ca8ba8e28aaf47eec2b6b42d0207dce482bc2c9f6af5cbbded7fb79e85d90355

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4410492f2404a927cb5f0328bd2407_JaffaCakes118.html
Size

69KB
MD5

2c4410492f2404a927cb5f0328bd2407
SHA1

7c6f41c4adf5117262fb22a07655be79950b9a57
SHA256

ca8ba8e28aaf47eec2b6b42d0207dce482bc2c9f6af5cbbded7fb79e85d90355
SHA512

e7ff4ee4f92bbed7d8a59908368f6b8c5c7ebc29bffac53fbcab86784be8b53da012de362246299eac3734a7965477957f228303b1c43a93ab6b4e9151786375
SSDEEP

1536:EcoSbFrzdp51v1Nc8sMyKMwXquPd6+WE1+6e/6FjglqSRmgPbRf03rJ:F51vs8sMyKMwXhd/1JmkjUEgPdf03rJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
4948	msedge.exe
4948	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 208	4948	msedge.exe	83
PID 4948 wrote to memory of 208	4948	msedge.exe	83
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 2996	4948	msedge.exe	85
PID 4948 wrote to memory of 3732	4948	msedge.exe	86
PID 4948 wrote to memory of 3732	4948	msedge.exe	86
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87
PID 4948 wrote to memory of 1124	4948	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c4410492f2404a927cb5f0328bd2407_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91b646f8,0x7ffb91b64708,0x7ffb91b64718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13050400324314324542,16717217787255988420,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
bf5f7f43957993f9cc81d037b9e72a17

SHA1
069cef703b0577153c81a9ca9f788bf95fa2533b

SHA256
6eb15240cf8e79ddd9b5ca97ada4676b03d73bbe346dd680a8ca1cc4e8d45a21

SHA512
35f1f4bf586b4e81400ec6c9c2ee82005aab0f49f10a62c3e95172e1dde88526f0ad8ff4c7f422684aa1c2c5ae2a471465084c66a2bdbc3a1d06e8349f3ed7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c3db67f2a8cace98b8070262cd4180fb

SHA1
f119b12a5f899dd01ee3cbfda5022a0f9d822eab

SHA256
556cf4fd815e3dbdd091eaa46bc425beb240607401c371bf2f4a5a91e7a1f068

SHA512
3024dfd51afbd66a28e1e2f2e2e99cdcb60d6ea3e77338e1ba8343a87352a983b5356323dff1a8796293641247855e7570892d28982ca92939cd3c3a9cf3aafa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
0debfb29be624fd0f7d1c3cc071b089c

SHA1
340c94cc5a9acf2b72d58fca2ec1e792f5bc72ec

SHA256
4ca272b9de0860bfb468c7b75b8d2b61b23f99e40476fe7b7cb254a686c4402b

SHA512
3afb4b2de6cc84b0cdaf9943f63ce9bdfe0a3c10a0fc7c73352927f81999bd41a1ae9c22bd3ca7ff44f90ae88f4a7fc0d59b95d7791a61286c5f54cb50660324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
bf8f5276aeefdcfa5a0bdfed12c6c831

SHA1
e9ae2982b77a32aa0ffda5d6734a0d0402e7b152

SHA256
1e238c3e668adf9761cc3fdfa54c9bf1c2cfe949e1fd3a144c0afb39fd10fd86

SHA512
0b4eb4e0cedecacad3cc5aa07102993b35aa5ba92b0b76d241c6dec00f854393da271fc186812aff19ae7cff1190d00d6557f774bd8d4c6cda3f286585a66f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
b4362417d791ad018aa9e60ebe903546

SHA1
8e006623ba604dc20aa74ced715d2ff18071b35b

SHA256
d282858ac48d65c2e7b86b6965d4acf30296e07e0c23384e3040cf16a0bc0b98

SHA512
852f519254aa825f2ea578164909b171807f4f1e967f5c88cd828554b684f1021d5986af5730d3318e843d288b48146284a08ba3f4acfdd1fddacae6ecf37488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
51844f8aebd7a99b3296c7ba981614e4

