75889be46d1c3851d4eb4057b7c66c4aed9a4c22ffd7fe62134d453bc9e359f2

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69729810d2aa24512b6e28347feaf72f_JaffaCakes118.html
Size

75KB
MD5

69729810d2aa24512b6e28347feaf72f
SHA1

6eeaa2344f58eb6e3fa376f9e010edffcb93e603
SHA256

75889be46d1c3851d4eb4057b7c66c4aed9a4c22ffd7fe62134d453bc9e359f2
SHA512

b4426b54bedf0c2ed96338f265dd3312cef24cf44aec5d0284b077334b26e9f2bd73aceda6f2faf3b57f235c6d629dc5b1cf5a6d0f27d5b859712b76ede3b697
SSDEEP

768:ZgOriWNcaSoBgG7qkufORZMFFX/cYhaJPLEHEek6cTLkXtG8vFzNbPq29yb5:uaNqZOR6FrGiEe1I8vFpbP45

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{B1D362FC-DBE2-4FB3-960F-90F6631E25E7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4356	msedge.exe
4356	msedge.exe
2116	msedge.exe
2116	msedge.exe
2740	msedge.exe
2740	msedge.exe
960	identity_helper.exe
960	identity_helper.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

660
660
660
660

pid	process
660
660
660
660

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2116 wrote to memory of 2588	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 2588	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 5020	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 4356	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 4356	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe
PID 2116 wrote to memory of 644	2116	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69729810d2aa24512b6e28347feaf72f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
2⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
2⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 /prefetch:8
2⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3248 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:8
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
2⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
2⤵
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
2⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
2⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,1693446282860664698,10995635545364563939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
384B

MD5
9d6eb96c61633b07a9b4b6c493b13bc2

SHA1
7d4aac13f4ee8419294a08dcb67f6ad184f68678

SHA256
aeb48715f0a81f13a8e2a329c13ff95554f846150d429e13474ae3edc84e36f8

SHA512
0b842da57685a55dc439eb85a0e51c59d3d2acf9f13c84c6d35ad851430f81828d6e874b945e2e582634c143472d553509462badaf5480bf8855098c18fa62ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
42da947faa1f144608f9748341c90e0e

SHA1
51b668ad1a72a3a4d42685801dc1aac96bb02a87

SHA256
f1c4d614a402f00fa464e5affd0c4ec63e0e3399ea5c90b349dd500d570a3ad3

SHA512
c68d7c428dddbf87faa6e988be33f83f5047b9d1079ac89fda88e8ad14f61d5920b01732716f9943e6f291669fc488c94e805152e4cfa0bfa0d32ba4b215d76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
1084db0d6ae6f46d2d8e4d92fd865e71

SHA1
986a4580e3410a908a2541fb3f93a2e08605cc66

SHA256
572b7e9a6024c7446c383ff5a3283ff382615119de3b80a554c4473e7791f787

SHA512
9eb6d0c8fbc7f2ede42aaa04b4ced71b33dbf6acf628de15192bc065b3c1fe427a681824222d8e51ee04672cfaeb650360717361371255239b77f9977608d02e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7f4898a2309b50caa56db93f38fdb7ef

SHA1
fc5be18f77e0af70c9134eb47f2ec996cd0b2dcc

SHA256
27fcc195147263eda8a90fd52a08602bad18eba105e1f6718cfc8d18a93775d3

SHA512
19e76abda77a11b5d2e91eb9805e8e1f07fd1639db48f0a009bac4e29ccfeb2d0ec5361c0089c2e4133708ee8b67a5b053fd174f48503201fe710ad38d1d91f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
cd96e2ec1a7cb84151556401ee5873c5

SHA1
dddb43193425785925265396dc339a4f908b852a

SHA256
9db7deb3e3afa74713ec2d5160e5c9aef54b45d43378f77caf05410e6e093e50

SHA512
67295242dc3dd25fae9e26d2260e4ef797d57a8cc5fd4baeeedb34e035a5e063b31c16244bc82f293054073ce04338b140e59143b4f275e9d24b1139c1ec8473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c47a43102b5d02d9e8ff78ef09cb99b4

SHA1
d458f15cd44d75df599f0e321927a140f8c9f8bb

SHA256
3a774bf722e399e848dd7e22679b8f4f3f7c9da10f02da5a3ac0ac4499c3e6a7

SHA512
dbc1d9bfbf4228fac6f7fda672fea6aceba3f4b19b7a6f638313faa55a388eea917906401a4aceee24bf6ce0c705b089a3c034f9ee5760aa1b01ce0ab4982d4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
adde32999e2cc13b0f2ce4e8f6e1b946

SHA1
7d7ffb002df46b7b384c2a86d15de86697201dc8

SHA256
50e7f8a43692d49695510a6c5c2a852369811ceaddfdc2b36ec9dbcd033b8d5e

SHA512
444576dd6b2fb47af2daf1aa00c57cc903aa5a141bf585399be1cc7019cdc55f1e20f175c9b507339b898b768e4be19675dfad3061a7bd78dac25a74dbc50841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e887c8a84a17a89057ac48948f3e7068

SHA1
9d91de757d3874eb7228b63479fa1cf474b4dda7

SHA256
72d79d85e8f1de0dbde8443710553f2c7c00ca005b422ca6aa43546bb2be52d2

SHA512
455641dca1db50e9c2e2ce30462bb9b5fd4f904347546686946cbd10713b07661c3bc61e38ce1ecef2935fb6e5cabcbaf7e08a417da713661800a945282f746b

Download Submit
\??\pipe\LOCAL\crashpad_2116_FQODRSTUNIMQKPFP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit