2da80c4a47c8658bf2b714baccbb6f6424de40fe3e358a6cc0dbe8471863add6

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69059960a8f4a09892e0d149cdddaa41_JaffaCakes118.html
Size

71KB
MD5

69059960a8f4a09892e0d149cdddaa41
SHA1

29888e62fd6a9956cd65bd6d5d82f6b3d0de1c14
SHA256

2da80c4a47c8658bf2b714baccbb6f6424de40fe3e358a6cc0dbe8471863add6
SHA512

462bcbada1776e0970bb602409953626003f03f028ec31ebbca97b76511fb2e81a42d5b2300e89c31981e6ad179c7fb402d6bec8e33fa72aa08dc10f7534da87
SSDEEP

1536:iHe/QgK+AS5Q7i8hYg2Ls5fy+Jn15/NNWPGlCdY3K7+m:Ien1QHVYcy+Jn15VNTlCt7+m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3908	msedge.exe
3908	msedge.exe
4084	msedge.exe
4084	msedge.exe
3624	identity_helper.exe
3624	identity_helper.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4084 wrote to memory of 3536	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 3536	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 2864	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 3908	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 3908	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe
PID 4084 wrote to memory of 4492	4084	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69059960a8f4a09892e0d149cdddaa41_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefd5946f8,0x7ffefd594708,0x7ffefd594718
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
2⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
2⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
2⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
2⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17970450624313221682,10289876030937228387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1380 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
bb648264e3603487bdeeb2fc28647103

SHA1
b1ef6aa97e4e62aada56efd0fce9555533edd7bb

SHA256
4565c392192958180d0b8e1887b3e8eb52bfb0e11d98955034846dd2d7a96bda

SHA512
bb87852199ac6760dba8dfdc4f271a0a476cfc582dad07a5065ce10fa6fff620312106cdd6948fbdf90c7317d234ec99afa7d5f8ec197218e5d36c35b9852228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f825c3767125f85d35bfb3c59bebe791

SHA1
3cdc90f754e20f320beec71deab594d22eb76b7b

SHA256
dae79b119d1d4cb9eca8bcc7677a7bad7be3ac6a08b58dea1875bddd2633b998

SHA512
ecf7688ad907657d2085009b168531c0a0e0067e80380651ff59f4af0c947e50f9e1dafabd98757e42387ced6a328bae8be70920d179899f9e0bf84550879c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
212fe8384af26b1bf13dec91b34a3f01

SHA1
71d1ad5b27524ac1eb9eb861dc683bcf3f20e55c

SHA256
258b99c48f33fad3674e479c238f768ca66948dbbcbdf2cf0feb32d7d10814c0

SHA512
e491c201445a9ecc9cd8cc934f957cdbadb06a9ab180bea5bb4e57693292a5efcfaaebdd590e51452d426dc1623e1ae5b42f32331a96a5c70092c90636b6dd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c374c5940868934f8633ba42daa198bd

SHA1
5fcfe85ef24312a97b91bc280a2848ac0b222533

SHA256
92a5a235bccdec0083e5b59742c6a1c5c27e261e1b2e902477172b8142564f4c

SHA512
35ea41ca67563e09bd7c44d0fbef32733efcb46383dc06eb15c15dd71616aa4bb155a74c4ac85f19c1ce7dad65fa49c509277436b06d4d5167e2a77f4dc38e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2a635d94c221490651dd99a08a825003

SHA1
0dcb2d6d3c040d3e4f2f798699f4d769432136d5

SHA256
8da2a8739bf9f93766074f9d04f3d02b882b35fc4ea249b6f0327a185578020a

SHA512
eb377447566f4aab2844212b9e2e288c4005318d4457679477c903aed8667387d2f678b2ea6031b85190adba8c650e32edae09bd342b16d93c6943df8c8335e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d1454d01b0f0c6e9ac01f7f0637d7029

SHA1
e6bc68844f777bdf48831d89352ac15fd3f9deaf

SHA256
eba6e4a6364d927cac6bc14da173b38823ee2533aba45b267db7e02185f23a2e

SHA512
769af565d1a755fcbcdaa94dd9d91e5cca54778e053cb0389fb2b0d5c384f23c8c616852ae7d427b4d7bfc1c4f3df7dc494a092095c8009bb14ca8edc40df40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c41b771dddda51cd038ce7fcdf2cd4e

SHA1
3ddcc05f336606745ea130f6c6f2352447f95395

SHA256
69f49e3ba5094a0d9eae40f66641e6484e7c2e66e9c0b6c965c322c35a00497c

SHA512
d4fd89dbdc2f235d9feee414f018d6bfa32955b5aab988d8ad8536e0a0fe454afe9b9e3f57b461b299ff5f042e0e8ab2abb862626ca4244d9d11566f4a0b873b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a17a065733f3a5f89b90bd89e7d7f4b3

SHA1
af0a5fb4b108888103dd1a185e97a4a728953f57

SHA256
e1a712e69f2d9f17c028765cfcb59610aa1bddf937f52f4c42891906cce1f699

SHA512
ef20acc86575e149b23f5f38b90f0d7ab9955c1f79a685c521bbe3382e1b3505050074f87af4e6a90aeefc0afc4ee9cd79bd001e2d50080020c6718779076532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
aa050e9e0fac8a0685ca2a6c385154c5

SHA1
a26d47489ce2e873e5b8058609d397593deb3f76

SHA256
0484fb38b5600b0aedecf231dfa9b133b94b2bbb3e682f50da77af431cb47e37

SHA512
7880bac6fe75b1b573c492a48777430df567da300f51744b8ac11acb5b508b7c2c23202b4f00ed269b3bf59830d6c9fe8021a625c547a4c65067787a2d6f2fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b93e35ba181a33fe79c886e8fc6e4f4f

SHA1
d0d9a85589b5e3405dcf53d6b56dc4239f647528

SHA256
031161c0755b2cb3aae2a06f6ca19536542423bb17374dbbe910678e82c99c68

SHA512
f2c7d5235842322d675b879fd5d27f0df1fa6adb3445d66833c08326e600c29f4315399e96e89fd683fa43bba19fe1ce107894eae5350c6c02dc3bbc92926f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca43de629a245aebc152cd4b6682ecb2

SHA1
b3aadb446dabda0d33d706043d6bc40c375f2fab

SHA256
c853f20524a69a6f9f60294168d4f223a8068ffbbb045132dd8708fea606c81d

SHA512
d39411cd4d2c3f8b669519b554e67a35cded27f10f99d05b9560cd425a2827136bfbd681de0f48921c8c13d3c9dd1dcccefca58621445cfc35540d0fc7ff8fa3

Download Submit
\??\pipe\LOCAL\crashpad_4084_PFHSWBPGQCDLCBMH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit