13fc0a1eca16b128dd307b8139b30dec59789273a47c9b07f153d950380942de

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44dcce6239f7bc1b18aac57e7a10550e_JaffaCakes118.html
Size

34KB
MD5

44dcce6239f7bc1b18aac57e7a10550e
SHA1

5929e918144123b20d238318e5055a4a70021704
SHA256

13fc0a1eca16b128dd307b8139b30dec59789273a47c9b07f153d950380942de
SHA512

21f6bd6fc88d63e3bb5208aa892f53a50c3dc52d151d7bb2a84d287764546a18ea1183420628c17ec09107f2c05712bdc7eac9ca199a89eaaf515953b172671d
SSDEEP

768:eCqY8fQO8s4/KJ8HO3TWzEi23Pvg/kaS6cgRrECRe29xEy:8Y8b8VSeO3TWzf2/vukaS6cgRrECRSy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
1980	msedge.exe
1980	msedge.exe
1436	identity_helper.exe
1436	identity_helper.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4084	1980	msedge.exe	80
PID 1980 wrote to memory of 4084	1980	msedge.exe	80
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 2988	1980	msedge.exe	81
PID 1980 wrote to memory of 4120	1980	msedge.exe	82
PID 1980 wrote to memory of 4120	1980	msedge.exe	82
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83
PID 1980 wrote to memory of 392	1980	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\44dcce6239f7bc1b18aac57e7a10550e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0a746f8,0x7ff8c0a74708,0x7ff8c0a74718
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14049922285948168420,14999148992188147682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00e855da-56b9-467b-affc-570e91de16ed.tmp

Filesize
6KB

MD5
24dc2f34bae77bc906b40d8104321c0a

SHA1
f68647bc688dc87483d72d2f7a580c13c3f645f2

SHA256
7c49169ffb523a5bc133b39251a2c68310e56b628a6202520dafa623e1ffac3c

SHA512
46f0a0ea5bf9e70dfcb8fb6e5b6acb83f15083a2042fabbedd8f825b13ce2c829d9d74cc7e683dcb73e08490a02194f415512ca31d30efa0b94710948f0f4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
35KB

MD5
aaf43a01c7c5882cff81d32aca0c73b2

SHA1
72ef4599ecf450c0c3309670f44b927203fc0a14

SHA256
f328796eb94f865db398266520986fb34cacd1a47258442affc00141e279fd22

SHA512
0b1eabb32b3b43dfcc95138270383e0dbf04968f3cff8126a92c365c2ebf80c1a88f091e1c190fa76fd5057b7b87d0986606d2a6cde96c33c2abca3813532b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
54KB

MD5
3d43ad52a5e97214b6780973a555d0c1

SHA1
ac5dcc5dbafe9781453c87ee892c8769cff3df25

SHA256
2760b7d22f5936561faebf3afcec848f31faab71bf5c95243e36908178d33342

SHA512
e117dfd48a35fd897b052e4623449bceaef0b9d9742ebd078b36d6029743598e1a91c81c0f984f0b3e2b81ba02bd6613c78db6f477ee202374ef94bacf48b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
46KB

MD5
a601783b430a8f930e3f10d74cf5094c

SHA1
79528fe1bcb67c3c25d6d813a9ff57a4c7eb8050

SHA256
8c94a9da768e6bec7c897a8ee08c1b95191970f3f3091a891ad472d6bf5305cb

SHA512
63d97e76d40f989969d0e11c13deac217adf5c45ec3d93c80169b9292bdda5fb585aa91673ba15a06fd33a350d16d73856c0aa52ac093fc52456e303b86aa6ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
133KB

MD5
4d1bd282f5a3799d4e2880cf69af9269

SHA1
2ede61be138a7beaa7d6214aa278479dce258adb

SHA256
5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693

SHA512
615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
43KB

MD5
66bc6bb65f6f81b7a22cb33c654a7340

SHA1
cb35c4c494dd014c64cd7f41b8a4230d796d8646

SHA256
aa920573cb213a875c378183424c3ee2c7bca0f028f1fe1afa9e9b0cbec3c479

SHA512
6d4dacbc87cf73a6d4eaa6feada1f2716d8effca75f7f7b8e73a7959e3a03f18b0f4a21b52d9f840e7bb1a21c03bf788d0b4893204be5c06f2763c9ec589562e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
de13e09e0ac093a8ecbcbb0139ef7ef9

SHA1
fa2654d164c8dda9b34727cf30f331c76c35df8d

SHA256
4697db323d51b612a0648315184f44a57ea9427a4645ab135c596b5b697498d3

SHA512
9d7845525f3c3cff2ae95aec3bc5862cb761a27f6b9d77e7d850cb70eecc812d307b8f08f5b17f868e8b5aa8fdff4983b93274265eb4a63c857d30e946cd0447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
51ccefa26393c508db51bb9567089087

