93096f6b9e46832250321c796bdd0241ac0fe1d7143587363ae227b75f5d668a

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ecce13891f4edf6bd24054920174032_JaffaCakes118.html
Size

74KB
MD5

5ecce13891f4edf6bd24054920174032
SHA1

66f78881447c38fdbc1c3497d5abfba1695e9822
SHA256

93096f6b9e46832250321c796bdd0241ac0fe1d7143587363ae227b75f5d668a
SHA512

b58d072e9facc0ebfae6c5904ab7d5f605482784cc4c46122fd35a852feb976f2fb018f4d3ca38486747df9724535a685d025c8df73939ac3b1a86844101618a
SSDEEP

1536:a2PYzRIJQL1iF+Eew2A6b0Qznns6FsL41e9OmJJg8vqrzSNu:WRInQw2n4Qznns6FsL41e9OwJg8vqrzN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
2864	msedge.exe
2864	msedge.exe
2932	identity_helper.exe
2932	identity_helper.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2708	2864	msedge.exe	83
PID 2864 wrote to memory of 2708	2864	msedge.exe	83
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 2604	2864	msedge.exe	84
PID 2864 wrote to memory of 4240	2864	msedge.exe	85
PID 2864 wrote to memory of 4240	2864	msedge.exe	85
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86
PID 2864 wrote to memory of 2868	2864	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ecce13891f4edf6bd24054920174032_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce9946f8,0x7ffcce994708,0x7ffcce994718
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12030550135152083000,9884871209489883481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
bd69061d94345d6796f7a0fc08aee07e

SHA1
b45bbcedf42b747fd3bafb0038f6023d237775de

SHA256
06c02c373b15508f12c91c7331743b26fb57d47ed3913e84dc9bd7b557adedb7

SHA512
3376ee8a0293e9c9705e4a3970c4c0611b83a22d2d1096531503a9d999b2cbfc5b6dc04c7f3dc3bab0000d44e22eba5d7232fe84a0c59f415faf120749c532cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
ed63e15154b9128dc13272b855cf688c

SHA1
bfe7c3c6dc880326094b9ff8c2b9b59cad4ea3f5

SHA256
eff4c9093c4b7656374514b36036553ce7fa314df76aaa1dcd51d5ce69a978a0

SHA512
5c278f146392b336920dc454d4a4c420e9cff2c3aa158838b557e9f72573aa41453d5d3f2045c4ca3c978f27ea5176ca4614bbb189252540f53fd70b899e428b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
29ab970563107b1f4b7e874a90439ad4

SHA1
ef83d73230a7f798ae94200a1cbcb5a3a3a65d26

SHA256
8241dfd2f224a1a453762ef508261bd728b5718a6eea8ef41571e0d65cc9c65d

SHA512
e05e9105a453fe4eb0965e8b8b10c20820eda51a8b6aeb02c573c9d852bc224e7cf936c235d2c5f9676725505a68e046ecc432d1e513b5d938e31b5314cde323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55cd910c667b17672de43e979ceb63c6

SHA1
17e9e14ce04b0b8e272eb6c45e6e3653c2c21019

SHA256
90edf0a5c5f375d853ef0abb347cefd7bdb00b5d940161e2f0ad4cffb2691982

SHA512
bf87733a2dec577a268e505fe7ba887c6cb33550322ef0775c0af31196a68abdcff44d70346bfb7e14f05e54197d605e28c14e90189a4ba992ed5fb50cf2d04d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
398540ceb9121ae565293a104b42c1dd

SHA1
9e861c655835f13c3b6926c3a781c08db6633c8f

SHA256
4bb15af774938dd8db94dd66401c111e2d57e8af58ab45d9da851ea61d0b47ce

SHA512
5c7373c28d7a1313ee30203c989b4e059cad88bdfaa24f6b860e5a2aee794769829f10e93b6c7c52dc5f1d0067e05b035d4df37ed19ba23feb3493c1bdcaccae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
890d292db1cf9ee2fc517b1e470a63d1

SHA1
21dc33d0263cffe6dbf6191ebe779702dd843a7a

SHA256
82a7eb08ade046bec15f961929143c84f634ff13b2c6b3bb40735d5d37c31dd4

SHA512
03b985d8498772013c10bc84eafc82186987f399840dc1ce44caed3b675b17d0fcc76a4b63099838828126f62846a527c42da91f890cf08056fda5a4eea55e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f463decd64a68a449cca510054d7c1e

SHA1
715093b5b5330a1e09cbc1faa71e2b6173c751c9

SHA256
730779439a4e9da0fa9d66c0f31897520d20f56b7d3fdb20a59fb3333633263d

SHA512
44568c79b89d49198909efeb0bce6b41323c3a63e43f0133edf2f8d682869738dcf85dce1b924d12e04274dfe6601cf27c6efd187f643ed48a6805418541e2b5

Download Submit