1f46499439f3015c194a32f31b27f1bc0e12a50a153ef1974b67fc4ade3e5aa3

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f8652535a34f399496357f4771bfaa_JaffaCakes118.html
Size

77KB
MD5

38f8652535a34f399496357f4771bfaa
SHA1

fc0a27b0449d803daf40456d493851b7558313de
SHA256

1f46499439f3015c194a32f31b27f1bc0e12a50a153ef1974b67fc4ade3e5aa3
SHA512

800812fc07447c68fc769d22210ffab816c77c98c8843b6b42432a5da36f81ea596cb23805d9d3027216b2cbe2928e219e1f77ad9dc83c34bbb62e661187b519
SSDEEP

1536:MbiZtWguGbyWt+huN1BxnigPQFp4F5rrsPKQDccYZCNodlhOtejtn5tKnzak:MbiZtWybyWt+huN1BNPm6P/mTKwodlhg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
1532	msedge.exe
1532	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1940	1532	msedge.exe	83
PID 1532 wrote to memory of 1940	1532	msedge.exe	83
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 4660	1532	msedge.exe	84
PID 1532 wrote to memory of 3940	1532	msedge.exe	85
PID 1532 wrote to memory of 3940	1532	msedge.exe	85
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86
PID 1532 wrote to memory of 2676	1532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\38f8652535a34f399496357f4771bfaa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d7846f8,0x7ff84d784708,0x7ff84d784718
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8146196650273169863,3112128905217429587,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
afdc5520c55f53cef7ad8d9764d3ebad

SHA1
fdb87e8d4cc12a64189b186f681a74d67ad16c90

SHA256
8b6af88b917d79b06d9d934fcf3982e403b2a8e721ec5574343cac83c24432bd

SHA512
ffc75ceb7cd87c9477a33d30a2d185899f8cb12812d5f737fab172c78311c04ba04a4f83bdac260ce39e5514bf00152134b76c8a44c2746a9950dd044ed54715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e124eeea81cf17d5da7f4c1ffdfcf7d7

SHA1
69e3d3869e8a3a2d572feb7266289ae205a46971

SHA256
b86aad1b8052fcd83e8c4214a9134d59af95e8cff6477a4c7894db7e9db9651d

SHA512
27ec744d7de688a0e9c771059a27640f2bb68ca1b424344494e786788690cb00e5da91ae13d466997218101ef52f07fb260459b0b87aa58f4ba427c141f8be08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a9bce77a4471069d4238c8b1706ae25

SHA1
d25a7f3b2cc1467f7086bd5d05c6e11a6374048a

SHA256
5ab92617cfff552ffe3c05aa6621eb98af77a07b33871cdd43f5f499d113c40b

SHA512
b052c1ba398dbae1b0fc80a59e86c63eb979e1305fd40ccc7e2c6ab00fc43a496e3451e0e2cd37b38700416e6d3a2e6a722b141dd48cbe22148cdb68baa30871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e9b243832b82b929e99a5a8b0dcda60

SHA1
4155b39aa9127f3b547e843c1116431b9faf32a7

SHA256
d9830fb7441e822c9262c9dc0fdbf05cf344646095a7a7de5c84f258d06e0f5f

SHA512
c2be8b829bad79c9ea85ad23007f4a6c0bd7e32fa2214b2875c469a10a4bea014a048322c1e1ab7d5ac5f9e7ebfa263cb15f386e6e80e1bbcd6a9e9388d04790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4de66af086aa665fe5806ac39da009a0

SHA1
a6b59700bbaece8c5ae687f0bf3c8a71c7fc4f16

SHA256
31734d54cd66c497c8d6a3a8d55e10dfe11dbb8f96e92be8db635fb477ebc11f

SHA512
bea5ea907bd4e08a56418aef6447e36085b67561cc681b160bc4983c5833d9488ef939989d64e3d9a2144636774eab46eca63327d43ed4542e950b0360a692bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f855dfde06c205441e9839362f475f9

SHA1
7aa5d98d6e7510520a6be640cb05c6bfb77095da

SHA256
11ada6f13aedf6c6efca7426e0326dc54736c1f16d0df3e5b7997163e794dd76

SHA512
e399b29850fdb77c7997ed4771b310466ee70e994fa03cf55ec7c4e9d449ddfb0e004b8b2779b3431c61e0dfa3cfd7ff11996d0f59a79faaa42e250161e20b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
783f14a6e022ca7c6e370c9f0c936a21

SHA1
11bec660218f1af6c158aac007ef62a5f6735e38

SHA256
a2f04e09d0064df99ff7ab1dc09827a8bbce5cb69662ce1a85f7dfa5288a9ad0

SHA512
de637639f061a72e597f55f9ea0c454cc8830bdbd9d4ff5b2a966d4848b767ade54534dd6e62d096e7cbb19e51b06286920db6601053979a7bb3ed21ec35f2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804ae.TMP

Filesize
538B

MD5
c4d2c3de8a45fa04d801cc5afc5dd4fa

SHA1
d108a50f6c2af00395d45adf1e822ae0c3e2f58e

SHA256
b8b20745010524d3eeef4a0e2dffc95a1ca12556eb880cd4e978cd2548adf327

SHA512
7b9e0e255d1f7f81fbccbb29f7076b9b399624ca6583b4da75036088436118938a254901bfeca6da8219aa495f13c260b66ec46976a18852ff99ac83735b2ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d41f1bad604a3e2e56b4c2ea4ae74b6

SHA1
c3647f8354b1792d71d07b8240a29d24c2eca9fc

SHA256
0cc056b80ab97789cf55d88e4ffd627eb883b75b32a335bbe0da134f94b24a81

SHA512
a7bb331e05e7e43280921bd3d6a5b9a4a60e0b72d5124a5eb13bfbcb775335b06ed8e0aab4d601f76a4d047f17b327fee4ff2a28004c8996f15e11335e2ad9b6

Download Submit