7ec87049215a07cb2cb3a35854981677981f6812ea9c9ee0a62e715b9d774436

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cc7a794ebe0177e33b549c9f156e88_JaffaCakes118.html
Size

130KB
MD5

65cc7a794ebe0177e33b549c9f156e88
SHA1

505f042b7c0db37909a6638c25a8e73656b62fdb
SHA256

7ec87049215a07cb2cb3a35854981677981f6812ea9c9ee0a62e715b9d774436
SHA512

30e6fd410133ab78d32d3e540303f335e57a025220e2d4bfc3d74557ec7689f3342459c64d3ecfbd7530f82452970e6b8660dada7ce671eddb431a18c056ade1
SSDEEP

3072:r+Y2MYJ6rHfgaToXdYKOg0N2BRm0kDFtzh/eD/S7/kx9N:rBoaTob4/eDf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2352	msedge.exe
2352	msedge.exe
2252	msedge.exe
2252	msedge.exe
3096	identity_helper.exe
3096	identity_helper.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2252 wrote to memory of 5096	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 5096	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 512	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 2352	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 2352	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe
PID 2252 wrote to memory of 3808	2252	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65cc7a794ebe0177e33b549c9f156e88_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
2⤵
PID:512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
2⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
2⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
2⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
2⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
2⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
2⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
2⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10828542325138348270,6898247255728548626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
37d07854f295b30fce7226567326e7ad

SHA1
81b1b333de96e05c831ed507b1ae1cdc279280f8

SHA256
13f40f6e8c92ae9478dc03e856a0136ff3261c7735c0aafb2102a946383a5d0d

SHA512
e125f2063ef825ced5f1489991f7afa1418ba4a8f908c27b0bea7e61f801136014cd9d3ee84e4096696d3f286cf41f962a45eb1d22f45de3cdf29c1baa186a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
f930c47282f57a93091b2f93ed69c80e

SHA1
3cd227379bc547b659dd35658d03db8703c476d8

SHA256
25bb419e493f309bca414c3f524dea5e200e734f33c16944503886d46c9660d8

SHA512
0c25b42c26de989e4c48576531bbd64c245c32fe34459229f5cf5567658eed29cef0030e53292a4a6549d17c6e3e8e37196dda17bb4a57d0ac8d3b0c5f2cb2a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
b098d97a3c086c721b6a736a0bff7a2a

SHA1
474e5db70fe21359bafcac24e91d2a75d6a3370c

SHA256
c13aa97d8e63a9b8d2c9978d6bb878e5ef81aaa32d6e0ae9ae858045e1d2ac99

SHA512
92287b7ac5e0ab03eca4f92b9ad053e0f56cd8f8e41887916c07a520e9d8b6a6428f0d38ffc2b90b071bbaf13dcd2bdfd583bc47562052b0736a303ffb0e2359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
438df979dbc19ab787f9938e840d5bbe

SHA1
1dd1221cc63777123b0282b69b31eca90069dfc3

SHA256
8a66f484ded7ffee47f364bc870a4119b7b715b05bdb7fe6929caf1acbb506ae

SHA512
29f904a8fa9b126fc638db7a5dada89bd3498cf2a7f207ef7bcb5847f5bb427cf0a7469470a45d6a57efed71001e62bfaf93a32238c1400ebc0dad825491a151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1f8b3d994edeacbe13accff1ab379613

SHA1
4155a288306943d00e967e3edcd991c7178facb6

SHA256
addd81c39bcb7c60f69f90c258fdea7835cd413aad55f144d9deb2e4584bf55d

SHA512
b939b6017c31e7eece25da576abbef041a86fbfbab1c1004ff2740b18a8da4c92a0652d6828bafeeffcc7abce614fb675ad8d12de9a51a5fcbccd06121d62e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
322808e706560a8b6aad8e5ac36198e4

SHA1
6e7129c59c9881adddd8f54170b680c0684cb735

SHA256
0f49b7680c25c8eec865c9b2e0de684d6c7ee10d53abf4a2b431dcd70141bce6

SHA512
4c3bc5ef70017b1679e98a35a85e2ac83d1018acb13e1f802d8c3fb825a08393bc6e7d63eb73f7477f22dec55b56b42371f4c4c714fc96bff2a288f4a420cb10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
13dcef05d3de59eae6cf5c4553f1107b

SHA1
69da00cb0586f4fc0dad4df1012c42e4fb0a5fdf

SHA256
9fb2a5edfaa362dbbdab1a42c415f570fa1f6c24c79ec63e1b3c0527893fe6cf

SHA512
c9e9e7249c207293f41c8baebe5508a1974c0da2b2431120039bc81af8ea5853d82848e11e7dc9f8295918e5c30e147e2f5fef909241122a455314d2bfd1bb64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
20c87dca5a47d2bfad96102f180e6ef8

SHA1
0960c1a4627ca008980d082a4ffcdfffe337dd37

SHA256
8c49cd8578ebd49d7fd6165a0b81fa23fe4bd3df94eb8f0dcb4f2e5a1e513f7c

SHA512
75afa86e0207734b5813c37144a73508092c6ede345cf8d2d1c963f0f9b6dfe8be8ec7d0869b93e94e6e495158b0d1dc06c1815ce6372761d1df9199101974a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
ba79fd1fecf246a0d69994969d193d1f

SHA1
2a20b9460b8e40250d321a7eb3381fb255404334

SHA256
0f2950104d6b83d4a1245c05daffc1ca61d084478b37a2e8c8413ea611a8f7c0

SHA512
ce0fbe999d62baaee22db9c66fb0efb9e7d848a3736895420002b2a7bbd04139b409a433f43087ba45a4d8d12e2f8c1d654e0175c13a6970b7db75bed192c3df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
370B

MD5
b9031fa35a3f8dd8fb35cfe9ead605ad

SHA1
276528b4cfda2e6385333fb64ea88155e27c5845

SHA256
ee1e4f30bb1dfa35258218117f45fb4f3c683bdfa5bf2f3e0cabdc7c06170142

SHA512
7a3885e9d16a13acce073a0d7f1d2ccf73002e289b687f34d7f3713a725e9da93508dfe857e648534bf8f7b74e2e0b22638472a8371f283c60deb0c1efae1724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e857.TMP
Filesize
370B

MD5
b7169536259ba9ed4c704582c3aa1f8d

SHA1
5976ecd2f3fecacabf3c94e59fc3139472cb3229

SHA256
03fc78a774240f30b6506048e742fb6a71fa5cb851ba062ad6f89e3ce0dde9b0

SHA512
fe76fa7cdfdbc312f9b94f695ac4308ad05120f114e0a8b0baccc74aab45e48d95885020094081e1d44c856cd75b28af2af13db001c2f3b465201ccd3c91c97d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bccf680f15f7ccaaf3fefec17a63fe7e

SHA1
83f3e16d1f5d1f1c930b0168de1c2a0ea54406f1

SHA256
d772d4d03bff151264d134af3a2b8b061834c501a0c5e988f011087c6ff13cc4

SHA512
eb9de336164c016076ae9f0ec12229549bae6a344e086c32bbe66da8788ce5be5e5323c6fc19ec591c4a379a5e40aa5787c6bdb35acc77dc0f433577456060ff

Download Submit
\??\pipe\LOCAL\crashpad_2252_UGJSOLAHYHOVIGEX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit