67b08fb3290ee34b3d28319e25b69721e13603445125cf3e21c0df75cf0add0c

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a1e136996401293cc810d9777fe3650_JaffaCakes118.html
Size

85KB
MD5

8a1e136996401293cc810d9777fe3650
SHA1

4db32eeb003740711c0514b48dbc37bacaeb8b04
SHA256

67b08fb3290ee34b3d28319e25b69721e13603445125cf3e21c0df75cf0add0c
SHA512

ccb78e8f110335abb2884334769ae04cd88714509fd82be26084202863b658907cec027bfd78106b2ec8603c7a9a6c3d5516b7adc43e221cc7c629befac7a698
SSDEEP

1536:A7ZIRpDKFmCpBbxV5+DGCC+AFlrjVwh1cksEXWG2l7AeUyAbryAU+yAb7yAaAyAT:CZIRp2FmCpBbxV5+DGP+AFlrjWkvq8z8

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
71	sites.google.com
57	sites.google.com
70	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1820	msedge.exe
1820	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3012	1820	msedge.exe	82
PID 1820 wrote to memory of 3012	1820	msedge.exe	82
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1068	1820	msedge.exe	84
PID 1820 wrote to memory of 1488	1820	msedge.exe	85
PID 1820 wrote to memory of 1488	1820	msedge.exe	85
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86
PID 1820 wrote to memory of 2828	1820	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a1e136996401293cc810d9777fe3650_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb42bf46f8,0x7ffb42bf4708,0x7ffb42bf4718
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,4563921193056771182,2989332371975183643,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
981b4bf50f2afce94e33476ab866522e

SHA1
c2abf6efc1bcc53a5c0ae5f518c970e8baf68b61

SHA256
bcd8e3418d6e9b0f6db89c694b2c35fe32a9fc019ad796607a22ffa9b3da8b30

SHA512
b3119220c9b9340d9502b91d38e0f6fd617cd36314358ec2acecc90699a2d2105744223e534f032962cfad2220efb86786cc0caff19d9403f9482f8a3852b237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
88057747b4d0326de6d7732adf8f8eaf

SHA1
8443254b400ddc6e9695afa44c4cdba241d3e4fa

SHA256
250a9495aafd3161aea149b5a2fff8bc74f4715bdbcb16dde1ce14873b599be6

SHA512
8929decb7886fe195590f86a232d24493acfd30a630a4c776d1110b739d92b76a8fb79c35b403d9c9ad78213fae5372154abd328085321fa7cb11f19eb54ccdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
5b9ae0d58906ff713d50cd2212a57040

SHA1
e860741f12a431e42316096981989bd3efc3f217

SHA256
32ed1da6940d8ab39f1c6bd72357596daf9ce649882c37171a25e4df644bdfec

SHA512
c8786ad4d0558c637634d338f387e427aef186d8d55e3f05ecbdb0f6b0fdf6b807b4fc9dd4567ec5fa52cb36263e97c4a8b2004fed752bec5d309b0b19f7505a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b104ab8f74c63a42c8e55a4b10d9618c

SHA1
a8bf66a30c26e8ebbf3c662cfb1f177b85f57fbc

SHA256
7ef5e4ae6f5c8d5d9b4d3faf142dcdb0fe9e41711d405f848cd888cd2e4d6bb2

SHA512
bf1df50802d24509307187a4ccbef97b1dddfcc9de0872a2c68d0105e356cfcf788d1c92f7693462f6106f407e1dba73906e152794c5e34ed01d52f1ad921ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
067093722655e420975110dc6deba249

SHA1
a49a5cdb3a02f9872c44c1756485114b6f2b7875

SHA256
9bad692c760173955ad4abd9270c442cd7e2b39fbeecf793bc60f09f61f6e91d

SHA512
f369bcac98b7234151b7e402f96ac5115c37ca5fa001d1f05af732a9c819a9fe1783ea802a41ebd349b9a68dc60347a7d6b65a31954ccfb7112672e84d42d8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa2b7591377f91f3cfab9f4ab1006c9f

SHA1
e8399604da4fdcfeaef9668237c55fd8a3cfc520

SHA256
fba0e7d941f5fbccbbafb2393d0fd37e4f3734307527067d8e80fc4748ef2685

SHA512
337408fe1f318675e1b4af97b8b2b55dfeb3d116ec3d7049e217726ba7eafec94a3902e08ec19d47296deee9c492870cb9a401c2fc49c057ae264f451ce3ff1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3d2df63c23c82a1bed9b11dab59f45e

SHA1
f5a46d49c02ddf090e0af7019a446af68ba905cc

SHA256
359fb6f6578aab7fa22c144445baad6f2c6b86f3fff18f3e0f55556fd332b26b

SHA512
67ee05eb12bf5db672acd64ba1b16f4cdc1b48cb3af240a93d3bc4b720131561ee05bf6e7f7442b4e889c44d224aeef5d5676070b6c671699311ed122a5f0ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9d5f4dafacc6a4ea3f7237f0a52c4a7

SHA1
df02420ff23ba7f34e39479a42e4c96629f03d57

SHA256
4e9856f2b60b23919c67d59877dc4b32bb7c59e753dfed8ccca591b6e0719f54

SHA512
f004fdaa46d97e168f18513309284dca9e7569544d15ac48e3631490b6e2850b9c882ea78a3c8ba891e38f4d97f847919f823a12f9ab31ab7d9e31dfd91110ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c71f2305914107393027b1b476ed928a

SHA1
46bb102bcb6ef344cc8a9bab486b338886920cb3

SHA256
42453dd85ba3f1af43cfa8595dddeaf7d5403f64f3e6a9355b751394a90529d4

SHA512
2b56beef2888147be1acdbef8eb131611096241c52cca97357708e1643aec8ccebae57defc653525d13fe350a78fe9dc5bce491b380b53bc1aaad97f3d54ab79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
6dc520872d8a26f29afd6919e8197953

SHA1
44ae5ba4c1e2c539398aa99fbc8fe355a1f809d2

SHA256
a8c2fdfeec7b9e3bf178401edfc4c6c1603f83fced71ccf839c1561d641825fe

SHA512
12fa34da7b5e6b3e0e4d93ab5de30efe8681bae9310410e2aab16a9f430b14b500db3580de9216b9b42199c26fc3226f491c49b1e97d9b1c56942b94bb5df92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca16.TMP

Filesize
705B

MD5
199ceefe28be0121580c0b933f09f501

SHA1
fbc802738d67ceef66aae45ea268e32b9519ebf5

SHA256
e6031fe5ae139a67a5bf9eb0ee62b036c3e2a271617fa751766d3043c8d84780

SHA512
9d57bd5b82c1a1f433ebc3a5565c1af94f005bb7224b12af67e41237dbef4ab5f0460ac3a32fb3956c9c23ae6192347efc32a4f7f5dc992565c995a8c9140ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68a719b29e273e53b4eb5615136cd7b7

SHA1
1d13e449bff544ba08a4153f1635d9076aebb75e

SHA256
b435a570486ef08e94d29e6c438ea783ddc88097f257c8ab70f6f56a41880af1

SHA512
4361f6253a24295c902763e54bd9275e6a2ae340a949a69193851fbea4f9cb8f742fecf963c69c54e2c78b1b21ef16165c349d62b48a60b35fb692bd2cbb4998

Download Submit