af7514280eece579a3f23dfed58a8d311590ec1fe098eb2ef4e4bc51713a96ee

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f113098de32ef2d3d678965f3c4ad3_JaffaCakes118.html
Size

313KB
MD5

27f113098de32ef2d3d678965f3c4ad3
SHA1

8b9528fdf8e53239b9a851184bc9eb585cd18d42
SHA256

af7514280eece579a3f23dfed58a8d311590ec1fe098eb2ef4e4bc51713a96ee
SHA512

4703c73a0f2a29b6803d1a8ee9c9d3162bf827e4a902c9643f12774698ae12c66824f7287f5ae623fd9b65e5e00b77079dcce490242771570411b4a332ed3802
SSDEEP

6144:drGyJAcAyeAcXpdeNYnuN5B7i4ClyHwc91bbhsw2KRnPwE3C:AyJAcAyeAcXpkN95B7i9lOwc91bbhsw0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
2968	msedge.exe
2968	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4300	2968	msedge.exe	81
PID 2968 wrote to memory of 4300	2968	msedge.exe	81
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 5084	2968	msedge.exe	83
PID 2968 wrote to memory of 3160	2968	msedge.exe	84
PID 2968 wrote to memory of 3160	2968	msedge.exe	84
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85
PID 2968 wrote to memory of 4148	2968	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27f113098de32ef2d3d678965f3c4ad3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b83646f8,0x7ff9b8364708,0x7ff9b8364718
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,10330664731526252895,6043973836051540328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
5d03bd110d922c71a35436e760aa3cbf

SHA1
e112d9e411695879739cce178b8cf0bde8336823

SHA256
398808cd043c49c3bcd9eb895ab6e0f04c3c0f5cca8c1dcb76d04d69f1889da0

SHA512
76716b45fc9241eee3163576a3d79fe7aec5c6c256f4b612f2843879bca5f74e213c131178ccd238b75c6d23817d3868a201f229c70a075297e17d49b2a35d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
25760f414d3eec1d7177d0bb11ac3f19

SHA1
cb10c426cf78de8e303ead265aa237c0c447f117

SHA256
437896871c801c871484f9a4e853ce86050ebe4900a31bd5c67e4fea5b796f8f

SHA512
fa52b757e22e7b88b303aac319dc6796e1c64663cdc227e4118439ea6d3d0d138f1e7500d6e2f57b835ba2a8a1b7590013447187f4439907058edcef4eae6e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52e17c55716f436bce187f9469d7e12e

SHA1
48629fcfc13aab6f5c500301225b02b5d7c4726f

SHA256
0c58b9c125950cc13ea96dcc2d1ab0716893a3710d7dab7cf6964b3a9dac0bb9

SHA512
d7aa60c69f0b12e743c621f47d2eb795b2a792325881a8695d27c6742ca3d4e05aeabd7e9c5916a3d31a25aeb7ec9e147a2a434ec06991a6580996b03d36eeb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6f803189cbd271affb4a1ba6b5e93653

SHA1
cca7c59d5f232a8c4d2b54e2fd8307873c11c14b

SHA256
caf2e7ff7fd6c0f1f525134d7a53bde619191c253ae8fa12cb8443e1691eab60

SHA512
6a6da1909ba3118a633bf1be92282dd36d331a3e7a1b83c2d60a3e4493d925f414c50e72bfa0f480f4ee9badd740b0da1593090d99cc3e92c51369df76bf48ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9890d27e68ef6e0a922566e0a47ecffe

SHA1
78fbd813ef1946651c5269bc8d6d06d913e20a7d

SHA256
c4d36532108aecdd7fa2556b3fc1eee86be334c4a2d0e2f57a357c4c8c74a8a8

SHA512
549cbfcc07d54a28e09a618e90523aec40c9792631602f3e916a731ba38c2ad1fd648015483517cf16f32828f1f0341742016e67dffe75512c8689ef99342291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c7ca70187d4eb2f0ffc79c26dfa7955d

SHA1
975320e4c6ba36d517b8e71c4e8182fca790d51e

SHA256
0cd1622ecd833985081cfadfd2a5a5582164e29b792af1f1c9b48805b7cd7115

SHA512
9c300508c638a2a0ed6933f8dad5e2286c9f2d83dfd4a5f2f18eeb6dc0d08864340eaf5a615b7cf26870ba15cb86ce9cf9b0487efb5bc099d5eddb02f17af58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
896298ae2f75c475c74c610398cc7668

SHA1
a4f76f31bd2c30daeadc2f0900acf1520a6cd5ca

SHA256
05a65b5aca20c58453365cba919dbaad46dd2f9240d901005078c0a3adfce551

SHA512
67dba125462f2ce73c9bca1806735bb963cc2d01a88d439fdea70db8acaaa0f5562bb8db0a0962603e6a07670f87a9927dc15ae7fad41fc7ab9d8d6a51604dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bee6.TMP

Filesize
1KB

MD5
cba5a19ae493db4e0c6aa823a2fe86ef

SHA1
4f02845193a2c2adc8cb0a9b4c336922d8aadf2f

SHA256
72608dfb8cc598880e5f89b77750d294b455af210aa4b47c567064f52ebfc7ae

SHA512
ce27c4b4801ca2c42908317c2eef96defb15d50e29343b5ff9f8a28edc8fe2257858ecf8b61db49994550ca85268321feb934fe7deca1774c4facd1d3ae11556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
341bb5cc7895e0c128fdbe37e19435d2

SHA1
2704dc8092571324e52f1092b51d595f6062f19f

SHA256
d176ab7c0a24655899cc543c21801da0ffdd3d0fd745fdf2ac7ed9a20f4bf3e8

SHA512
8bbd16eecc4d0a03a262bf8cb09d141f08b2e70f4603d071955e80331ce4a8a670fb2adfe4c63180be46465f1754140e27bac459786fbfcc965f607955911651

Download Submit