fa92aab30b7caad3ccd1a37bfbd4f923478414231fbdaf77e9bb192c77853b39

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65dab90e8896993bf0906d4f78457c82_JaffaCakes118.html
Size

28KB
MD5

65dab90e8896993bf0906d4f78457c82
SHA1

e2166e0d7de7986f795eff3058e0ed8d684a6a86
SHA256

fa92aab30b7caad3ccd1a37bfbd4f923478414231fbdaf77e9bb192c77853b39
SHA512

1d1d59d4c442c808ccfd9a76e67a08fce7b055aa5174fe4aec21ae5c2a8c27194811caf44f7cb6b5173c0adb61e52bfdcd978d6284f6aace6a005d7b31c17eac
SSDEEP

384:/WY6KueuTPjEOLKN6+uMQuIfxtpHmfXQKqX:+YHuewfL7+uMQffxyXmX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{8F38F5F9-0EEF-4219-83C8-8D0CEDDA552C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4544	msedge.exe
4544	msedge.exe
844	msedge.exe
844	msedge.exe
4288	msedge.exe
4904	msedge.exe
4904	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

844 msedge.exe
844 msedge.exe
844 msedge.exe
844 msedge.exe
844 msedge.exe
844 msedge.exe
844 msedge.exe
844 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 844 wrote to memory of 4032	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4032	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 1648	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4544	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4544	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe
PID 844 wrote to memory of 4260	844	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65dab90e8896993bf0906d4f78457c82_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5676 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5288 /prefetch:8
2⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5316 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
2⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
2⤵
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8877075739810308068,11202181939909934651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
4237e1b4365297935090b10466e7069d

SHA1
3495e03970af4aa890e56ef4a456a1d595ff543a

SHA256
1230fe3c5cb529fc8d56485257799edbc848e0405ffef9e3f7741bf7c0e1cb96

SHA512
0839b669ce950db510f593db814d3bcd37ef74e681d159b59df13e3955b40d322579b9983f3b0bd643e44d36fcfe1a0edfb8e11da7290ae2b4de05530761cd8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
496ce3cdc7dfa8297c9927988373d20e

SHA1
b82f3980b084f7e4d4ac85270b960d29e782e129

SHA256
3aa58e7b73f33e3249720eb72bab717ad536eee28d05c616a51f800789227c9c

SHA512
30f353743af7849463a33105af9446cd24786eaebb4d281c9c07c1506902cdf0d2a21cebcaef283422ded562d492b9f51b5d216b8aa4c08b5c4df548c8d234c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
316bf86eb7054d03c89282f38dde3944

SHA1
1d0d707fcdf881305f0f590ebb5ef5118cc3ef71

SHA256
b4998fd1b85d1aa4c0b00fcf7097e7ffbfa492708c88d412307cf0173aae40f0

SHA512
2059ceddc4967f3c3d40231ba92e0f3c50b545e9d511e9cefa0b1df38419581d94ee8645f5b5c0fd1a56a8f34546ed9448e2a61a2cb6a01e6331cf3d3ae9b7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
90b65ffeb30c70bf0341d7892cc5ca5b

SHA1
7755c071748a8917aab4247bc2032049608f41c1

SHA256
378f476b0815e041baad48e825c2c413a8404b71576addde19e9510d78895560

SHA512
1c8dbf19b36cf76dc5d43ac6a1ca14d0d94766f774de1721142ad84ae56591b07da80e2d0472f5b5ec9239f9c9318b71cc3036dd15e2ca27018da96f877d61e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
288ba1653fab2a3416c0f82d95cf502d

SHA1
6655fd3f107f2d63e721ef7a2041b8e834cb3f80

SHA256
bb595ae0a1b5a30c85d11599a37ba346e90c95825e792cb6354a182037cd454d

SHA512
1dad32046498423125fd39ed1e7eddbec6e2d0fad23fd5a8c31cf30bd4627b5ad7fc00b9d31d68d7a7b84cb92e9098df29f9c44334901be8a0fefd8999133df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2ef498e69829becf7a28a1e17c0d0386

SHA1
c646d92e6acd2551aa01104277088d085bec74c1

SHA256
cac06b2abacef20ac0731cb5eed7f61e188700da567308fbe1218f8c291d4521

SHA512
377a9b50670385757fe14977f438a1093fe4c5e22fb97b315186cb26a8c1f937896fcaa6ead550fd9193337295650c0d59acade403264c7398aa92af0436ab6a

Download Submit
\??\pipe\LOCAL\crashpad_844_VMKSBCQLUHHDNKRA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit