29734718
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18015995437357443108,1988569294814314302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c9d92d3543863578a007c6f2633d81ac

SHA1
91a13d85b5036f7344c7bf1d214851d924232d44

SHA256
2d2b3d002f3d36564e3f910e14b858e2038ba3eb0e53b43884935a38b583542a

SHA512
5cfd302b9e60ba363b077227d1afcd6521aa278dadad92a7ce21e0fff81461aba1f11fb257706160dc9e47e9348dee464df654218e4552c24bf012a7559021bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e9da24c9d23e548e1ad3cc747bcdc6bd

SHA1
c7619c1bf5083c52cc55cf41da2608ab90905222

SHA256
e092391f3c7ee7e35a7b069624401f3a1ab2a78a9b5b4e187d5662857503b5aa

SHA512
ff0fa79bbd47a2ba85e88379d5e5197a31f671cbb2ae41a0ec5e7031504334695e93cbc5053a0389bdd3e4ef958cf669141efcae722ef7b32ef231ce4f50e711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac3ef2e1571590c18b4e85ad91df8671

SHA1
0c2c5aa295264850f7aaf775549142ffd52eefb0

SHA256
927e09574fd9a7831e275f11ceb5ef5417e76b90c611b87f11a75bdc9f85f41e

SHA512
706463740bca845db2cc1d399943a261a6dfa7c5b2a76a0431ae0d3c3efe9402c64c341f6c3bb2d912758d19018e56c53f2424a7fc5d4535d98fa54cfa96c02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25cc97764fa89328d4c989a4b16ed99d

SHA1
a75d4ba793b3aceecd3babe5dc32e86ee477bc53

SHA256
ca11a1e61c009525fdd31e574cdb33ed022f390bf0d1b22faad73e0d891afe57

SHA512
04d0dffc6aae6eeaa55f161bb6ca0c0a0dd5649b0bdb1324f5f4d748e162bfa2723e72b585d45ea13bd9995bf493c34d982896988210306de640ece33e7ccedf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c063c70c0b14cfbdccf230c86c5a056a

SHA1
3ced8fd63b3902a24f5148173f7744f0842c7af6

SHA256
14508de47ef9c3d0df5ec82ce0a13c9717cc969b483198db3a6625a6f9e42b99

SHA512
bcdcbb7684350ef4b69fbb6b59742fef789d861f01bfdb7c609dad4df47529248b5c87e41811f23d73ccd4b7e70d06af03d9455991cb1efe59332d0e4bfc0a03

Download Submit