53cf248d7d827b70934f08abcdb18d4217d36d5b6ede67c50f9e21124c7d8d5a

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693a35d27b9fc9323018a1884ab1094f_JaffaCakes118.html
Size

21KB
MD5

693a35d27b9fc9323018a1884ab1094f
SHA1

0ccc37837cb4a05c36ac394cb85e8b6b1d26fe9d
SHA256

53cf248d7d827b70934f08abcdb18d4217d36d5b6ede67c50f9e21124c7d8d5a
SHA512

3a6ede53e6a782f8cb21951ab96803b081a6bda889d97466381156e90a4a1b931d17d0062f78141e62cb632b8e9ae149c50a9a67b07a09ecb825dc0de4da95e6
SSDEEP

384:KAny6dXLnqlPUPnZHu76AeYCK1/hywlyEaepyD1txc4muZX:Rd7qlPUPnZHVArCKJhywlSepyD1txc9S

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3492	msedge.exe
3492	msedge.exe
3356	msedge.exe
3356	msedge.exe
5524	identity_helper.exe
5524	identity_helper.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe
5896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3356 wrote to memory of 3568	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3568	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4660	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3492	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3492	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 1716	3356	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\693a35d27b9fc9323018a1884ab1094f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
2⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
2⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
2⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
2⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
2⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
2⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
2⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
2⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2065807052036160242,18295194386174142188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6132 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
29f03272d2870144d89c549c07e7a3da

SHA1
917c4b7df53d7e0e17480c81b2fd491489d5830f

SHA256
c0e22cd16444d1a3b50a5730142868a588d8c00661008985a94e187f7b13630d

SHA512
dfe96187d4086dfdeb26b8883c7b08f3b81ef84ac05441bd72aa50ad209eba446b6f24022d6dfb86b13c9078d9cdc877365b4c4a913d7ee1c67a5e86f20dc10f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
13bddaf819c007b4de457e2655d224d1

SHA1
d55f6acb3725dce947a233b1ce47fab466cd712b

SHA256
a6775dea7fdb3406b33c3385b7275234631cd130779f4b4ceb053a6d68ad9dd1

SHA512
4fbdc5be42471e1fd7e4c58af2bac5fd92ccfaa52ddad23e55ccbd69e98802e15de43977379a7a2d0cbc839f5a427e6a9e759d8f68f4b12fb7c56d1005bd3af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6bf49fc5727413132795bbac8b3e2556

SHA1
8c9954dd157d85ed081e01ad3dd09855c11fc8f6

SHA256
650e9a851937387848600aa0348f9237f172a2d55700a32495e30bf730484fb2

SHA512
57c053383e111c69bdc441b4501a63dce28c7c3b463e78cf3aeb9b327c95ebb3a3d893accb91014b190f6cc31b52cc2741b2c33d15815a14270aba4f1bead8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8dbd8768f6c8f2d9e8930fa3dd91e08d

SHA1
084d816323e7bd2a323223844004403ceee83f79

SHA256
b372234fd30c512ce4cfb7ee9b9628910d5d9d0ac804e2c578810b08d142e0a5

SHA512
9d15ea85e335c743c92c0d44051a917f4aa187f66ca6a74526f15adeac77ec4f3b9d833e13d46dd6a881c14fde9a350f1401e8083d89fefacf40cd4abb831fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b1c930ab44d7dac11410a967e7cfa86

SHA1
5cae2a3e0ae83ca64db44138b1c4b3a29d99523b

SHA256
fde8c53b5ee812a98541e7bc672ba698fb4c2c31d782a391400ed2ddd405a9db

SHA512
c0e893aecd1b02cbda3d3ec220d788ede314cd193a777956e0ec39e6ec102aaf6ab6525f8bbc92a5b6d961fc19ffdac103ebeee114c08a630120b4fe1aa68888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed34c10c65048ec3692ed06fb2699448

SHA1
727563b13828f2c6e79d206df79936509bb0128f

SHA256
2ec549f10547ff082e1817865924b2525c31f5dfe1862d9b19871a98b82c1337

SHA512
48490ca0f441518745986ab65da2b91eee17054fc98accfcca57ec08197df4153450659fcd8e91197cdb0a9d207c883807a598d3b25ae399955a5c197f34a128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6ad67b03ac86e56def82a7b6e9c1cbdb

SHA1
77dddfcf5d21799a54c3727e6c46db66d10ad262

SHA256
d9050fb15e98ad73428443672d12fe7d8580f06a8a2661eb6898b3ade54164f5

SHA512
59eb1af3a5f882230e9265f2800cda8ef2d9336c1e57377ef0a5e8f878cf1b8600739a0c39c97bf76cfd251ec3e7247008d88656a1fcaf471816d7c1407b166e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
882a772bc193e3e2c5120f22f118fe31

SHA1
75f50669dcc81a9a9416baafd19f8b006829f70f

SHA256
18b2c334502915387219f7b6646883bdb3a64b94d26bf781bc274535ab0c76b6

SHA512
69654ca80e50186d87f65ba8af19f7ec616da1a9be81f8f8bffa0912e040a228bbf5e2db0e176dc15c848527400963af005d35f9fff2a821aeb9a7c1d16fe59c

Download Submit
\??\pipe\LOCAL\crashpad_3356_NQMDTFQBGSAFIBPP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit