08e8c5922f7ce5067f9c253a31fc09b4fa72fbc3ececdb09dbbd848d30fb1517

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38fcf5b9b9e8616704412ce65bc5d78f_JaffaCakes118.html
Size

50KB
MD5

38fcf5b9b9e8616704412ce65bc5d78f
SHA1

dd3c72d4b010183dfaaa178ca28531e352218cfd
SHA256

08e8c5922f7ce5067f9c253a31fc09b4fa72fbc3ececdb09dbbd848d30fb1517
SHA512

b764306cde8e6bb67f682ffcd0a3a2d058e98a6cd901762a15d8cef30adb1f3eecd830942e2ddd1550f864ac36291bbc01c6a9dcc6afdc5c45c3d15901ca8f26
SSDEEP

768:S8bz5luvqCHCQPCSC0CtCDMbaVjB0lSMueRl2L73jNwPb8GKTw:S8xluvq+Hl9g6uAey3iYGJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{47933403-2C2E-4357-8396-DC94642924B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
1896	msedge.exe
1896	msedge.exe
800	msedge.exe
800	msedge.exe
5376	identity_helper.exe
5376	identity_helper.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 4360	1896	msedge.exe	83
PID 1896 wrote to memory of 4360	1896	msedge.exe	83
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 1284	1896	msedge.exe	84
PID 1896 wrote to memory of 2176	1896	msedge.exe	85
PID 1896 wrote to memory of 2176	1896	msedge.exe	85
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86
PID 1896 wrote to memory of 2672	1896	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\38fcf5b9b9e8616704412ce65bc5d78f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8797646f8,0x7ff879764708,0x7ff879764718
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13889099069746082974,16683597371240496143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
a9fab471bab2e2937ffd77300aeda528

SHA1
308c2d3afa64a86312e72c3579d0f913f7b98817

SHA256
9ef21fd5d4f3292cc9116ed2ea15435b06185d51c3c676182720f02768e624bf

SHA512
339601dd038c022ba7467574c4dcb145f0d5225576929929f7259ce42b5f2a73c60f2dab284955b766f1e9caee8566a7f5fef825843680748fd0c1b87712fd9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
db52fbb226bfe82b2fa976b4dcc0acb3

SHA1
a33211769e11eb60f0b133bbfd0200c783d9b14d

SHA256
0cf20f823f867207ce8f77716436e3b3ff52a9900ebcc4d23212f7e699998a11

SHA512
52d51b0f1114c15d695e0ccf53078780fba0a76e507a6911ba813c1e30b7c670c785d948dc2bb49b32bf866e950a40abb7d11827bb50ff19025886bd9cba64ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
f319b77f6ebcf30ef05f40dc0cb40182

SHA1
ea2e7c64e1761d536e449bcfce1c3317e1c8ef2f

SHA256
3d7efdbe8fad362c54146d63e7497542d95b15f1ad5905769f83300a9bbfa686

SHA512
a57be5d92104113fa5a44d14fba1093fd51e71e858a24d90fd8965adfd98fd3c11d72b05cffcf7817f4a9f6c4d6539464d78ad257ac282280d6cb29759f33319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
b574f0239e5d72d9a5cf1d2823deaf5f

SHA1
9449df8160a4606c23b7f9f11057c8cd3ea9cd15

SHA256
3caf695de8f4a35d76456bd32e90748f53e43a62df59248c46d6bb544ffec136

SHA512
97d19ea3848ecb4b9d624a64d17521a4d0cdd95cba833147ec6ed2e5de0e892862b7f8eebb6e4443743e6836a8c93079d1b238c05c6f7a3c410986ff9979b80b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d7179c75f9f9099521152d4df9f2e042

SHA1
0bf06f3ff0ab4419b91eaf5da92b08ea381b9186

SHA256
d29ff234d346b096b3806fdc00fcaebeaf86b07c186caa66af940cf343a4320c

SHA512
1c280e6427ef384fa66e159147731cc24204320bf0d85b18317eeba674daee445d3f6632ce84e93f0133297c7a34077615bf5744ee0700ce0c0d119d32597ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eecc077a58538bf4e9a8b6a7c667810

SHA1
f68e3ad66bc8510d50e1eab6542d8ec779c78138

SHA256
4f251d7e161493539e9d28dc5d68e3210058e6646dbb7c328ce09e04b91d7168

SHA512
bc5780e2164c3ad2caf24b22877eca2c313b8355d3b9ecda335318e7dd576a6f630a59b20c419f4144deccc2a482a613a09400c030fa14f6202b33f675760c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6a489720fef23cef859e30d5a9d48e86

SHA1
d82e9c6fa84245eacdb1003df9f99c3b43bd17d5

SHA256
1ff630f44d92341f6b9c46bf56e1e141c3c5cbffb85600e1105923be59f29bfa

SHA512
6584fffedb276437514fe99f3320354b06f42dc08bc63f689ab3b6ec2be96db25778a0f001c7f12602a3e239c0f69612fc24d255bb45092edf0c77009721e4a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cb5d6b6f149cdfef511ee7d8f2461648

SHA1
d747e330618a97910c39324eabbbc556220dd798

SHA256
8aa2218c5d7f55a9bc12f55b77fa7c796328649dcc696244f42af1f39c2d7d1e

SHA512
a2730b830fcfa415c54e55067f97105bd6dc5189477af6e344fbbd4953d4ab59068ce6647229affa541895bd704c1ef07687f642e77891a20a28afbeea87dccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
29f60cd60ac45254d81252ce7fc5d513

SHA1
e0b7c5c0b47e1c2101c73cf1fe9db66e2d7ae90a

SHA256
4a6de053399b06681e2f00091277279ced7bed79e5cd8b8517c2570020cc4991

SHA512
46735f288e69e62335f00b504cbc94e1b3d1d6c616c6232ba495c347ce86c92521fd4dd1c43f609c9c070fe3b4342beb7df5501a6d04a41272b342d773eb9e97

Download Submit