9974b52cbac405415130677c6068ebbf2e68a0085c5daba70f4c0c1318ea888e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c7035063cf99ed76b552c6495762e2_JaffaCakes118.html
Size

93KB
MD5

63c7035063cf99ed76b552c6495762e2
SHA1

c18e362336b1a9aaf176fbb318765dd6a351498a
SHA256

9974b52cbac405415130677c6068ebbf2e68a0085c5daba70f4c0c1318ea888e
SHA512

0fbc154276fb6a290cd3b7d5970b7ef18b1428a5ec4b2dbf5e5ed128b6deb5daf941053a4e190b2f461d2d6bfe6faff1ff5d783bb340ce4ba50b0b8de2bde3a2
SSDEEP

1536:RIbfm9r1pUaSAYGA5NbNTY5sTiveiERidAxO1O2Bu5H+h:RIb7aSAYGAvbNTY5sTiveiEVxO1O2Bu0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2792	msedge.exe
2792	msedge.exe
1092	msedge.exe
1092	msedge.exe
116	identity_helper.exe
116	identity_helper.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1092 wrote to memory of 208	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 208	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 624	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 2792	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 2792	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe
PID 1092 wrote to memory of 1116	1092	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63c7035063cf99ed76b552c6495762e2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6e846f8,0x7ffea6e84708,0x7ffea6e84718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5345022691691901602,12748203761383747839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
3fc3f18c1bb973d1c57b73ff4221a88f

SHA1
038a94aa291a38c2567acbcdfc696225bd4bbe7b

SHA256
04632074b8d3ea2e051465911907d1cc5358541907efef8d488be4d932e15438

SHA512
fcffdf0861c71af1ee87665290cfe3bb90fe9a17a3e65113c2450f9d164ab1bc26c08037d7e7e883282a9b4eee8c52adc20f1fbe24070001a49a5815a735f9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
78e296998e0191a37c5b1e73c6438af6

SHA1
097572872575a2cf474753d9d95d42e0fcb3ff3b

SHA256
22d25564c7e1b97bd5e524b11fb367585925cd4e3aa429d2f6ee6a22a326874f

SHA512
01d04df400ffa041cf3bc5f6abff92e848b3cd906a70968f0df6d3bd0c159f25857b02ab01a82c8f5860ea7e00759ea942d0a20d951dba7bda8168821445b2f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3eb2b9bfa7756c483e09435e5ea5166f

SHA1
6b97f2821a55015f0271740a0e92926b3c0899e2

SHA256
bf42a3ff230ba0fc4a8a7717341cbb5735a527c608e6d246a213db6f81912520

SHA512
9d90506c4e3eee595db80d3f4df9bdf5c13d42069b642af82f57b7ddda8df66e8668d302e7eabdc6841295ce37963e91452987ecb59717d6e8c29c2ec1a736bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3910205377dbe82fe27a02d3323a0d4b

SHA1
8cda3a3947f73fecd97bf40cd77fd008e06751aa

SHA256
9880894899ea2573b75bee0f6091389c2acb14503e59b60f2d4d8b3ad3ca84e7

SHA512
5a8bd90801d7fbc691fb72de20908b7d4c8d74444a062cc56af62272fe620ae3ccd7fc148cfdc75a95d4b1b2510135d51f202e4dda651cddd5cf92c545022409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0adb1a1ba2d629d64d5828314b27e71b

SHA1
53067b6ba49b261e88dab232bd84c3a6a282636f

SHA256
48a2ba2526dd8d6de7400ca4dfae047ba846ec8b0c8a228efd9c791943ca69aa

SHA512
c880f2e5e17362cbead74dbeb06968dda09f11a77132cd7bac3b6c0686bfa518214570d53d3daa101ffccc6632e10371f436ce104b226de42ccb1f07298f660d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3be6ce9974fe02d73f810aee2ff9c685

SHA1
4577875ec0810bb0ccf583d09dd80074454c0e4e

SHA256
1fff4469ebee1476782401756cd8990c51ac3630c8f564e5dcb25230b3f1f8d2

SHA512
478f8cc731d0fce233e253849aaff05f29ebb1fc9ab1a18dc520e6a733fbcc0fe1965e0e65ed5c4cb1d84e0e674a83baac37b9a61ccd7ca99e25f2f6f7642d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
051750a0fd3fe72e425c5c051a3a32ad

SHA1
0eb62c93da6313f6b6d025e8e6cc0b8799ff2107

SHA256
aa74f2952570038b00db76c2cb5ce7d67b9de9583cb94eeb07ec47e49240e030

SHA512
57fd645a07818e48909aaadf2d95348dad3069a177316a6b9b04014cef170b27daf737ab68321eb0d9436fc0d64621c569ab278e99fa77155a968433de637432

Download Submit
\??\pipe\LOCAL\crashpad_1092_QTAMVJEBGGURVKYH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit