80cf1a7a1f22e6e4bb00009fa22ded897c1e5868da56c1928479a31290155607

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eeea4f397057f69001194888f7ec53d_JaffaCakes118.html
Size

148KB
MD5

3eeea4f397057f69001194888f7ec53d
SHA1

306e78efa25cc695e5d1130c215e89ede2d51640
SHA256

80cf1a7a1f22e6e4bb00009fa22ded897c1e5868da56c1928479a31290155607
SHA512

089b5a189cda5752213e1f8414712d3c43366272facb36f8b04a53a34fe9b26f6ad35a354bcb47669979d11a8c0cd8ea3f32243197b411ced0f181043241c059
SSDEEP

3072:YZY2MYJ6rHfgaToXdYKlW+lLltLKn7BKMt58:YmoaTozlpow

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1456	msedge.exe
1456	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4136	1456	msedge.exe	83
PID 1456 wrote to memory of 4136	1456	msedge.exe	83
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1988	1456	msedge.exe	84
PID 1456 wrote to memory of 1868	1456	msedge.exe	85
PID 1456 wrote to memory of 1868	1456	msedge.exe	85
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86
PID 1456 wrote to memory of 756	1456	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3eeea4f397057f69001194888f7ec53d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb633a46f8,0x7ffb633a4708,0x7ffb633a4718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7451452174186968617,2191891127150646170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:5340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\749a6632-ce66-466d-b278-ff1e2a0b8568.tmp

Filesize
368B

MD5
84901b9553afbb61b26ea96202bf9be8

SHA1
3ff0222100829e199458bc823f0e1efed3c5821c

SHA256
9733b0e25c669dc8b32842c1c3cbe6f2ddbc70a7eb8c5c2fd2f795273220ebc2

SHA512
69d5daa9fce96b510848b66e63a450686b316df8503513a3ea1728ad66d76fecaecfbce2f17d7ae678dd9ce551e69c90eea84dba4b914080ae2d40ae93332868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
74KB

MD5
1c7e1982bd31c4ac1f58bcd3bdde7267

SHA1
d672d5a215d6f3cd05138e121dc3a2aad8a584b0

SHA256
f7c3dc7f8feec3cc31ed8f65dcd3ebde31629c69e62c26ee44cb0dfc55c3de83

SHA512
33caa8d1f077129fc36e4da0f50aa8fb29b204dbc7e8439781f8e28a953da49a63a1057a83aeb1b33012aaeaf205ae62c34d1391b8885d375c486aa15ec4000e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
33KB

MD5
430d0f52546401d2f8c037bb84952ebc

SHA1
446c9de67e5cc8c01e2108494fa0055693dc6993

SHA256
fbbb7e598e30407bfbc0e1415bff3127bf07ff9282937b87330bac620e919696

SHA512
6b9f3d0332aedc15d05e0f574e8710678898355cca6b16ec452fc9c3fc80cd4a7e7b45361f0a4f7faf55edc5f6c0c76efbf235b022a895e3aa5a06a4bc843830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
97KB

MD5
072dc3be9042b863f465f570fc3efba9

SHA1
0323377816ff6d31dc7431bb702be82cf0653764

SHA256
608f0e85d175cd5a7c54e11d519f682ddd1fa886df48be30f91cc72c4fa7f08c

SHA512
361c56eaeec2205a5cba71ae7f26949d80b12a8cf451e6f0b895eeb40eb8700ee5c0fde8cc34d881c304e655ef168b91b3bf241b58db29876e18f6e24cfc42bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
31KB

MD5
548260b20981c0be2d9dcf8d01c08c24

SHA1
84230120f8f1bd559eca3fb2fec6acf6cffbf4e7

SHA256
2f8a612a714e5c928525fdb193f8ec12f7965a6c0d63dd8e58ccae239358c8bb

SHA512
9308e58083e5a6989b7646de95d251c5431952dcd55e613e9c7100d817e847da0f4835bfbd0df325d9ceeb4fb9680d3e89311997b801b16bf8426893a2a34c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
22KB

MD5
6f52f16e0c8869759029f92150fac68f

SHA1
d7171b0111ecbc51953fb6a6a0fcb639c9aacdb2

SHA256
0ba65009d2629977348e7cc30414a518b21b8fe7f50351fcead70764219b9bb2

SHA512
ebcfdfbd773d2e7a0930684c7699f4e557995473c50ed7875cddaf1ff03fd889684400c6f17558b6f801ab5c66da0dccc312cdccb1b2fe8e8784e8c0987cfe11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
a25afcda122a29d1f5124029b593e44a

