dab025174210db6e403d38255b501c1a1c513c3932d14b80607b47f0549a657a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c3eb1de605221a3220e9f8445802b71_JaffaCakes118.html
Size

93KB
MD5

3c3eb1de605221a3220e9f8445802b71
SHA1

8fbbfaba1ab2f5fe6cd876eaa5add6a4c4d2c7bd
SHA256

dab025174210db6e403d38255b501c1a1c513c3932d14b80607b47f0549a657a
SHA512

03f06597d94e9e310cd6b6994f45e18e82a703832c891a53018c02b0d18147d010aabbb6930772ba9a0e5079792381b5086dbf0c285bfed55ac205826ae3022c
SSDEEP

1536:b4QZm5sU7EkWqG6Bs9xWXQnNAotBkxcSMDWbkADb+RSn0Stmieu4gWzmcOcubZFG:b4QZm5sqG6cxWXQnNAotBkxcSMDWbkA6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
4836	msedge.exe
4836	msedge.exe
4148	identity_helper.exe
4148	identity_helper.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4508	4836	msedge.exe	83
PID 4836 wrote to memory of 4508	4836	msedge.exe	83
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 1044	4836	msedge.exe	84
PID 4836 wrote to memory of 2720	4836	msedge.exe	85
PID 4836 wrote to memory of 2720	4836	msedge.exe	85
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86
PID 4836 wrote to memory of 3040	4836	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c3eb1de605221a3220e9f8445802b71_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeca0746f8,0x7ffeca074708,0x7ffeca074718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17582303509731920919,12709414463072119211,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\267a3a96-27d6-40f6-965b-ff13940a6051.tmp

Filesize
6KB

MD5
e46201133f71bf581f50ab06680b7deb

SHA1
30dd6c0a87cce08f6defb6bee4f9dfe9227e8593

SHA256
e9da6f225d9b703a5b72aa229a3584a903f670e11b9bfa19460258d68dbeccf0

SHA512
6f6d4f77dbbfd534815e2a18d58802489ee07a6e1664835d79567f4da1ea725bb80a38479bac3cca60bedb00827ff7e0c54fac9159956ab4b278f09d3aa82339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
32KB

MD5
1fbfc2ba1b544583815404b4ad92dbfd

SHA1
d4f89ec5247bf715e314e45848a2710b35e79715

SHA256
35683e41edb1cc791cf6d8c925431d63b500c4e8436b61a26d4676c3f1141476

SHA512
17530db85040c96d7971f0aa4cc768d297f2bfc3075533302c56b2ccc4f4da862e8226b9e642e8044c2061e26a1d2633e344439244c55cdf271d0c58d8b6a83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
44eea27c9d0eec65981b9df6de19ef9e

SHA1
ea0b058ae2350975ba99d549544e72436b1a4d4d

SHA256
614a2cc6bcf2b9eb27c16814b0980bde9706ea870bb00c9c9456c59b728e9ede

SHA512
4d64134fb53c8680757c45da125aac0df95ea80853d35e813d7d5f33fc278e72428402586f51beaed52795b4f65c736c3920df7a10bfef97c08f10d667979292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
5fb675a2325c7702ee3b630251b7b0ff

SHA1
a3b7dddeb7dac5a8189c2b964c4c617f5c47ed72

SHA256
d0100813f7d06d26189b95863badc2c615a850dce0f59cd490cd458c70e7fe73

SHA512
158097d3dec1b933f4a41d2514fef124cb3dcadf671a4343ad40ec35e5c6cdc6140a11da24c995c35aa98bab9201aba8c49b20ca7f92f2ace33d0257d4b30f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
4edc54843b3c8d77bfc7f965d2053454

SHA1
d6dd88b30b37732343a29a47869e5ce205acd850

SHA256
0f47420a81739fc54d996f85207f0e20aa43e90511188d9d714574a371132c58

SHA512
2de7770ebb6ad8a9605cc3710d0317e5a5d46a0fea18c37f63f2a003528ef35c74e8ada7f0133d5bb4dbbeb29ff2378c22b9f1b97c42d889ccf455f72794d9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
509af6fae92544efd2e9ff02fe481d6c

SHA1
d6a563353472b99f0c0cc5fa7d72c9c6e9dd4704

SHA256
38202ee62b8fed96f50b06f00b5b2f799aab2f838649b3dc2e17d5b6a9625564

SHA512
2ad47b9d6a445410ceb5a8a86ce7212b0a25b6afc9a3525c5a73adafb122019e61c5a37bb42477cde538d8a6183f058d502cd16113d10f2017956ee979f30f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c4d2baaab17b5b84b4e6777fbe9501f4

SHA1
83d9fe3776ae4554592089a61c37adacf8250750

SHA256
104cd4ffc4b5b5f132ac91dc581a8b4b0a70ad72a079bdb29c74870337c39506

SHA512
59e79144a3b8762259a127f8b1e2f152b3f7674d7b5090aa36b0dd0357912f838820b01f59cab8a3f9e2f7ad8b4a92d639fde9855617344f122ee9a57e98b589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a391a7d37a92a5aecd5d0902ba534c0b

SHA1
f3a1fb921da9d72b097d3f7678e921626a5e3ff9

SHA256
44e16c5add364eb112cc0fe7cef2b93f6575386c10bf949fee2f342b3bddbc22

SHA512
de06a83249d2c5f060f91669c2d82b2c9412a5e4127be50fe603b174776881a101ddbc23fcb2c0dfe0d22be394b74beae72032ea5e0b5253637661b29f3b3d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82b0b5d7fc7be255e082037aac9b496a

SHA1
3adc3a38e7cb572f8550c3debf5ca3530ae929b7

SHA256
cdc65873f405fb814b852a7ba88d5b4f435ba4e1b15b3862c199731c2ee1b28e

SHA512
49193db7cacc692cbfc513e72ff9c8a7fba1aac8380850328d3bfd4c19e660709271f4811e16d1fa12b9ee4b2117c32ffb72a563e4d3199b49b9882f3cba2c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2254cd5c298218ea9ecb286a965761c2

SHA1
7ca63ddd1035ec991f82a4174a183aaf1209d879

SHA256
88ffcf2a73a82427c5f9bd3afe32ca9a505d4afa57bb147d79aa99c918d23b0d

SHA512
cfb7d47c0ff6c268b162f7879d7f8071190192bd1c9040c91320eaac89f72d0047016ecde9ecf3404a04850b327bfef1632e9f75cff9ef787e94fb8b089b350e

Download Submit