e997f6c2df2d3bd596cbb6570ed58a1a8950885c0d7b7bd40b73e835aab2a867

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d69dccd5ff473f6e954de925376661b_JaffaCakes118.html
Size

63KB
MD5

5d69dccd5ff473f6e954de925376661b
SHA1

6ac282483623e8190417847f2475a71b149d45ce
SHA256

e997f6c2df2d3bd596cbb6570ed58a1a8950885c0d7b7bd40b73e835aab2a867
SHA512

8c9e1f86667e6cbc85b344e070bcb86ebfa44964ceaf92386d403168f9142db1a13ebac7d91102b3a3bc2d18dcfc59065b7d90ec410c4a5fdb8ac9f23b87e058
SSDEEP

1536:rQfsLPMKfLyxpSjRSIyCoTWUPsxdPDTsexlXn9BuI3nlZsBNkI:rQfsPfLyx6SvTWUPsxdPDRy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1162180587-977231257-2194346871-1000\{CBFB3DFF-484C-4B5C-961D-0F5A62BC5270}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
3884	msedge.exe
3884	msedge.exe
1100	msedge.exe
1100	msedge.exe
5580	identity_helper.exe
5580	identity_helper.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1368	3884	msedge.exe	83
PID 3884 wrote to memory of 1368	3884	msedge.exe	83
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 892	3884	msedge.exe	84
PID 3884 wrote to memory of 2040	3884	msedge.exe	85
PID 3884 wrote to memory of 2040	3884	msedge.exe	85
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d69dccd5ff473f6e954de925376661b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d07346f8,0x7ff8d0734708,0x7ff8d0734718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4027174180014562003,15576509881428977851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ebbc9d9-d30f-4fef-8233-298b75bd68bb.tmp

Filesize
1KB

MD5
d2a6626653e61dd7485e017b621888db

SHA1
580c58752e4201dbba772466f2941b6f7417b561

SHA256
46ef43ec6ffe12fafb44ab4575a0b589af476dc5909987e882579f355d207a2c

SHA512
33977bc503fba81abce20eb2958f7fd1f732d20009b9ce9f883fa518df7d650c3740c24870d9b643413e80049a2bb4698133f6a4035d68a01df4dcd5c5f769bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9e88fcb2bb8a57da7903baaec77995df

SHA1
433af5858d827193a3ffcbb489bcbbce20d9d2c8

SHA256
8f9e3712fff6fd808b61e983bed8d3c2049f2919398b85942cbf5f4fcc041f64

SHA512
2368b8d0139af7639dc008e45d3a769e1432e492064c8041c8fe4ab3622a8f91f3ea8118587a279e3e5ca9e96c015f4d6451be2de2152361ed0e67710283ac3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
873b2fa687915ad5a85506b188aba2a4

SHA1
9d749ef4c6ae4b36be1a234685bcf46d08bb1c16

SHA256
0085c3e2c71352041cc1a0d6ca1604ba0892878745523a070225471a7c8e56be

SHA512
02d4429a9057530fa043cbe09c0fb431e6b24c283bfa400be61d2e4492d426c1a418948b3c22aea521d6a53f49b322af9d34b02dfa3c5bc72929b803b83a1628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
33b17c4bb6d1d4e716cf87de9fd33355

SHA1
96567ea1242cbf9d47d5a99265b0d34acb4e2963

SHA256
1eec227950e74ae9ebdb66d102fdb857cee2f2289a31cac5e84b07ff830d72aa

SHA512
a8ea9e16bd0a3b1b4e87b2aa73631e27d9f0707b9332482f60cf795aa8d6221b5b84bf9e114f55f107e3314ed916e9d6a0fd465f55ecb0491c034924982371a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2fc07643e6a692bbf0e8631a492a789e

SHA1
8546e566bd81fad90cd7cf615f1d6bbe87f19139

SHA256
ee0bdaed24a987ad06b7570c6fa20e848bb07055a241a7a7ce4405f9b193b317

SHA512
ffb52230b62ed3798edd48fbbc6f6a799ce6e7d93c0242258577216501eec2eda20ba819be6ca66345d0e171b220cf6973a10050040e2f92d78c4a7a085c2ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9df4be2dddaafb995fa407798dde741c

