9a9d97e0b6aa0bf004c467f7308ac4c983a572f0d6905a0d7d53ea7a5a1356c8

Analysis

max time kernel
147s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21c4e6f0d786d81e08092d631423e8f4_JaffaCakes118.html
Size

59KB
MD5

21c4e6f0d786d81e08092d631423e8f4
SHA1

36703bcb218976782dbe968741255835823ce1a6
SHA256

9a9d97e0b6aa0bf004c467f7308ac4c983a572f0d6905a0d7d53ea7a5a1356c8
SHA512

05848dfbaf9ac7f796cb4d3df948cc544fedcd70e7e9ef45c8ac1bd73349606ef569683d968a9b38451d754048cf5788e49ec8d877ae44adb09c31f6d6444c8d
SSDEEP

1536:B6OluQqTY37sM0OvrSCs2HJP/+3EfaHHXIPbJ:B6O0Q1rsMjvrSCs2HJP/+3LHHXIPbJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
4220	msedge.exe
4220	msedge.exe
3320	identity_helper.exe
3320	identity_helper.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3260	4220	msedge.exe	84
PID 4220 wrote to memory of 3260	4220	msedge.exe	84
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 1764	4220	msedge.exe	87
PID 4220 wrote to memory of 992	4220	msedge.exe	88
PID 4220 wrote to memory of 992	4220	msedge.exe	88
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89
PID 4220 wrote to memory of 2212	4220	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21c4e6f0d786d81e08092d631423e8f4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe194646f8,0x7ffe19464708,0x7ffe19464718
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16153748288856844129,3380802162615614979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4cf6531ad0df61b6f4b12facd4598726

SHA1
d58ccd7dd16eef56edcafaaad68c5dc24c36fb7a

SHA256
245ab668aeddbd7b66001d8d5ae73edf2c3de868432d9419e4b19b6ce9ea056b

SHA512
b8cc18e374a4e6cb4e5a1404b254540dbaf639ef55497dcfcb5f9e62ab13f5d73df394ccffa2fdc9bc8d69a71f9b739d0a5d0404df4abe72bdbab0ff79546164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
601aab4dea9531b39d89a4895e4fabe4

SHA1
e94ebee4054c732956c4aed37e8d3893f703250b

SHA256
a6c83b0ed032b36687b4d0091a110bbd690a553abd93374cb48f4c6deb3e2d40

SHA512
c59fea77db1099cb794a8f36428f76b117c77c2b4162401ffd30489cd3faca713f70dd86c55edba85865a3253aec7cb64259e5288cafb8aa16fe44c6e4c13992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0d0b1d2d8e7f524860f68484d29aab99

SHA1
04b8ad295bc3f660e71fd4b69c53c938cca8e1c4

SHA256
666307801ce164e8b6da57a410144ba4ab8de99b0a591a524920ea151393ea8c

SHA512
8bc6a3fb5bcc1e2d85fb3ad878064fa968b00217d530d79639946e0718e75f417b2fa5edf0bef90b9c4462f8149e7d9946ef0a47e2c2feecbcc1ed1ef07e0924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee6be2717831cde701701c1dd83a1f82

SHA1
380f3d49dd983cc91b99c537250fcf8aaaa52499

SHA256
6770fe5d21301c222e86d6ab2f7a4a6692bc9a619be287c0b17636e9fa18ec19

SHA512
c3c1ddee50abf3b5f9549e3df1de546551196a849a65b1212343d69b78d06c11efd9cb16c1aeca75b3629258486ca63ff1c8db65d81a8cd6fab81e648f6d0d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c8cc361ec654e26e2fe439efa08a5bd

SHA1
f0d43d9bd9aa28e6439c8f55e9ac0bd36a4a4d82

SHA256
1e8ec61c937a237a0f85ee473ee1b5bfb11f8703c03a8b17677c3af36d2c2c77

SHA512
37f410fa169443d6983575c10f52838f067ac27943df714355f8b443d17daeb7cb2a9e577769f89f81f73d061e645d63c5638a5bc5b74a77a2aaca69c97d896f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
931b3f7a74ad1c5017f73f2940c54c4d

SHA1
7166cb65b093fdee888b0c2264c08b4e03ebf2fd

SHA256
ec1bd03db4eeaa2d582675f59112ef166517fa967007015816d875fea9d7c10a

SHA512
290e1439fbb1bf5974d5b6c532ae3d147161f689cc2d495d1e382cf07e25fc679c79a682752b0c15db14511d91893d206f8c78747b93f69ba6660a97de714730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d3b52b2943027709204f06b7ef51db4

SHA1
4743fa38a4d7947caf5192d1a27b328a59b71a89

SHA256
7faacc00bb0d137ff9d7d4b6e94de5c690752e086bf5efbc7fe635ab3e676152

SHA512
7589d16f89fe3822c8b586c178b30b26c0bc58c33e0bdb90248b709f6eeee5c45a6e94100e8c4d252366d30f42760313775da88b94dba172695d88e60c992c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3bb9fca27762af016cb4e5a3951da424

SHA1
5f1b7d06b0caf0eb2cf9a8b48a5d99728d4eb916

SHA256
68a381ad3971297881a04566cad29567d185f01e703892a8b4c23753cdcd74ab

SHA512
d35ab8b708f106df9352b9073b5d027390bebc8f7362ff160ae79ef39b89c1b6b26fd5076b53fa10e3176fc60398f1019a8a9488c7d67cb701ba2ff894c435ff

Download Submit