26e77e949c2b3a7515e046562b1c32b3ccbd7f64bb221df2b811581dd293aa66

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658c98772a07f7d21a2145f2b200b69d_JaffaCakes118.html
Size

44KB
MD5

658c98772a07f7d21a2145f2b200b69d
SHA1

7606a868489410ef25b79498df10593734a2dae2
SHA256

26e77e949c2b3a7515e046562b1c32b3ccbd7f64bb221df2b811581dd293aa66
SHA512

f9c5df7225fe4d6326132c32ca8e3c24751fde0bb63b3c1ab62668ca04ce938f2107049b1c3de9fe33bc7e843c7cb05cafbab512be392c2464bb5a783115ff5b
SSDEEP

768:3kcluTMoM+o/sOkgAb8f/wYxH9YCNVsD+eL/:3kclpb+lOk55mVY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3256	msedge.exe
3256	msedge.exe
3076	msedge.exe
3076	msedge.exe
4244	identity_helper.exe
4244	identity_helper.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3076 wrote to memory of 2984	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 2984	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3620	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3256	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 3256	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe
PID 3076 wrote to memory of 1888	3076	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\658c98772a07f7d21a2145f2b200b69d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa604a46f8,0x7ffa604a4708,0x7ffa604a4718
2⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
2⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
2⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
2⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
2⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
2⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
2⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2765156031986576554,6313418692564731841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
58dfca9d1e3059160092f30210550b3a

SHA1
e808c582e17eb786202e21651ddd220c83073102

SHA256
27ff9b7b71bd90a71ce94af3b7bb5ba1b3f6c8e416e197da1278c3a6f39a7e41

SHA512
51e109973839bf5f998632fa748e5427dd339f3ec1fda194630e73d5f299aea2a9bceb79f41740fb31289fa588a197c5c5578662942471b9e0d5d462e8929d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
29d837f80461fa0affc0b50e3ec39c84

SHA1
819e71f615ee99fc49cd947454635217bd9253b0

SHA256
f9943dc1dd0b777562bd455c5367af2d46253e88019f0ef4d5c607795a382537

SHA512
240f289140c78e781e376ed703fe749b6223e49ba433aa85d73a68855dc3c727b772b6fe76fd9f2bcb933fc246290060b260a52bee2c430c2a96c6d8e2ed3015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b581850be5773d32b3188898bfcd1f2a

SHA1
9b5cec7be267aeb620e8eb9a6a5db7b0fb38f763

SHA256
82efca352bbdad2ec8822f8e8cd790179c07c31237ae26ec23c2c622739b26af

SHA512
c2bbd883d4e2d996d8658526eb9b78e60711e61ae0dbe32c979d2b7ddecfd9aef23a45f2937a084c0e6d458a998047a3e886e9ccf9feca9dad773c38aef3d1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e50dba71b0e10aebc8f00e93864de1c4

SHA1
e2d355419f91d536bb286a586fae7d25c29fff13

SHA256
b33852d9dc825da6aa614180fccf158534ca4f865dbbd4f0005104b336546a18

SHA512
ae96589988aa2944fba5563eb0d648c2298eee5bed2740ee01d8440ec02e5d934d39d09ff2a922085fb8b483d031db27552bf1717760dd63426d5db734514cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\957c98bda99ead403e965ebb553e712b25665454\index.txt

Filesize
83B

MD5
10c78935d2d1bf44ab67ad0ec263d3ea

SHA1
a7db991ece96a05d83034683c98178332f1824b9

SHA256
aff3ec475afabf5d7b381bcabd8542164d87253ef85c77ce516496525979fd9b

SHA512
38e488729361c305eb30b00a450ad9fdad0dce7656be1e8ecb5c4eeb9dc44a6b0c948fe687275a111a8f93140c147c36823aba7204b85947d57fe63291f7d1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\957c98bda99ead403e965ebb553e712b25665454\index.txt~RFe579683.TMP

Filesize
90B

MD5
6ac4d08cb42c1ef482ff62b8f0cd4782

SHA1
8df467e47286b7b3282f19471a9faad0ef194d5b

SHA256
0b372b252ed4fb0f3dbb136c282721a88b9fb5bb351cec892e3289aed2d07cd5

SHA512
492511281db89fe285faa9d09fe404a088263da0ab23cbd943138e9cb2d86b5204bae35ac128dc0b9ec3e9fca39efbdcf93f481bef11bd559c9f193d8201b0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
72B

MD5
58d6309e778813cc64c36af1904ad419

SHA1
f0fd5a54b4e1d3cb767105c6b042b231ee7958a7

SHA256
0964c5453265ac6ab8feafac1dc99e95863982bb24cd2b5b8f9c14afde683d37

SHA512
f72f17d5d35d21b4cdfeb69122d915ec6b614b7c2da8122621a64e1d8145df7f5965cbbbbac5e3e2aadcbfe8494f808a13bfc8c7e6f53490e858e9573329f4e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579328.TMP

Filesize
48B

MD5
f83a34bf389774bbd0bc7fecb3662bb7

SHA1
d1ad94113f8cc09c051a4757e418ac062b0035d4

SHA256
52726ee55cbbdae656f9b31640b094b667ba1252e8ac930d9cc61de7ed2c7e26

SHA512
24fa650e86c31313accf12313250becc7eb05458ba8c633ffab747a47ff6ae7ce2b65cfb3e170082d4f9ee3d770bd35d9956722e13c94e2af4c1e33b579863d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdf826a7ae1453305d7dd1faa3b1654e

SHA1
cbc42c7405d5a6fd7fd207e32bbec1106deab8c5

SHA256
1c1b888240fe283df03dd1ce417a48123c4f9fb07f21cddf31345575adba578c

SHA512
d21a78410912074099282da0c6476655b8f5284de4ae98893136568bebd671c7652e817658c76262de8ca1dac8a94366d32bed93cc822f84626aa255e7328a7e

Download Submit
\??\pipe\LOCAL\crashpad_3076_XUONDVMQRBAOPDML

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit