29aa61b05fde5ce377c731ec61a338d3b43d6a487c2c75d8f033b0d3c4d2d62d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22c0ab57bf3e8dcf064db83581564f66_JaffaCakes118.html
Size

82KB
MD5

22c0ab57bf3e8dcf064db83581564f66
SHA1

ddf31e2b0236fe8210d0839e70d9edd73fec7212
SHA256

29aa61b05fde5ce377c731ec61a338d3b43d6a487c2c75d8f033b0d3c4d2d62d
SHA512

0c0740eb9b0a32ebd7020fefdea0393cb70c47593c3e8d7fc2a09e6d87f45a06c1e11da0fb0b6bd72dab09b0b8a7b28d4baab6bb271b53f2886bdaa09b793a04
SSDEEP

1536:pGY02i/juqQhtmdCcJOvlae/pQWOdydlpAMOXgLGeb5Ex3BocAUHUopiLFu9486D:pG52iKWCcJy3/aWkydLb4Heb5ExR5AUq

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
7	sites.google.com
16	sites.google.com
17	sites.google.com
18	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
1844	msedge.exe
1844	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1860	1844	msedge.exe	84
PID 1844 wrote to memory of 1860	1844	msedge.exe	84
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 892	1844	msedge.exe	85
PID 1844 wrote to memory of 3032	1844	msedge.exe	86
PID 1844 wrote to memory of 3032	1844	msedge.exe	86
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87
PID 1844 wrote to memory of 1544	1844	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\22c0ab57bf3e8dcf064db83581564f66_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe42d46f8,0x7ffbe42d4708,0x7ffbe42d4718
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11404163938893667671,11626429993261553299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d6d8e65865c96f34dd3d9f0f01dd92f7

SHA1
de8cbd6f1c5a06b0da9ba68f3617c12989537938

SHA256
721485f858b64bb9c10c744b3d3902b792eecdcd53a58ba0265a088fd30b8b91

SHA512
8bc5c9176210cead74b2325c3e28136c7fcc1f584ef7e713d7f035798c4dbfb7df6c703506d417bd3f9dc38848069a6b6184ee76cd67f9ff1819f55ff4c0228b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
64925252352f3aec5e281fb913a23b24

SHA1
f540294894f0daaee3c4bd970e2caa4a2eb53a70

SHA256
4a786c38e0d053fcce80b396db1342ee96f5b8c7dbc0517c16d45bfeeec13058

SHA512
47ff9941245474fe342c0a6f0d711e201432ef28b8e25cb7abb19362ebcb8afdd7a4f4026f43e5f6e14a6b0f2b736f6ce69ff3333512e60b6f1679e0d480306e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f4e761241a3a6f0e7d5b117522b72e9d

SHA1
9293b797c4cbb1a3b60d08436bd85f05fcef1999

SHA256
c40137059a85d71499afbef898f9095c9a4015d2da7e4c616859caa0106e791b

SHA512
c4105646a1c2e3984ae4604dd5965204ca9c863fc6fcddd63e1bc9300d8e592a87455ec7d7e51894729fca50d48fc344469da8d7d3ca84254273ddee66b37179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c4e42e1bf23533967d488e422ab885ff

SHA1
b62e1d8eb059e2da01d04488dd579aa695512b72

SHA256
e64dc20963be25f665bdc6a982e43ec0a299dbf76e6c084fd43c6fcafd0ba806

SHA512
bd7ff65f5ceb4dc85368bbb82d97c0c1b7a51de9c02c923c21c0417f8f8f8027687871d213e706b1c462ece1ea052fee2eaf0f4d1e970506fee8ede7351612fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b9bc23fadd6804155356518f38294b2

SHA1
875ec8f7e381e35cbb93226b31d66c9bd54f45e4

SHA256
96f4647c24afacc75243fa88d679379b2a4273bb4673caf48042aeb1c471d108

SHA512
ee1a613fc95ca51614bf02470f5a97df6ac42d5e43c88d05f7f3641e91122482670cd8d410cb92781f262a6ec67f460f0520be75bde2529e42a640311866fd02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3cdf88b338901854663ab2a1dddb9d03

SHA1
4790915e2ac00b0939c5e9f68127cb0206a2afb9

SHA256
589dfae451a2665069dd5dfa1711f2b65062ece3022a49fc6acba144e01913a4

SHA512
abb99f247aadc83f08bf819391815ba64be7c94cbc3328aeca3296f9f006df8b4eaad4d86bb7697cb7dd5e05abd0266d6edec3a9ff7c7db90cdfe8bb331ce1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
288e4782e1a80cec5697598ac5315a28

SHA1
d22dc513af02a7e79b68c9ab37e16efe219325d5

SHA256
c0eb1c667f92025ac165187ae665f1e08516ccc237a2bd03f0266c71e0435ef2

SHA512
2ab05163705017f5129dfa3a4d621bf517bab3495a7a40e790c8e16293e11e7666b306866ae90363685fbcff8baf90f36c02aeae90f7fc73e00c4adea6d5c5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa8161e8a47bde1d1f55bb3119a4c4ae

SHA1
44918d5305cb9632c671a43088d1975c498bc5aa

SHA256
2e3e15a8b865e48f02a509db61f930e2ad8eddcd6c85c1c0739a470b4d0e6418

SHA512
e1e91d120f1e15e1764c36eb21bec71374156f27d5b71dfcac13a9b08ed1ddfa5233c1a9aa5b35779b6227f9ca27846d77b4393b9e9b25d932ec92e4895d3932

Download Submit