6d6a503ae75f833502ef1f6924b617deed56f88608cdd98771c68c0ad9b8c66e

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d18a83aff76379400c01f1dd8453e77b_JaffaCakes118.html
Size

96KB
MD5

d18a83aff76379400c01f1dd8453e77b
SHA1

f74ccbc63c7bc7b01775526251be0136671d178f
SHA256

6d6a503ae75f833502ef1f6924b617deed56f88608cdd98771c68c0ad9b8c66e
SHA512

05a4ab577c6ae0ff0733d2b629b67674847be51596b0f672f52c8c6208b54d3348be7ff525d76c4c3a0fdfbdb16808897686936e57e225d725609224b31a53cf
SSDEEP

1536:dmMLvkKfSJkXg6UdreYIx1bx75TyYHEjETNE/8h7At2MMa8:dJLvo6UfIxhx752YHEjI7At2fa8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
3792	msedge.exe
3792	msedge.exe
3588	identity_helper.exe
3588	identity_helper.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4700	3792	msedge.exe	83
PID 3792 wrote to memory of 4700	3792	msedge.exe	83
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 1088	3792	msedge.exe	84
PID 3792 wrote to memory of 4044	3792	msedge.exe	85
PID 3792 wrote to memory of 4044	3792	msedge.exe	85
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86
PID 3792 wrote to memory of 2444	3792	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d18a83aff76379400c01f1dd8453e77b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7fdc46f8,0x7ffe7fdc4708,0x7ffe7fdc4718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4413602226057711330,18202997253157185894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
3904f04673b57a1c25478e992b1a3ddc

SHA1
a78724ed0f779b808b3a2d1042577a6ee3971d3d

SHA256
f8df39acb56c54e853b439101b6ed9e57f68c5b8fef3d87149ccc1d7c2eedd72

SHA512
3b73a80ab7e6336ce0c6857979c9a8b049a3d8297551085a652aa2b745eeb2d3fc09fcdebc2f828f9446527f1cfd308cdbfd2111e4a7752a44ecd0392353a443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1118b880-ebf4-4245-8198-f44bb0ba1669.tmp

Filesize
5KB

MD5
c44bf7c3a4c931789efb0bca46568145

SHA1
604631f4998e54337d41035071630f0db225d9cd

SHA256
eb34dbbd0e182593faf8d1bf85bc71fde02d2db0aea9c336bc2f5ddb6947f7eb

SHA512
8f3163a5db82d9c3731514ae72b4d922ed73306aba0622ce76859b38cff5da00183e8ffc187c510722c68fdd04b6f39954b174041a6d1290d300f1e6b0d0623f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
1012d7ea20df28c0e610348c9337b1fd

SHA1
ea494a8d9333fee51ee5d5f6b30ed8734a598370

SHA256
93fad839968613f4c61d6bddb611ecc5af53c077216c9c60cfdd8a10b5755856

SHA512
96d71ec14f1b764c2bd36c117179a47101d3a4e6e001163ffe41e06795a927f8a726e45084ba7fe9d43d0775a492a1d05df1fc2f691d8cf9b0b9e9df99dd8058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
81bf6c641070df96b74b2444167e2f07

SHA1
3f4ebf928a2b4d9b0d50fd4995bc626cb991aa39

SHA256
c4021e995f09fa48bbae9a1a6dc3a6728d07dedbded2fa5f692168c48a16c974

SHA512
5edf68f605b2e4b6bd9e146375f1704c29677dc821663c2c138e93c96da836667ea7ee1a116ce1ac8c14690c9d54c75623b134daa0edb085645fa021a5b974e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
93fe93910e871d360d267048c0cb8902

SHA1
d9a6d531b6002ba08bbafaad706322321bbf0bdb

SHA256
f36f497300f7d829211d192a11aa18a76e8e5a5b3abfb7b9218efc3d443c1c76

SHA512
8f121ceb2610189df7c8eb9c59af169ae2142069b8ae866fb4d87c72f35c163e47c9eb4664c39f422da3f44825b7faa457daca2bdc0b5fa4c70132633bc022a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
28e78791c1f4c66c9448f5f6c54b2640

SHA1
7962b840df8a0eae9f9aa20606a46c09f0caac2a

SHA256
4b19e74251adbf6313fe5bb5107ddaef41b078a19bca7ea7d0a371191fe15013

SHA512
17818fb0245b66ccdc6cb07484278ed8087c9b0f1505dc47f1a33c5edb74ac32e9559ee45b1cf8f301b18c750f1f459e0c5c5066cc8c6546eb6107674ccec92a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7f9fa7d7b7c5ee48002c37be8b990960

SHA1
d080e103c0b4231906bd8394cad0aae14addcc77

SHA256
1d40bb3825abc63158fa70a6d34fc67337581275a12240cfe03ab92f9a40cd5b

SHA512
c21df565996736c7113357284f5c77c36569c75d2fe110eca05003711351a6994b6e8a9fa8d0dc3981a8d1a050e710045607181901bad7be3beedc2d84037920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03ea415c67f65478b21e03c4cafcdbf0

SHA1
398dd886352ff927cd3295277505ec1422f62cda

SHA256
b848af0bfb957a9317f375ad0d7e4b851392f729a6ae44a9e92c2811b0185635

SHA512
832a35564e2d0e393194ac6d68d2bed27496953124b1ea1eba2cd4122255d801e6cac3cb655337482289609121e69e6130713891dac60437178251b7218b1880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0e5f31883e8ec8c06347553c4315619

SHA1
6db187eeea4c41106dd7cbef2235ee9c72916163

SHA256
2acd3f6f25ec913a38666285c0789cf522332807f3e0bb9f42601d6680f47eeb

SHA512
20bd1a07aac3b1bd3e672a38e817bf4e4614d9ef84e300cb28e169cddc187cac21b8600a709cbfd48cbe2a2ec084f6238f3152592c71b170ceec2b577e2e27f6

Download Submit