075ba7f759a6cbd17c06e44a9224d3e94289f946f1e02475842022ffd47bfca9

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eacad06bfadda42cb22b102f8732ec51_JaffaCakes118.html
Size

141KB
MD5

eacad06bfadda42cb22b102f8732ec51
SHA1

c10251d251a5304a67ce6ee7ee5253e1a0b53e6f
SHA256

075ba7f759a6cbd17c06e44a9224d3e94289f946f1e02475842022ffd47bfca9
SHA512

c0be1107e51ec32a8d2b205e333bbc7cd90651d082f5d2c9e7f9316a61d0c7789dedb89f2b0339c0b4a78f0b404bcf68b1fc9753a4127d65ed95aaac8d580d4d
SSDEEP

3072:bUjvG8rMAcXmNRSNDbJLUj8bVvBVCGtmEAkLNKVEAcHLPrmFeh:2KXmNR+mIzA+GEAcP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4988	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3976	2552	msedge.exe	81
PID 2552 wrote to memory of 3976	2552	msedge.exe	81
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 4184	2552	msedge.exe	82
PID 2552 wrote to memory of 1168	2552	msedge.exe	83
PID 2552 wrote to memory of 1168	2552	msedge.exe	83
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84
PID 2552 wrote to memory of 2720	2552	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eacad06bfadda42cb22b102f8732ec51_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab96846f8,0x7ffab9684708,0x7ffab9684718
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7021802714849083678,13746036127985568660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x338
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
9f6ba3cafec8a29de745e0826311fb8f

SHA1
fb426d3d2f18fa5053c840b93934e661f73930f9

SHA256
14a067908fd409b1500a5c38ef28e5fb5089c837a7d05acb3e5f138bb49baec4

SHA512
2d6d26dfe0ac535e8cd2ec6e6e7fdb1301ed6b1d1294d7796bbdc37b8975bfec568ad7a4f9152e879fc313f65d540381d12e5e2417dc417c26035b619bf8319c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c5528d20756795beda823bb0f4d9931c

SHA1
b54858587fe5f7384015b4c43ccd570acff3f4b2

SHA256
a490d47972993c6caf4d026345d4263e0d1b4a3b944311f58b2d567911d75be8

SHA512
60d0065038b5d260780f37ae15df30943e59fb41edd8094859f0db0424d0e526991b38966a6b1dc253352304f629d9ff1b06f7f06e5fc64b83765755527d9506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
b6666585475eec838b210d8d678d5c6f

SHA1
4a7fc692d273297fcaac13afc8af3db4f99b1b78

SHA256
840bf006f2f804c9886541e6f9030d8805075f17f8d867d536ea8e562b503877

SHA512
0a977856c32f8982a0a99278adb13ed70f711a4b07c5bb5563dfff8b26f4fc4356a2e03be563eafcd03affeeeba484fad0483a7510eef9960fd77b7fd1ea9c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
552B

MD5
ac5618d8bb6ced86d8da282b47fd362d

SHA1
a3c9b14f905365bc2f3ef987a2bb75e4fbbf671d

SHA256
6757eb2a3bd76f2d00eb1dedf85cae5ff922ddaaeb52cb47335633d5784c9769

SHA512
f92e923cf340b2e3dcb7ca3a7f4e6515af19ac608c2b7bd1c08f560f82458437b382afe7fe361dbf316f4eecb89ad0493e592045f23ed7b888f3cc415dbb6b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
4b83a39c62ef65d893df9c82b411160d

SHA1
a479b2d85c567ef13ba22b7169607c503a51c8f0

SHA256
89895eb2425bdfd759d0a4f1a392775762d7c56120731ac1eb3a56644db32e8b

SHA512
9bc7b243c4c848079df1aef86973a080bb5f7091ece86ffda36327b261bb2ec659441b5dd4a0ba100118e8ae90cd2821bcb0ff8830961fa8936d7d4cde9aed51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
addcc515a2e132c91d517c09c7025568

SHA1
67d6355ee0ad78bc0448fa3f819a7b9ba6ba4d71

SHA256
8e25c270ad8b015de0f7eb559bfd1afc862833cf2273e74b54e5d082cb37e9bd

SHA512
a31b6fdf76ad4b0e451f31e8ab4d61ba6b588662198556805d593119dec41fd8d4ff148d23f512f432ec37fa6376b3029ddb31702e95e4cab68a6e4a0aad3260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e072fed25711d1bf9c06c455da86a749

SHA1
8355e102df42a38be7e2e87bfebc036c192d4337

SHA256
b27846bf288ebc4cfb8f0e71c73255cfd0ec76bfe2c39cd82f2ba8eadb444eff

SHA512
d39f476fa2d39c2752fabe17d9ac079d970aad8e953f047cde4c61f4be520164f2ae45090fe97fcb6b9b3f2f653c2f0f6230dbaa57f0aff35ce61f17fb4add41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93f62c2ca4b7154691693e72c7276c2e

SHA1
846cfbbabe538aef508ae910b6cd091d3677b5f6

SHA256
49405ee34f272b3cfe29c8644400dc2bacb77bb1e573f33b99a5e394f2811bbf

SHA512
0bb080da85f7248b193f8abbdff869b71324eb4d6eefbb4a2dbac3b1e8a1ec606c49e4d12cfe93835adcd0c9f5e80fe8e28f6fcd12f170e422082b1715859bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c54f84d350c0263815dc4d73622e400b

SHA1
a0f149965a7ce570a2c98d0e99c0d04cd97f6c02

SHA256
ed539e912d4507b8ba7c97ea3ca02df74629d15a33cfe4d1f6be178fa0ff3bcb

SHA512
53e9587c4db2bcace46c8d4bffb51d791700fbb6c4642839e25d7059356e4257178793858701ddb7340ccb87706d34d8ae588f0bb12fca1874f3244e2c4802f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
065b3cd5fab1b7d83de3a857576f5bca

SHA1
0630311e666419a41bc866f304a24dc0b73c41a2

SHA256
afa9af69c463aaaa2acb554e1fe546fca02515c92deb79f2c361a6695d8a2cc2

SHA512
d023aa243de0357fa8546e97505ee40286c9a1c91bcda62215bf0cf30594b6c1a7545a2f2fd477be1cf42649c8e1348c689f2b16b889454afb0053f2400c5764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fdd1bd0794b075ba4ba8eeea589c203f

SHA1
2a1175174722a957b1ec39bda7b639893dadba44

SHA256
5621e4e0e3e21a4e30bda6bce4dd40250fe8c5d182b90ed2c8729d8a0d3e40b7

SHA512
1825ef3294a6a8460fe0880c33be396dcc57d7ebcc01e535576e682db4b2be793f56dce132e6c585765c71e344cdd0408a9e6ffd77637bc5d3b4edfacffa92ae

Download Submit