SHA1
7a031825e4644cdd5c63f376b372b268989ec612

SHA256
e3fc004d267e3396cf6ff1784c464a8585fa023905bc2a3579370191a14fc817

SHA512
08e58a093899aebaa178473df3b1fbe0067f7f7b28195d1f49018828da464967be0e25292b39c617aae6913037ee900706466a19fe733f34a9ffbcebf61a30f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7dd3e7da514671c2a378aa4c96ec6cd3

SHA1
e4435af8069789b002975a5add0d7d1b15cc9cbe

SHA256
e2e3aed622d6a6ef489802de4676d62f3920fb5c73994eaa32d7e398aa465bbc

SHA512
7ea68aab5050953d01c1e2d8761e084c65ae08441505e57fbf80ad27979f320068be77f5eb43a05e85faa1dfedf547897be735d295bf2a70c5da70698b9e7edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1018B

MD5
eda8442867b7e43a11558cb6727dfc1b

SHA1
e52c63b8c9d13372fa0f4d9f4e813f11b6b6908e

SHA256
c22c57127bf75585369e113bdb00bbe623c921ce7df3d4ade032efdb368520a6

SHA512
e62a93d18974aeb6ae1f1f991f8c943450458b560a8f57f0336ae3d3879325efdefdfa289d50f747c7e7426af364ed68feca1b41ca506fcb6ce0f4830635d6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6daed9212e020172a9dc5f7ed6a97ade

SHA1
af21c793fdef1b253c4d205f3e94b59845823f15

SHA256
44f86f04e6cf3dc3a04e38b531333a760180cc3ad21df5860c81fb6ba323a44e

SHA512
f77b337544cfe82163f76f03c80b12c79af0e41c8f517fe6d19a0767a1058d6528644a7cc181edfc914d71a8827ca35d4f2bc4e428e8d339d9359bd82fb57816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7452a98171bcc3b2913831040579dc70

SHA1
94122b5e00389d680a4025e28d44ec32dbd9fd55

SHA256
7ddc5d4acb722c93c8913bd9c01ca23d76da56648bfa5ebfd0b9e5287935a396

SHA512
0f03ef1d487ac005eea0f7758cfe4662fb204221a5bb2b1e9fa9cef344811d3d6756141b24a82f11b22f36a5aab0b35dbbb52e47c4b55b63e9954ca2ba43afc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60fafda2f363d99621b50e17a36f1f0e

SHA1
8d564832910b8cd14f634bfbe79045de414cb2de

SHA256
fd85bb634baf39ce0b61494d47a15aee6ca75a1c8397aafd1ecc1797decc7011

SHA512
b3b28488def0ec5e651b54b69d9d970de5a7d7db18068eebb2c0de5c804646a8269945dc375b80105b3f33a0b34c24b0e193ebfb8dfe6ff581626f83743527a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4119fa9bed67c93c1187f3175244d786

SHA1
3f389d933579acdb08639473008784ee201dccee

SHA256
2496731fcddb708966e1e1ce3725579c0d827545ced2ce5839fb4ed598dba529

SHA512
f29f9a48e6840a4bdd6819d79b6541de031d1a29cc52aec61c737fa8df0983735cadeb3c2056b0984cb4d10f3ef09bc11d6dabcdddbf24da2da426b4b2ea492b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
c3af87ff6578aa4a01c5fafb06e7323e

SHA1
db3630e329e8ab429a095b1ebf96cdd312954f65

SHA256
9067658f9b052a2faa693b55b46bdef38566826991daef343707b61aa2b0a84a

SHA512
2680d4b177d7ad2a3cacc1342b260048a201a00eeeb0f656fc48a786653cce1440cce9012dd840fe0e6903f6b55f88b099f583192ab5c099b8c795a9f0a3cddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
29cdb2167cb1175c932dce931dbcb475

SHA1
ccdb0c779f7bbaf4fad897a2f172a51135cc50b8

SHA256
5c346c9f0d97decde47ab3c64cfcd229ab6d4c1c6f490241c9a992980c617a0f

SHA512
62fbbc766330e576c578d8df7c265d8fc538529a90b64c4dcbe391d8e470d41e1c285b1aa560526c87b11eb9b44f786292d762118b0620b776bb36b0e697d16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587e82.TMP

Filesize
203B

MD5
81d315b9e0a039cc0f849ea30a81fe77

SHA1
2ff87f5293c81dcb33b2410283c51f8dae0bff2b

SHA256
0ec5152d7c13cd2d98cb2989f866faac757bb96826fd6785a27af20eb8f6f534

SHA512
b08246d7ad68f20314a204d0854808764417c149bf0fd3798fff51336d27d9e49c5e5485389962cb9e884527eb5c92cc76a1309adfc70339bc86a1976bb1d0ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8d4f7d2ee7c827102b38a494b983fd48

SHA1
af1888a070b2479bae7a7e90bf249a9b8eec9a97

SHA256
ba87696ec21bad48c472d79c2eeb43114cfd79e88a5bc7c00d1b8f34f0343020

SHA512
f117ab7d6a3b96ca7486baa1ecfd4f519cdc546d98375ef3481c9ffee93c6ccbed04ba165a6bf017f5d4278d162d4be1eca46d98a51024fe3bebf94e7c029f42

Download Submit