40a11036d3f940c91529d585bad0d85b0a2c8885adc90d2e68bf70cf3ea6059d

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7097689ed7a91145682f87d1209b5a2f_JaffaCakes118.html
Size

73KB
MD5

7097689ed7a91145682f87d1209b5a2f
SHA1

71bbb419aab5496c61ec50f0347da3200f19bf02
SHA256

40a11036d3f940c91529d585bad0d85b0a2c8885adc90d2e68bf70cf3ea6059d
SHA512

003c788759c6e18b4149b5c7d8905a67abb00cfd182a427926cc860a7b5b513809f58ed0d55a3398e41b0c45e4e9b007cfc3ac91749079eb0141e887dd438e01
SSDEEP

1536:niYi7rEFaPakJi/loaFWPsfgUiHPEwqYTgGMMcrhRyB:nZIakJ4otPsfXGPEDYTgljrhRyB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3200	msedge.exe
3200	msedge.exe
5144	identity_helper.exe
5144	identity_helper.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1364	3200	msedge.exe	84
PID 3200 wrote to memory of 1364	3200	msedge.exe	84
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 1104	3200	msedge.exe	85
PID 3200 wrote to memory of 3060	3200	msedge.exe	86
PID 3200 wrote to memory of 3060	3200	msedge.exe	86
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87
PID 3200 wrote to memory of 880	3200	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7097689ed7a91145682f87d1209b5a2f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7a2646f8,0x7ffd7a264708,0x7ffd7a264718
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7880223874580362629,18298720049054510837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
21KB

MD5
842969383c00d89ecc360dbf56ae1fe4

SHA1
8bc07ddd709b367e90b91eb9be5422242f2a1a72

SHA256
d550afde14a7f853f43932fd40d1a586573e507f4b4a7761e8d8abddfb70808a

SHA512
881c5ab66a00071968ec0f781cb3b31e9c7be5404aa70339f1930669f7738307051f10b491988dc55e201e6877cdc9ca626821b8071e22b413683d793dbd4560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
fb1a4e8823f0d297688e8017ae5e3412

SHA1
4a861e1c3766f2792458201f7c9669ead8a9719e

SHA256
cdaad26282ea779773f9e585863d1d72e95b88f614b3da1cca834494dc34149e

SHA512
21738183bcd615c670784da1d0c1083ca28691aee710819cecc177c89ae3c0e23b378e36bbaa9f4f83d947335d17e640d7049e4e84ce72d637062a69e5fa5101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
21a9edf60aca7222bfe94c4b6d59d389

SHA1
ed480eddf49435505422a8f87c76b9d9339333cd

SHA256
31a25eae6fca5f76de5cf92acd23d2223f15572adaf6d345694ec9f927c1351e

SHA512
b5597618c63193c94e5a87f44dc238a614a1b5badbd4184f9ab95ef9a07daabc7bba2fe8d85edcd11d6739d155e5cd8cb34585e514db05eec908d70b354508f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
7896613448135e497058267e55de658e

SHA1
6ff5ed164b5d7cff6ad421835d3789884818f200

SHA256
0e9264455b82f0d3cd95921d6316758b2df0916633f1a06ba6c8c5bc21403161

SHA512
5a44e129d1d7e1aad5ffe3dfc7a1d78f9d132784081199162b9f079ef091777d8ba45175a44e4e57f85358ce199e96fe80ed9523c4d113382030a9e915879f36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
eea2a8dc8cfb968f4c89c152057a45cf

SHA1
74f007630fbe7991652df6d2d965f2473a1be7e3

SHA256
29ebcd0763fc2026b50fd7d85ff44967848aad3478b0634d5e9e7e4f9d1f7215

SHA512
736c7cecfcba4c8f787c01724c8f881c5f118e0d5f59a43c83f3b3874470911bc04786fff9f66d620ae5650446aea8d84b074ab68116bb29044b9ebe77fe79a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f618aeee2aa35a2197a27752cbd10ee0

SHA1
c0cd02e88e8cae466748675025acabe6cf29f8b1

SHA256
bf50ffe694ceb8bf2008c3b34d2ed5bf3430271898f7b28e3b51c8fb61f2f356

SHA512
bb85dfa2ef48269366aa276c2bd1d157e0dff53936a5d6ebd10c5ff6e82ce3f3e040048b16f7f0a9e35bfdb26021a32a199098a11579e2ce5d5f5c6f175f21dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b84435bdd7729fdb62bac1e48de16b3

SHA1
243e162da52cbb88f306abba518188b6196e079a

SHA256
92ba7564663e0afa5fe727f29efb29e3a7a88fe7db6b0162c806595f9662738a

SHA512
34e4ad02b86b862d7a8e446f7b5f01dc67390209c04dd07b25f2603a23ffaeb0300c2c229cdbf3c5cee8bf8c1c328610b5c4b0ecd119b90f682ccb94d3c98a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9f39078328838bc4426821923c1c241a

SHA1
df82724ea06c5034be4d7298dedf254374b3479f

SHA256
9ac24fd6589b1fbebb2e93292bf60295784dfe66f5bd24431ff16edac0b6b140

SHA512
7eb7aa1e08e684c9a144b31481b313269569cf690484c02887bd57fadb8cbf87a4515a9f4abaf0cd5427c23ab7a3ae1b5ec8985bb7625a84dd5313fda89e1c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7bb6881e3345e66e4c448736dd5e1375

SHA1
ac43908c153da14435dc501c532a0c7aad8acde0

SHA256
344247f9bfbefbe77c841812036a99df0f2dd13ab9ff71f579d7766bc3d35565

SHA512
ee6ecf90b6518fbe370df9030564a28669081f23dcb3c4d6387855b08e74ed7dbaae8de8fb598b242a6f05828fe6a08ca954392c9879e3e55d4f3f3a2489cb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
19e52508713be5cf4a57bb2885671f91

SHA1
ce1321e4371e86cd8d7ec937ec0613aa90fabab0

SHA256
359bd0a840c8cf365b61fffb1b62d1a598110ee5e1a32f46785718dd91d7078a

SHA512
7747daa1cd6c153792375bd386a744569ec267035b319ff79e581a8a5674c867931833b3cbcd22383e1410ed22ec27556c91bc18820f50b2adb16c1874cd2a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2a8f8113eda2d29667c2c5434a44efa3

SHA1
0a381ed5c58c8460282db89fe7b9b994cc404f87

SHA256
3cd5631576582b1e48fb6445356b2e0f97c9bf7841e05d01343495ff0d0d83fa

SHA512
1a1fdad2a05c7718ebc2445090958d28cde7900e8079bbea66de551bfa1a831387abd891876a5428991117c99ed820274e8be182b4c855651d2a619f356f1f1b

Download Submit