60f65d8642aedb04596f048d8aec3a90322686d17a98503d008bfd8843ffee57

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f53ba4c7316bf70a71bd4237c747b9c4_JaffaCakes118.html
Size

64KB
MD5

f53ba4c7316bf70a71bd4237c747b9c4
SHA1

9ddbeef69809be39719f70638dd5fcec34a74e74
SHA256

60f65d8642aedb04596f048d8aec3a90322686d17a98503d008bfd8843ffee57
SHA512

770a8624457373d96815687af328f2e55f088b54f7b5faff562dd9d5da1b0e37a9dae9e0471bb86d7e193670abd38903f08434aa6f049c55223138982c0bfabf
SSDEEP

768:qbZL6TqgbYgD2EZnS/OUejO54czEn/odghKK+ETa/t05COMZ+5ADtOBLXb18e:e62gbYgDRoQOpg/odghXO1DtOBLJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
1592	msedge.exe
1592	msedge.exe
2660	identity_helper.exe
2660	identity_helper.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4104	1592	msedge.exe	82
PID 1592 wrote to memory of 4104	1592	msedge.exe	82
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 1168	1592	msedge.exe	83
PID 1592 wrote to memory of 4340	1592	msedge.exe	84
PID 1592 wrote to memory of 4340	1592	msedge.exe	84
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85
PID 1592 wrote to memory of 4484	1592	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f53ba4c7316bf70a71bd4237c747b9c4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7fdc46f8,0x7ffe7fdc4708,0x7ffe7fdc4718
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,15843925329819204991,17749541655052422416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
81b00bdcb05113f6660a0ef277a58727

SHA1
f820afedc940ad327a31307500655dff95f97a48

SHA256
1548de45ea7fb90351c15386918c297d2bfe596429918ae1b9930b8de3909ee2

SHA512
6a7083571b0466cfb1852de2f1c03d13255e44fda1359b6c51e99bcb4dc7966d4af98b34eb86e241d24bd0302c94ccebcf96611dc791d139a22a8bdbee3fcf48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6a1b61e97ab1e7ea7510c6550ca29f1e

SHA1
0c61013196797b43b36c163d724247bb3dccad37

SHA256
366c11a985181763b1819baa424eaf8a16c626826e4f843034b572f3b7fef6c0

SHA512
9c9eab204717bb57d83ceb1053b9cb623926c4dec34b16c4aca2553ebc1c00892d45d96cc26f10f875e8733fe5a7836f1e5c33236f24925de56665ec0db0ec6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
f7aa048e9d1bc8245952a8a1fd0a68e9

SHA1
ed2f04576aca3f4cb1da9a03a50fc6ba91eaa6cf

SHA256
22eed4d6fadce33a6760ec22c69873b8ca0ea61fc0ce2c94ab1f675b71c1d86b

SHA512
f0f63364cefad98f1f5e98d62f960ef4dbd16c9983001da0f5d99c337e6e8703dc81824f15454892a83a03dd592ebcdf019bbdc22a1e301fad82d1ec55f8a32e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6a9d145c300edda367b778f84d6fd70c

SHA1
56b73a9c35efbde739916f3adef2700e973b8ae5

SHA256
6df456d21d8b1963d067cce5149706a974e0c0d4576c21b607b927d1a225ad25

SHA512
1d3d757b904e7b9583f624abd295f6d9d6027dd6a8631334a2abff069b0652a00df96cc03dfca8eb23c5876d3d78d032acdb01a4eb2e353d565e810ead6952d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
59951fb01f7540699782c24c500f0794

SHA1
c69360001fe07c8ec25b0cac896b329222b85853

SHA256
6f241ff7fddb45f2e5480a37fddb35a6e80b16754220b3df757bbe932f348a5e

SHA512
171a2aa9a30a23229cfb7159fe80695ee752918c70c07130bb00d6276a6d9630df98b976dd6c4182c706a9ab76f1c5ef55fb5860942d826350618b9d6e6ca09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3220f06b64ef921a69730ce25849d72d