SHA1
ac693cad7cad8e6539ba7dc208429ecd88969369

SHA256
e8e1ef52a17dafd17e991941aed0f47305ec9b15b1ed591fe8e192c7d8eeadb7

SHA512
e77d32c20db978fa57b6feaa15ce575b7b82117cc34981d2104ef29d36c98bcc379d156eec619fc7cd7cc5baffa6c96592a1ee013482f0b2b9351c322c8df951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bafa62b76446e895156c0433bf1b7816

SHA1
1623406e74ea0595b33e83ff861c815111405d88

SHA256
d48a6d828042f9e6e4457e9b96e350e1e29bd4e4d691dae4bb4f4676f43b9d23

SHA512
28c9bf8d3fe4e72a1c0b705e086f35b89c5c2b298efb2d8e078040cf7b2cc3f343ffa910a5a31b4449d31cbe645256c8af23bbcff111809ecf74a4604b0bf3a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8fbe180acbcbb589de0537cdbc456f6

SHA1
f74936452ddde811185312d27df26331a45db22c

SHA256
e948d76c81011d9fe1c0ac04895cfb671e5984f8def441e0d575ca2462bcab68

SHA512
87ba59d7e699a1d47dfd4de5f9e9abddf05a02615ac0c22f36755dbedf0f5cec2be5445504d998e77e8f894fc95dfd9101813b7d4f9a2105d8e77192b4dd88da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
677e0660747b64b7ce8ae23fe0037acc

SHA1
72e5c064cb1e935014c405c33f299154584777f2

SHA256
51015bcba3e78f1a74e8d8db81d97cfdf00effe69f08edd38ad622a5bfee6d11

SHA512
3feb87181a65ce5cc76ddbf751898b0ab5260edaf2fcb1e6284cff6e5a1f89ddfe8643a36c964ddb4e24ce2058fbcbc549526d812347a9b4b5ff636b2bd74622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
95d98d17c71a67321144fca42dfd7f09

SHA1
e42c9cd84c048dca64126c04303d22500f17465c

SHA256
c8db16f4052a423d3dbfa905cf77ef85145b6425b04bd0d9d67f097e7d69c30c

SHA512
270d03518b02b6600f966f2d31410a6eccba6d1557a3bc3e3f8e86bb42dfbf17d7df2edaedc7b68afdf7d3fa77395b68f2e25684ca107858316145c8c08b40bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8444c080d2a94f3164dfddc4816b6a95

SHA1
d49a1d61e50418671cd2d13ba4dab6d5ba422d40

SHA256
5a55a0eef2c9b29e45258b37a36268aff4f79fdfd264a280b20ad792c020c6f5

SHA512
67362b165aa035a94ad1ec2bcba645242b94417eb28a40c280d38f29dceec0c7bdcabd4dc3566364da11b1af7e180a52559682148e1670abe9bbc0baba4e9d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f3f5.TMP

Filesize
371B

MD5
5e676bfea9de812b4444cf86dd3ddca4

SHA1
67497112cf34cb2d7acd8d4d943c56c73763ff49

SHA256
16855dfb9de799d1a2681123c2b0242fe1a022650955e9f5d399731b22813b59

SHA512
3c4c452efe1d1625b464bb224c868b67af51c97f42ed36339a808864265e46ccb6ba4ea14cefa52a487a72f58020ef8ffdc75dd22df6f6ffd7b3d6abe730ca2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9190c324ff6f0aff339969698f799ad1

SHA1
509d1cd9828b64499be48f2d762f8ef01abc7424

SHA256
5750c534eddf3b18e85d64abf400ccf82f05c93fb0dc3889ac08fa14720e4d1b

SHA512
4c971f12eda36cd907eaeec59570a4df2e2ee541b4a4eef7751a52a3353580d15ba8bdbb623c32f6835c5fc3bf570b4bc4d6e2605061957d338d4758e98d7e9d

Download Submit