05324a85beb1ec0fd6e26039c579789176828ac00eddf375f619c3a40f3de9e9

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20bd7de4a01915f5a3ecd315ba0506a5_JaffaCakes118.html
Size

102KB
MD5

20bd7de4a01915f5a3ecd315ba0506a5
SHA1

3386ebf97ea26babfc5fd3e4d34de29fa6cf0868
SHA256

05324a85beb1ec0fd6e26039c579789176828ac00eddf375f619c3a40f3de9e9
SHA512

581264447591db773d6db0ae10da12716c685c1109f17a344e4c30dfcd996b5f60ae776c09c0c8f1328ba0c0571d8e74b8bd7f62386c8a5b56ee12e27cb54c27
SSDEEP

3072:6AscxaEnkFRJ8DcJNGuagyx/uKQvwAhrYaSKrXVrIrtIAc54AcBnilwd7:6AscxaEnkFRJ8DcJNGuXyx/uKQvwA1ix

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
3804	msedge.exe
3804	msedge.exe
1068	identity_helper.exe
1068	identity_helper.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 3216	3804	msedge.exe	82
PID 3804 wrote to memory of 3216	3804	msedge.exe	82
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 3428	3804	msedge.exe	83
PID 3804 wrote to memory of 4388	3804	msedge.exe	84
PID 3804 wrote to memory of 4388	3804	msedge.exe	84
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85
PID 3804 wrote to memory of 2224	3804	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20bd7de4a01915f5a3ecd315ba0506a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc502e46f8,0x7ffc502e4708,0x7ffc502e4718
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1364 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2104072221107757399,15487830652070246104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
50662ef1dae2c609a4f8437ac7410d7a

SHA1
96ec2b683d1bee8e6f7accdd23214550df948da6

SHA256
514b86c2194164be6bbc6a4390f0a0d99689e5ead87fdaa7eb891419df1f85a7

SHA512
4e5e0de2aeaf8dfbdfafab8b50295fd67bf8f0e4b5a1444b9e75456c044959736889f1687274fb40f358cfcc9eb1cb88a94600607a42cbe85f5f9bae6c933f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
642d383404bfb36cf79ca7358562937b

SHA1
8507c902f5b16bb6484626386b46d34f7a6e35e5

SHA256
958f49f0472a0f8fa6597e5e7d7048b30a3b84603a431235d8977941f6351e9b

SHA512
283fb18576a91252f22d6eee774c7419b2dd96f9b25e6e2dc3f700ebf0a6c8c3322ff0fe4ad4198226aefde2549c614b0a4566e95f8d21d5d7076fffcbaca790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c3e33f0c0be654a089dab9cb49a35561

SHA1
441b6d36bec10ee00563cad538b849f0b96d65f3

SHA256
d1f326bfc39b96653acd6ed11ba3ad01e48be736db1c80855dc4fef22487a36b

SHA512
6cbfca03fd390ff499d70ac325e01696f58bbe1105a66456cb294c1cb42b33c95debaf1b08c5d609e6774c22651fb822a19a6348d17a7b7efa11d466a8efdfd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b72c7d98dcac6ed07144afc87d37a58b

SHA1
f3a73b35df6d4717856353c1f732f41e6f9ef575

SHA256
dc60bb7da7c87d2941334813333d38ad256c519b4bc66c07a92ca91963a00d64

SHA512
f5db90df7492afa9cd4fdaef41f778716d6f1917b29943b3f0b21957d0f29805cde09e8266cdf40f061493b5fb00b06bfa1bc0dfbe9e59bd4c00e26075a7c157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
29f8410c89408a8a6109590cce329db3

SHA1
6507934cd831a101e987c293ab39acf6f2c64d77

SHA256
fba51c591f95786fa5eecd0b7eb1fe01167f2ebeb2d19172b227c44b59821ba6

SHA512
b096843f7be6df4f84292b65ed18cd68eb414a0f447ec63a73cb40783ef8ca1a05b3c3efa5117f94e0c5cb79a1e5e8363aeda34cd74681a39201d45107a9cd6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca311ebe15b72e752147bdf25bfdf973

SHA1
18ac2de943379c6537355e853e68ae65c47d5c84

SHA256
65f2567c11fb9ace15586a69f46851cff148855f1f8627134d4bb250b952feb6

SHA512
a94dc7f5b421decb7522221afbb2f06de92d55f24272d7296473e472de6bdf9ef821c6a54733a136a2fa0095987b3fc823d0a1b3c8f9050fc5f6b52bc2fd38df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
edb119a74a76d55921317b35ed57aeaa

SHA1
c45a0dbbc8ff131f28fcec0a8bda98a4beabec62

SHA256
f0d4832ca46770e4021629bbb996ccbc557f489e4b31ce78d83829f7be30f080

SHA512
d78ed54c449a9cc2bd0b8ac9536382fa0c662f3a11c64f7bf0b87e54658ee1294c306703a37b67a6d18b50bd753bd8e6d3f82c1a3d18e98199d9effa2fb45430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b31faea9a6497b4414fe4ca3efe3449f

SHA1
af82af87f99f70992eaf20455ad2dacef0207a59

SHA256
53b4e6de5c533c9986aea227e80bcb75a94366174e8f657906acb94350af8100

SHA512
31d8676d8141ca7c1dac6c538933d33ae9ada7c75a81077144e691228580c6a43da748e9cea3d4ac574e1422c933c7155f4370d5120225f756aac82112726fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
053d43bade0320f595e49bc5bbd12039

SHA1
9c8ab268ce99de9d582d5765748828d03497de08

SHA256
db8179bda5e2e1d22be2d1dcde19b1a492ced85abcb0afb2b643b94dd1b81ea5

SHA512
7a60285883e9e0fca5b81abd9b1764c639d77beecc241dd0aa56635f2b6408c265cf42ad3fd66188e841c34ba3723af7f3109867461f19d6de30adea93c3e0a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c0ca.TMP

Filesize
1KB

MD5
c8033f6417b6b9591570452dcef548be

SHA1
b8fa81a41483bd792c7a2bde70e9d6317a8aaa98

SHA256
4558b3be3661854133ebba27ff18758adfe6a5c4b587cf4a65cdc80556e1dcbf

SHA512
b403cdd8d28c655ac471658ccf2aa6c124eb32ce845498099e96dd4ead2a20221b556d0041985848070ade379ac819598c262955f80fecaf53c306a2362cc80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
864c532a75eb9cd8bddb1bda5b87d735

SHA1
c08c889c41e636bd77526a450f8f932df0d65f21

SHA256
f4ecdf455ebcf2c167dd0fb48c2e85180baed903a6f3a14d01f652ffb6142b96

SHA512
d5e1789d991d2d40eba368f9474fdff8cb407e256c8add33c98b90015ef9204790f33ea0c3460aafb5bebd37209e6758b2d5cf56b1d0402ec5cafc2bd1a9e057

Download Submit