SHA1
fd2c66b8a33d603a104e42c07640716617eddb10

SHA256
cf0223c784573590105951c2771c581ddbbb0239a3d5d4d90d83ba79f8c6149e

SHA512
6f6be4d2111ebb59a119a9a9fddf4ce7d75e5e5fc7e74605f74e738b0959f16655e6b09537a6061dbca4def3507e3ccbda0e166a39dd0ba1d58290e37ca77630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
157KB

MD5
a07a0041143bc11d11c2fe0d37a5ded7

SHA1
cb14b39ec6f8a362a08d1957af211d81f750d54d

SHA256
233746b5d7f58579f0d5ea21e4907fdb5be5469f05dd7691633448aead77fc98

SHA512
17811e64a82d0810bb293ebafd2a04b20efacff9e12ae3f6bc555f75232349766cc52434947614684ee43ff00478cdc0c92b692053bd31c38638fb15b2586f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
2d1ff6a957e5509662bc985d074e4fb0

SHA1
ec024dd4a4cb1d751c7d4f290474a7d17f60e848

SHA256
c1d810f31f86677bb6eb23a9603d96809e13634c83d9513350b936ad860441cc

SHA512
d5ef9d49b1a4fce4f8395bfaa99d4fc3fe8798b97424f982cdf3e6b490d2dbc4e2cb091633971cd477ff2c51c9bcd03ed3b735447207cf8c930c927533c3c0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d769b1f62ced3b6d314a2ac0e809bcbf

SHA1
ac1102605aa9e56ade14f2ea9c66fc565d1fc19f

SHA256
36497a478adbbd20a7f647dee0b416e84d62c19c12cb5d6616557364963132d6

SHA512
dcc7f07abbfdf13b1383b586bba8548245f8012bf378d33ed33a552d583a8faaa86f5818472186240e3f0aac5624ec5e7453932ab967c89dedc3c91c8dd23b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4bae9f792a5942486d62b97ba4c9facc

SHA1
73b1d12fcbfece62c6066c13ea03cc1ab9d91eb6

SHA256
516c180d1163d5a87f8311739e4fa84730d0f873b9a751b12521052f4a1a26aa

SHA512
d5356082c6ec46ee10570c62197d949681f96cd73ed1d507be2cd08198e0928f00f7ca39f847c2b5ef915f9b0674c006683348f617fad0e794c2ce6600af38a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
29b232f0a2d780285b50ba112ef1f9ca

SHA1
5934212075a644ce24423104a8ab36b5ee334e3c

SHA256
77b048b4d9ad8156a6e448c1a7874a1b03aece023197794456953b6e70631bfd

SHA512
52127abe636f0d7123ecb27fde7bcfb32d7a6c6a262f9ac40f6f74612c114179c1f2bb32aa494207d2c9f25223e28527c5124c0bd59fd3f5fb27668ba8010689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
ad53d036a53b125c4f4060f88b255ce5

SHA1
4fc28a1ae8a741c5ecb0acd96dd7e856710a96d3

SHA256
57827d5e7b3d73cfe73c10ec73bcd011491ce2c4223db2c17fb530b75f9f3e07

SHA512
e3b188d8167d9dc15df0a7bf6b9d81b391c98fefb357d0debd9f6c71ce4980f31323cdd3df38e926f955fd62aa81bfec95d768b496736d4d90a81f8956c42b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
74b05bb851af6992ee5661944837394d

SHA1
3c908143f92d246083b78e60a9b800b219cbb065

SHA256
40d5eb064bca1c16ff24c71c8fa13b0ed996adf3e90c28c3a8c46d772628e74c

SHA512
ce2b6573232f64e3258e303cfb3e1b475bad27f78f5c1dd4a614676762a5238b5831771c4515fe72eecc3a06cd229734e9314275ee868067d587560533b17f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
353a4d1ff70573e4b606251026b175c6

SHA1
44fe1ad9bc91fb4266b204da20b0a3aaab0817c3

SHA256
f726cfb893540d1d06c76565a31b24077601f9520a868db897274e1288473e63

SHA512
d83b352ac53a081d9533bbe7619a75dcc96e5cd0f322e331b0a843a2a325d439fae5bdcd81bdd2b71aa98f9be02873a4b0ec1eec9f903a1616b0f61247255670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2f6c97fba69beedb798cef07b98a8e0