SHA1
873df748f2df6c1c72ad17a853ca16b6fba8cec7

SHA256
beb1d6385e765e9c74feb7e4bc1c2384f5fff8ef842ada402776b8822cb1ff1f

SHA512
fe4d95179f8f8478735756b287eec6f7fa52ee4119358a481533da4f6f4b5966476e1a8036289889ec1010fe06f25b1f99031bb07be2fb169df6d82051d59fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90c1292eee57c45824aca03611f0cefd

SHA1
939354be6f0ae1fa489953cc361e7c1e46789238

SHA256
1a87b4d3bc998f709b329fae0f9d89e814d293e90503b9c0b0a9df96182af160

SHA512
be826aee42851606da1d9257299cdf4389e8cf5f7d0d63d3f117feddd426e58928bf5af0658749b85419a860e28ab37a39f93cef5a785e85f53781bf3d63c10f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee63e3010db5b483c220a15a8fe6a2e6

SHA1
7d6205ed6744666f71e07f5279cc25e7fff1732b

SHA256
d1aa13e60e420e91ae024e42fbf2e7a97aee81a0336b2b26f21388035d653e74

SHA512
260acf1cbf8f4edff570f4d65fd78ed75138c3413f2aa968cfb3a522386551ebf85efaa50277b125f93751c87f8105ee4df175fd1622eb1463a391d065e7059a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3cfe72518296433059310d54ad1ead82

SHA1
b6723e558c78dc969014486840042fb688f96e0e

SHA256
1d3126e20ad1493f38f0bf58df4967dcf824acf11843a0eb464f821f1a9fe58b

SHA512
f5f48c2c6c7c29692940042e8c8f587b20e6eb4095ca2789849e3d57c9d6f2d95fe45025e3fff4e55353419b9138086c66c23f63806095f0dee392175de68631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5767ce79751a43f08bdc3d917531d7ea

SHA1
a7da953c12f79978a1386d2ee302434ade8909e1

SHA256
6c1e4b5f73cc17935f1bcf216b88aebe9cc99322df25418a3661db7231452e74

SHA512
d494b7132e932476650b8698c47f77291de719dac0cd34fec93477a1690e5ed4c56004eb9211499ccb105827dda27126d008d4bcf2870011da164805750a3ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c2cdd52b5183fad1fc0607c22f27d7f

SHA1
0c0c1113c006522938e07f3a0347adbc93d4d721

SHA256
af1e8affca0bc30c2dcc307ad7bd11cef8831dbb38939a5604ff0f476be88b66

SHA512
8412e24020c4fc2cea88fcde4f0c30c6ecd0f43b1fadb075947819fcc92a6e05b4948d900275f40055633a4af057a60cbd42a6a6f0c29fc6ff7d0f01e7bd7819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49d44fe7cff8c6d73886cbaaf2ce4baf

SHA1
976e010e0257d3fac0741bc7cc90cc3ab0d33cb3

SHA256
450cb6afa1f441e0fcd3c865f943c25f7ff87e9cb8ddcde85b443a45d3640eb3

SHA512
07cb0978edfc180b33f21e43a0b837ff65d92c2c07788c200308627b19098605d0fcc65f5f7949f4729f41beb885b6c381bcd391a5469a3a5661d727fd7d58eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b5f2.TMP

Filesize
869B

MD5
932cfb56b2aea21ec66c02a9e3e12e66

SHA1
d41ed5bec243a64fb9f68a459ffd3816a2f529a4

SHA256
184bb03596bb1dd5448c07db9459bcf388d8803214222cab6f10748a651f27b8

SHA512
4fee83152c3e9db291689260898e340fb3195ceb80096fd1f5eedbbbb3e63c14f56920f94b5fd885798fc13ca47a53962f3325930935b9019695ae24a315f997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4049e95787748e0d315a3fa7a29e4f1a

SHA1
6422e05a58f38339a4d83aed51e7566e8c86d0fc

SHA256
2b973bd991e15b0951f899f6c7cc7db24f3221c04a71ccc044eb048709552209

SHA512
18114310216dd8944564368df49e054974a0513b1dccb0f8b8f206cdfae09d582363d5fb6be3d00f1ac6527246d9f97a248564460b90a3164523a01bfcd602d2

Download Submit