SHA1
057ea86234451a2a85b3dc657f4c56f752673c65

SHA256
679490fec7da5165e30a48ad6e9d5c73fdf8fe31ecea40b70e0e15cd6a231d40

SHA512
2f636c310500c65813a287ffdfbf73e53d9132dc859af4e19ef31a91094315f4f53144d80c7eff5d92ab698fbd01232d65a97be13edce583559c603eebcd9230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5d400b47a6bdceb2a048ce9f75960eba

SHA1
78734cd0c64c548cc8b069cda285b4208126ac79

SHA256
36889f4b0ed70e5c054c56c84d0adaa67fa6fac523ee4a4c86fa08888f46277f

SHA512
39d67f05776308728b264b99bd7bc13fb0dbf24c0fe6dd64a39cff5076610ae42254cda3b97885e65fee3304276b0696b89ba88134dfc9664c83cd3975e2f044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5932d60cbce40f2fa4714ce15fbc0761

SHA1
3c8ee2d38c2aea1a9a3ca94c92b285dfb7570a4e

SHA256
5b3f990d20208f276970846373214762e4268518112dbd6d04cb6ddd6bc96c3f

SHA512
086ceeedb932e9a9315ad9e15dff8d4d499455391a4b730271bff40e36e7a0a8c5d3c4756e2e9777458dcd0aebbff240ab047ba4059ce308d4c512f5996290d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e81320585ee93940eeeca19f1a88a77

SHA1
8aedfe184b3f5afcf09e4818c9c9576417667774

SHA256
6be9681a45c70054c485b33eab93c8e4c509d948840aa93e3744123c7ee29c3f

SHA512
579c90a182eaa246b99e39305e155fb0e2b30e9058b385236039582b3964955d851d977341c9eb3ba26bcb3394b4f1a3cc3a9792b823c4b4070a812e134e6ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb92da761f3839cdc7f84661a26e1b69

SHA1
ddf511304a5aac77fbc64715e992a80b26f253c1

SHA256
0ecc8497d1f2ed625a94d4a497518ba296866f90d4b8644521b5318e4e583ef5

SHA512
887020d5c9bd731b6ca2e602d5d6ba2c12611ec165e69186a73e1659955ca1458dc060c154ada65d4a154fb33a0dd910401f4ecc8e505c2e7167b71453c55859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
cfbaba09c9c8890c47a58b905c781880

SHA1
49b00ece416e3575e8d8a3f28794e7bca3bda255

SHA256
0ccfe49553eec5c9bea45cf718d4b74d2e4d21a80b1d0baad582fc48a1a2fce2

SHA512
1e320bd96f593bed99ba7ea2cba9f13986ea3c564d5ad2c81e38d780f74911ec4a9a714e8a7cb85325d073326bafe0c33dbf0c46b5f538856a8b787019048548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583f65.TMP

Filesize
204B

MD5
ba1f77581443f3e04684c0b9c5ebb8cc

SHA1
5357f44abd8e2e6af4ce547a95a45005465032c3

SHA256
4995c33036a94fbf2eb5a40b68a937d01f2d351d396b4e911dd7fec0538bdbd8

SHA512
3888de0c66d7eafd3de2f895dd6f7ca15b6eea82a6dd6deb8553bba8d1903bd1eec03a558ef80858fe897629940445213c963e9e9b327cd35713d2766c14e69c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8c22c16752ace528a22f36edf841ff8

SHA1
a5aaed07a4f3b0d0b0b92a2143a117cccd55a00f

SHA256
1dde6b0782e7930e83ec29665891185a98909c85c5aa347d8b6d303ba2dab213

SHA512
e67bae38edbed1b6877c736fa7c66f0369914d3d1b2c85df5870d0f3b32a662b60d78426f997d96fcfeaf4a04cfda254ef99a05b9a0c48721b6d3755ded9127f

Download Submit