SHA1
01e48ddb8d3b3feab2afd3197b588776c9bad336

SHA256
5be0109832f87a062688da9900b622fe7c22738e48dc64ab13ed3e0ba5e4e645

SHA512
27947fed122de4500b400adb55eb23a33f65cbbee8131a7424a9056351d7ef20d95e9cf15ca0b86313737d3f2f35187eb57837721961c4ce35e9963c85fa559e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d3d04aa2bf8a774c1b103c88c0669cd

SHA1
02af791de3e272ad87f755817b06e089043c0d8d

SHA256
2f765925290203d6f406e9e1c8f954d7c18f1e98d1de7594e860d0dad9655ba7

SHA512
d6fdd89a0b29780846379df53e0ab53ca11926b6a94653cefdc4c27c97fb7db7678f4c42abc80cfd1a146adfc1fb56b7250612ff7582c96c363f33229d6d68ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9423d2554e8435a639b812325efb7cba

SHA1
f998d36a200688fde335d03662f919721003bc22

SHA256
a2b47e4a2dfd30f808ade76f6b28a8f23c6f464aba566fbda8780ea29924f1f5

SHA512
91283d96bd9fc57628dc82d0bd94d42e472eee8c425098cb2c3e8828646cebffe83e198144fddd31eec4dc083547b5ff3df9525bb2ba971415e1e0742f62e015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78e0a1b49d1fa2d59ba18f0bb362ccc7

SHA1
0d667b0f2d5aa9a8912d0046f045664be18c4e0d

SHA256
6653acbf67c49bcbbf8169141ada2e5c90c5aaf2d7e3ebbbf05dfd35280dfc63

SHA512
685cae9d066ad597f82e17d221f1d2e561786cebf7e2f4bd1b65a3e9aa0b22a87ddc3a0f7d63aac822b4eaedb729c80ba7311375c2ec8dfb364c68ee2ed26382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2e4709c0c519ecca02b95ae3b03d9d7

SHA1
69c336f7827a284ace6280bc3f2f21caeda66372

SHA256
e3327c246e8622ef6e0e1dbf92f6e893a88aa1fdd1096cf34bbb6f22d3188858

SHA512
42d55c6158f27fca2999441a31a96201e786061985ced742e61c776ca7c4f1cabd099e591cd4961e522f69b7c332949302c7b6df2e517f3f5451f45de1b7fc48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
4df22866b20efbd8813040cf96aac457

SHA1
f4b321e3d11ae0fba3dea35185b9e3659d8f4058

SHA256
718382af071e5055ff6114be369a7c40902d22656a0257f3eb878e56954142ed

SHA512
fb20ce671e3ee88ea41a2a9febb66becad674c0fdcfb6038572c8d9b1948edb5e41f8c644fb3f11c02941abdd24ae9bf09cba42c69279c74035340141149cbdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
6cd86da55fb3e92faa2a380e9e2c2dea

SHA1
a19fa0e76d03b1b9b54df645a132e741770abe46

SHA256
c39d429568513950ed6b7f341499ee18a056a07e15653d4f6923938d873bd0a9

SHA512
69127a2f017f3b255ee66ef73d68a11b39e8bd19e1276a3071f7b7095da76e48bfdd34937a8fbd434b673bc5c202f0c5d831a6d970220795b617e7e2809e981a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb89.TMP

Filesize
366B

MD5
82be81502949dddfa1c418af316fc0cb

SHA1
96cb8f19101b7a9ba7c3537d7f1087c5685855c5

SHA256
e88cf96844ff54f021a6fde41cf7773d2d6ee6fd67b3e67df8120ff148f66198

SHA512
707ff450b42127258328d2d807fd5690480cde69f669db43137bf936d4185ca66a3ef90b7451a9789e10a39f8ce7341bc47463784fc8770d9cdea3c8e400a5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11dcfc4c0a830ded2436af3f98bc5e48

SHA1
402e0973f6502f173a5cc708c967ea96abb892d6

SHA256
a7e3436a32685e22b5330bfa73e0d086e3a9361b661fe9b0d6b06be48f053f35

SHA512
57b278e53c3acc11b875dbe9d8351c18a675ff34851fb73193622ac3337a661c6bf7a7e21108ff3da960446b77e16ee0ccfd6ead6c6a93865cb5abe8e032c32b

Download Submit