12ef89c8499883f15dfe467106a6e8a9304c7e1f929479036ad7685f322be8b6

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

74836d8765548eff5883229faae64cda_JaffaCakes118.html
Size

57KB
MD5

74836d8765548eff5883229faae64cda
SHA1

a26dcdd488d8da1dc70bd73a56f47f3a6382f251
SHA256

12ef89c8499883f15dfe467106a6e8a9304c7e1f929479036ad7685f322be8b6
SHA512

381e5160747d563f359dbcb2c4ac5566fd3c9e68d91cf49c822afcb47c744057aaeda1f36a8b71d6b84e5705f488682e377c09a735624ef029786cb3f012365d
SSDEEP

1536:CnaEM2nv43onzkvy7Jua2rTs6HZeUxOv9c51iu:CnaEtveo4y7Jl2rTTZegOvKiu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1124	msedge.exe
1124	msedge.exe
1916	identity_helper.exe
1916	identity_helper.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4140	1124	msedge.exe	83
PID 1124 wrote to memory of 4140	1124	msedge.exe	83
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1140	1124	msedge.exe	84
PID 1124 wrote to memory of 1568	1124	msedge.exe	85
PID 1124 wrote to memory of 1568	1124	msedge.exe	85
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86
PID 1124 wrote to memory of 4628	1124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74836d8765548eff5883229faae64cda_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,6437784484651975831,976975140030604940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
057a8c90f63e7f931684742843c5abfc

SHA1
41fddb6a346e60cacdff8ffcb7c9c5d732c5604d

SHA256
13af2080ccc83b576d40dc629dfc871b6394904c1e07a928db8f6cac39da412f

SHA512
ebf7e5705e5eb87ce440726a2d220c0dbcd470c4819b4b9a57a1db8d142c3dce5f7d4786ac07c63379918fcd01efa982b160b849801bf3d2c4d832bc2c33e913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
2b247075859d6fdf448cf6873a696539

SHA1
348ab74a93ea6e223a0e8918e0a1ed0121bf693e

SHA256
74a094f9fe1412028e81f07e0a2633f9a1f79c55c164c1c2824bcddf527d48fd

SHA512
a745fe0e8ccbd3884c857f3587f0a896396adc44a8d89f71005171bcf88d3a88138fb29e918db22988d0ef1901f3ac2de1ee25862be25445ab4b5778d0d1635b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ab9ba0c56cd4ce861b9b3554396fef76

SHA1
49724ccb59d7c8f80d8b3feef625f16eeb99c535

SHA256
0d3f9db78b1c2cd00e38b9b9ca6b494e871a187c42049342e882f510526e0732

SHA512
9daaeec60ef3280962899f2bb274856e0f28006559c37b47b4f2ed8f17f432468c435f8641dc099e6e7f541b8549632e389dc2df813aad0a3d9d96cb0a5b757c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a66e69e2924d7ff4b5593b7b0a6feda

SHA1
0cf56d01cd7f50a6de3bc293d3923ad43f5b80b1

SHA256
2b04546bb798dfbe6267aea5044d62a263dbe896f0a992e05c790e8ec5706eb4

SHA512
9982da4739f5661815bc524f9eb422e61b2453dc1c15078b8c9c84afd5fbcb6dae02cd3849726ffa66e7074225d807f2a29930ae4d09e768ae7a93e59fc2f88c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f27b7755d3cf6f3285d6a39c35b2492

SHA1
1b0fedb71f05d7b91a94561557b47464b5b2c5db

SHA256
d50fef706ecf075c9ad5deb29662be434a687ad43d4b8927b2ad74c4608013d5

SHA512
933272fa59904af86bc3152ad07d898be5d1351b7437d96bb183f9b4ebf26ab81f06daeb1fc4548b513298224da96a4340c985678b6c46a59a308a99fa92d440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
12cd9b0ce171be896fc74361f3253555

SHA1
66251dd95f637c213da19576d4ab1c225527293c

SHA256
11164826ed40d9b7374f14bb60940151a02db6b5e49e83e12c70ea8174e9f49d

SHA512
223ee5f16ae0d06a5d72e9346aa0a758f547b1455f89c5e1652fd6fe013d1904d9d8fe533c3e5633b6dc573c44b3eee7e72bff3a0a4ce50bd6943bf607a66804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c4877ae7d54b754ebe65edb6f63c5f12

SHA1
68940dcd3708725f40145e194674c02b48bdbd5d

SHA256
02727c36b22f7475553ac71ceef5326285e9fae668ea7d20c10358baf848e174

SHA512
5bf1c341afb6e07ddb63c7494fbcf380b74b2b361269567f0a13cdd5d358af4cd3d07a3f6f99f1e181107b99d0d1c47bb975515c4da7cb74cfbc1a3494d690db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a391f755868d84eed7ac1ac7a11cda01

SHA1
21374ff22ae83d8e96553b1a8e845a5d58b206a4

SHA256
acb0fc19dc326af2603599ff8bb277e6a75e265dd6ba86e602ce7b99a3c41c33

SHA512
64d75c4a298dacd36b47f2c8e5ab1b8d752b414b1903c9ada4c65a4bbb2adde8452a3c5cef26ceaeee4de4664e722ce197473df51e0b18375961d8973eb4ee01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c4d6.TMP

Filesize
539B

MD5
00cc5e682e7eef6557cd01d2a5a9f8d2

SHA1
99a042ef36873c1438bad0c1ff2f499295513dbb

SHA256
25e8d83f1d0ede7750a2fd970f12e3aec3e83612a323b965295687ddf628ac14

SHA512
c846f0b1fc08bd6b3fb05fed53ea83d2a98f5d8c41b7809c13c27c7ffcf0f4a2b0798b19313986ae5c6f60ababc34cd668674e64cf1f9622b4585b2a4abeb11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d77a57e3180de3a46d24837c19a23b2d

SHA1
eb4705c7723033a4cc653e9602632342818ca771

SHA256
35b67d9ee8d5b979773a277ce5f2bff928a8cc9062543db40e0be77769b3f257

SHA512
a3cc21bb1a023796c7cf99da1d0c446981b7fe326a3c26d7e32c9d4fbfa39e238889d660859f8853dd40b7400b7b1ae7df2bbfdf1dfacf8b12feb78c3b7a5c93

Download Submit