edae9d71087042a5c7dc996edf4c8d36ba02d3d681bc14da4bf2c0cfd7459edd

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67f53e9a6a9dd42ae068a76b3ebc66b0_JaffaCakes118.html
Size

108KB
MD5

67f53e9a6a9dd42ae068a76b3ebc66b0
SHA1

cdef8c9ffadecbc00d845e8eff7fc5c9dc71d86f
SHA256

edae9d71087042a5c7dc996edf4c8d36ba02d3d681bc14da4bf2c0cfd7459edd
SHA512

e35b0bdecadf88a94fa01d68680e762ee381efa493537880c03a2a3ae65c1beb2299f363fd34c0fed6152772b9e1a91cad8446b5dd4cdbfe2edf6796c810fe42
SSDEEP

3072:UrI5k2jmiQfogyq/Pr4UdMrehjz3q4L5I:4pGehjzi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3156	msedge.exe
3156	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 952	3156	msedge.exe	85
PID 3156 wrote to memory of 952	3156	msedge.exe	85
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3952	3156	msedge.exe	86
PID 3156 wrote to memory of 3492	3156	msedge.exe	87
PID 3156 wrote to memory of 3492	3156	msedge.exe	87
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88
PID 3156 wrote to memory of 1916	3156	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\67f53e9a6a9dd42ae068a76b3ebc66b0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a64718
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7484764746141201865,1437160246967285991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
4ad590d94d639dfc35753d6d053a0050

SHA1
0f259944de0625b281b94ecde5d0f372adbb029d

SHA256
e2adfc7a9d83cf20897c30672f227ef573080873bcd4d573e82a96e7bc89d6af

SHA512
80ec5675c6221e3a73c958dc3a505aac9c20b192cd6841b0bddb56fcd455c451594828b5d4c8b07f76b484a81b2e733ba570f023560ba21de65dfe3c3186fbb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bd0e3eca644512ae781476c2402e1bbb

SHA1
a1b156c5560d3a5720738b04cda5ae8b2b053bf6

SHA256
48c975a77b6ee5fec60c1ead8fabeb0e058c5969768ac412bfa15b7e2ac0ffe3

SHA512
b620b4d7876c2343b2120ebde88e86678ff274c69a26e560e2e1247f60dfd375e53eaa67d2955313684d03c32dc2626f25145deb12ee540d631c20f6f4433769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c787e80a55cd4b163acc0b7a99fc6f18

SHA1
c1c8e4748f714c0a132f82c7ec2149b62f5b1e15

SHA256
07f99ea1706e5bcf338759e004b624caeca71c09b60feeb355839ad20e9e07d5

SHA512
801e3ce5460004440f00fdedd18068c814175570d7ead5ca1b3202d2bb14e70a44486f1e6e0ce068dad9f36b25e34b64c028e5eb44577418082795336b153789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af9b3ecfcfb9caf5172e7b7b8a459917

SHA1
7b9c7dd8ab1046d96ac7414c238e64951c2c5beb

SHA256
d55bf803f5781a31effda4b49cf9443c1a0cdbd04a1b3d96f15d830cf525aff6

SHA512
1d950bcddf98f8658e533000adfb0dbc6b4de8708c4ac64fc749526e6475fd594cb40b772fc13debd3063f2754ca6e927a2f1b2c5b2137afb87b9e2526bb8f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ba463ae3bb4f50187772589229528f4b

SHA1
f52780410910b443b97caaba9712189cf5937241

SHA256
29fe336cadc33a14c0f911d0f01650869407442569090179070b019aeb1cd5ce

SHA512
83a74b926671fb1199a240cebe90a5111c286481f0e3d2d2595d87afd481e6efe8fc4397380725fa40c69b341f71c5fd61720463bb95efb86820393bdd99e935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
52732f196ef0f53ae6438a01d74f06b1

SHA1
15f8fb40dcd3c246d626340736e5c51da0f2b453

SHA256
b0e1e28659b7ac5c1a8307d70df0f7ae087729eaf320a5abf9a0677a20283b90

SHA512
8ee2b4e331a684e23ce954bb751bc4da8fdd05ac46db3b9f82377d8e5a08e587736a77a3eb0cd910a61dbb42ee5beef124427b6e1114acdd0bc946012ed79121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4ef9a9d90c2df59675989621d34d04d

SHA1
f0d3a88fc2812268c264a4ea3a8c4f86b79e0d9f

SHA256
2c31cef68dca38fbe4aeb1d2464dce7077b878e1952f21aa4a251aef36efbd47

SHA512
52698d0d683c5e9c35f2ff2697daab2d65653e7a647025e56e2019c049cedb0c050f47bca1312544bfa9f3041f96e8f6524b7bd0cbbe16675a8ca8a83ab2629d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c563.TMP

Filesize
539B

MD5
34edf01fd9a5d4349289aef002d6b305

SHA1
7f4c7037ec0621ba7c556a85c74aed5b7c783958

SHA256
c6bf717d719958fdc0eb5211e8167cbdb81ae8cbb21d4bbeb38e6b43f2c449ec

SHA512
bb8b227aa33e1499c564417acc69bf78afcac378b2eefcc874e3bd825e6667f1b3040a4fbf694661c2e38b56c0ad1275db58abfbc5e300652a66069130def023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8d5d19d8f73bb9a9f0539af033c7292

SHA1
64780191baca238cba0c834a9bc02d8fb080b34c

SHA256
1ad008d0416d1c38b67155e35e5242d373408e5725a3fe6bf7d69a12fc3c6324

SHA512
c0d5d469a333d5cf61a61b662fbf100e847cd6dcaf4fb53aa491c5b6b2f53f458a955ae08d764a48c1bbb09159b33cdf1a6d3dedce4f536d607dd971e7f72eeb

Download Submit