f6e8ab2814b811c703b6e32f0147904994acaf8cda7b77c385447efb92f6ee7e

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac42c3e698c8e9cad8fc8f559dd0f2e_JaffaCakes118.html
Size

177KB
MD5

eac42c3e698c8e9cad8fc8f559dd0f2e
SHA1

4b5afc80d60d781f0bd525e0cc96f1da80efa0eb
SHA256

f6e8ab2814b811c703b6e32f0147904994acaf8cda7b77c385447efb92f6ee7e
SHA512

bbbfb0c9c12394406f2bede5ad4024f8b70d1bee7ca50cab0e7a765bd20a30b7bd3e65c80e62ef51ffef1dbe3e119f7c1399145e0405f131828cbddf6755aad2
SSDEEP

3072:1yIt8TcluuKyGxA5I5tHI0viE4CHXLz+dfMu2lAPrBPgKMt1/Y:8kFG1kBPx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
3224	msedge.exe
3224	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4308	3224	msedge.exe	82
PID 3224 wrote to memory of 4308	3224	msedge.exe	82
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 5008	3224	msedge.exe	83
PID 3224 wrote to memory of 4356	3224	msedge.exe	84
PID 3224 wrote to memory of 4356	3224	msedge.exe	84
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85
PID 3224 wrote to memory of 4516	3224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac42c3e698c8e9cad8fc8f559dd0f2e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafe8546f8,0x7ffafe854708,0x7ffafe854718
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16878102840170850679,4154537644788926279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
dd289af7acf1c61568589376671877eb

SHA1
fb80dbf267574caa574bcacf0faba6d8d697e766

SHA256
58f1873ea847e38386eb52968d83fd69fc5c03fc541d4d92fc5d43d9bbc1ef34

SHA512
7919af2ef3baa64307b5bf640bf577a214c90a38d57d00c21a219c5901cf9063d806ed08e0f2eb3a4a0b8d0056c1805a915d76d6fdceaecdeb1f0a21473f1e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
fcc7e1147d807d198402ec60a965f579

SHA1
54082548a2be46bb328001030aaa78c40a8f8cff

SHA256
4d944540595137dc09ee872b0868f6273f40a6aced2da54ce1309c64c05258bf

SHA512
b2e533e82ab8a2f51d245c7bcf6eab27cf04504a68659b3684e10abc27a5ee6d787774e2963def003d2e8a9a0ee87071fa897d3575806b161273a0095f30f40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
20cd8ab7cef3056b0db205b314bb926f

SHA1
1cb3d4591015dca2f744ea7293d80b4e9bc44b67

SHA256
b9f491a76da226cad9bc77ecbf4250d483fd3f839c98136d0e74b89464d9f1ca

SHA512
b5e00400076edb307a74a0c5de2d07d604a8e09b1dfbb93dac6927ee2b95966d44be63992c34f717105f942cfbfee2bcd3c750aff6bbf70ef1097120c3358777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ed3adc8c6c00022fa4b63ece8a1ad636

SHA1
a0fd0439f45a024fa1e59d59bfd04c729ed0321a

SHA256
e91f8d1fd73ae54f89a9aa49f4a4dda897772bd0a69e462248bdc1a994eada9f

SHA512
ecde0b5f47966ab662a2276a35bd22ce2c4d6d0e5e033a92c43f55bc00e8a711c847e4e09753917b6ac3cd171c42c12d08e2b91fdd59b516ba59e8d9c138c7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c446d4cab747a138d5aad1722a7372b

SHA1
7296faa30bad2a5e68902d56ce4b3355b894de56

SHA256
800b519884786dde5f3469801f1dd74cbe4a88e7db50f65eb103254b301a8781

SHA512
7bbce512aaf3688f4938b965ce658d28acf4591ba333249900dc3d19c43e1183007faa8aae47a0a46b2e5722b691bab1888e58d677c2c001005c630cebb6d50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad877f793744d57c6afd8c8b7df109ea

SHA1
d51b5a294b37b9f4830d40861e8eba8a4b9b8c30

SHA256
52dad042c291857eedcc5c134584a220750bfdbe60f7c0df3191a12ce7813410

SHA512
6a0ee6e2a0f512024e5b3feba5907a0cca440ad9783132556070eee700ca5590b252871cb34df6af77a9093f6951560c8a5e4957e737dfcfd2deb701b8779e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6acaf0150c6b715cb7b98abcf4b3fde5

SHA1
0acb7af6896a60216c9949fee86d87075dbc5425

SHA256
f302060ce18222a4cc0090d36fd26986bfa27fa825fe9e77908c70b6212e9fa9

SHA512
2cfae3ca3b69332b501fd2fb9726197a95597a3159195bf12293de0ce60df6006b7214495f77c9f365c0aaf53c5129819a4bc9eb42b1f99c90c6aaf9b6647dfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
020177f7df86aea2128a58e87c077d61

SHA1
dc19e51bc987b6673b85b131d4c2016a4d323704

SHA256
824799f0a1d8373943bbe51f36ed001566b450c0aa48569fe3c77a799080c94f

SHA512
b2d2162562c575aea901c62c388d2fa345467553e5478cdeb72c00cceeea56015433791a03ddf6f4d026dc05dd275cb0c0dd43b366634c0452b415a01a862010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a3f06a05bcd678e3029d231e8ddd505c

SHA1
903fb124cc291317c602ddd3be7139344edd3088

SHA256
12591ccdc3a28f22369d549377029727f3034d1651052384eb4503317d839ca3

SHA512
0b96e821ce4aeded033e1384aa844e58813913a446196c68ebbc0339d05327aabe33ac815b9e0cb540bfe3c321ae387c52ce2c0e633951c67980e49022e3d581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
9f2f56dc74c0c7eb1fc4df417595b5d8

SHA1
18c7cdeae6cd85f05e2e2716e10be4a6fac84af3

SHA256
7824d6d95f4739f82dbeb2d7b79dac96dfa739310fa170940324e6840a0fc36b

SHA512
7bd89b521dfe2378129923cf1a85dbbceedf4b80a5fb1562238325fced14fe3cbd0e5d4f5261ec0753b94525cdc4839ab0406183b0231ff4ccc18d3e63a6dc55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d282.TMP

Filesize
707B

MD5
ee7b804fb2296cd3516255924b570543

SHA1
a9f8ae30989d15d8c5d2f4a3d1992fd955fe997d

SHA256
59cfeeb3b003edba485d7a7e625ccc7cd78d69530677e585c2c4590c5e7110f0

SHA512
0939cf23c5e04a7ac1c0145889e52c1d03d590935539a1fe91650119039d1eb5619a22da88773892468c74c13dc03a168335c55abd42927d1120090513e14129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01aba58816fdf37cc351746e185d8837

SHA1
4185b73388dc5565676af6786b1f705a9d4a17f5

SHA256
6daef93ad8a805f1abc1eeffd366a90a29857d17135971ebcaeee37cdea635f3

SHA512
282724590f81972ca3038149dcc364ef61857d2b3751b6cfb6c0cec3200273ba658254deb2b8a192ec92782e112362258653df71d914fc85c3eaa4d693716374

Download Submit