67fe3689fdd3cc1190babb9776a73f7f856b2ddacb9b60707c815e9a81db013b

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d1cf9d088ebbd952b940a9696a90396_JaffaCakes118.html
Size

166KB
MD5

7d1cf9d088ebbd952b940a9696a90396
SHA1

1f361ecd942c11b8b009e47c1de9020b3e2db127
SHA256

67fe3689fdd3cc1190babb9776a73f7f856b2ddacb9b60707c815e9a81db013b
SHA512

5e312ca98dee4a5bd01373a4c686f38f7158f8d4c5e754cd8d3879435ed85c570bb9d6ff3178006a113ca0c33f00752d57fcde1f6c31ed133ac62067d065d5e4
SSDEEP

3072:+RcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRS/8sawo6FAGne+F+:WcjJ/jXmNRo/u2qnIRkR8u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
2512	msedge.exe
2512	msedge.exe
4368	identity_helper.exe
4368	identity_helper.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3244	2512	msedge.exe	83
PID 2512 wrote to memory of 3244	2512	msedge.exe	83
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 804	2512	msedge.exe	84
PID 2512 wrote to memory of 3920	2512	msedge.exe	85
PID 2512 wrote to memory of 3920	2512	msedge.exe	85
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86
PID 2512 wrote to memory of 2204	2512	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d1cf9d088ebbd952b940a9696a90396_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303d46f8,0x7ff9303d4708,0x7ff9303d4718
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1364 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,8820022252575882735,5635072250904449015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
e685224872b4d08ce75e0254628b9ae4

SHA1
5f5b5935151bbc312929cc1da9afbab47efc8901

SHA256
c0115bc4dd352d9622ee68470e88ceba88421638390e08b46f90290eab38e366

SHA512
89a203f89cefb4213e9163f33b3a71cab2c019b2b8cbd42a068cc4acfcae5ae9f51064447fd299426f49ebb7070798dd3a5d9a1951e9cd4ec9a82bfe32837e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
fad5995cd2b2e2be3851112d29688454

SHA1
bba9ceccadf70405f00125dc720bd0a1aa8893c0

SHA256
57c23a1ac5bbfb22e4e71cc2bd21422394a43741136ded6b2b2b176e064d071e

SHA512
f306152792e73593cf4e2b78311425465353bdaffda3bfcdfc2d726debeb169d489191cff3b12b4ecf13047592ff76d9f65e8651bd97029aeda34a72319baa10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f03279f018404145331d21c691799703

SHA1
a96c5165137d3fb1f3d28bd53d0d17f1e577cd05

SHA256
ff103e50deadc6de2ec646a01336ba05acec829817b12db636d4383472ae8a58

SHA512
7e69baf3b92c2a530246435d012d68110672a480e501a26805c1e58dc57ac3935b8e8319bbeb2b63709729436df1334a1ae6787782460d9c69665e46a311e50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f180002d81ebaba0f953e6a4d251b99b

SHA1
63b4390428acfe00609e2a9fd680c25badaad590

SHA256
6a9c79dd10d8f9f9eb049b170be8ade80aa17139f0a759c95c6606fed25788c2

SHA512
54629c78a75b7aeed7866b549f64caffb7217bbe647ba3fb11530b5366f6f36d638e6df8db55688e1e1663a69899fcabbc4cee30d51dab5433083b31bcfc7496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccb722c915d6b60bffcae1084d6c4850

SHA1
e15ce71fd3ac920890377058ad06f0db66d3ec3c

SHA256
9aa13db969d13475766c95125531174a3803efbce6a7f29fb3a67f76bb5ed832

SHA512
921a6098c0c1f7603564a9a8e3e5f4da99cabbf58e61daf0a527ead3fa2b261b91e6508598e221cf5f452ce228370c4cc55391e0ff14d56e14ccd1c5e3691e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a8485d665d5811230bac5e38ade5d631

SHA1
60f55af054034c45d379118c7036a6aa3b4950a8

SHA256
46654be1840d06bc561f69ebee49b42e316832e4f59059a1c7287038fc07f730

SHA512
7c736628c204873a3c79dc53436fa7bb9e1a9df1538a754b983e1bc78e477dba358fc669a60ad359c40df1d1af6b5750624041a4eccfe18e868b55893d5004aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2bc47bed438906186f3ccf64c190cdd2

SHA1
fbd61e5789b510c68677126459963a0084a60ff8

SHA256
fdb6d0e174b87a9dcbf41337a5edec831551e3877efa4b02437baae15a0e7289

SHA512
4b19bc8d6773dbd730b376d0ef544611c3ee33cb70e0ef694c458024daf65a66ee17bfea8e27c0588c88ed45d55b875cb08e1361ef5c7459f8c162abb373be21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fda625cc78f356c8e22ecf9914716c56

SHA1
07464e48e632c125909f3f400fc001b25cb8205c

SHA256
e638af7c1781eb926ffd531813e7c76d493d0bbfddb8c783a915a76fa5555183

SHA512
0bf0c2f3b6e7d0793d8dd39e992080aa25f2793c8bae0a012b552bbdcf580fe5b5603691d23884e86cb75da3dd74861f02b2da1f009cda2d232fc01a167da6cf

Download Submit