4b1842f84899720c169e26db8f4a05d10230b2b4375c9359cb01675b79044872

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ade33ffaba3f69aec9a0b390c2e62a_JaffaCakes118.html
Size

56KB
MD5

63ade33ffaba3f69aec9a0b390c2e62a
SHA1

e79cd4aa1a2952d67e7d4525bc4ca176de7dbb9e
SHA256

4b1842f84899720c169e26db8f4a05d10230b2b4375c9359cb01675b79044872
SHA512

3666ccc8d8a2115faae16a0b850d04355be19f188f7287e72c82c32eeea08e949a08cfec4358031bf27e5abd6fb8f6b58a73be0575607f9905b9114c03958d9f
SSDEEP

1536:Bwgr8VkeO3S+qdyeOi1/g4eaS6cgRr3jxxO:teO3S+qdyejg4LdjxxO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2088	msedge.exe
2088	msedge.exe
4796	msedge.exe
4796	msedge.exe
964	identity_helper.exe
964	identity_helper.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4796 wrote to memory of 1124	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 1124	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 4152	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 2088	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 2088	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe
PID 4796 wrote to memory of 3548	4796	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63ade33ffaba3f69aec9a0b390c2e62a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8645298665138293798,1715875529394981261,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\759dbae0-ef89-4c69-86d2-9f1f274f33e3.tmp

Filesize
11KB

MD5
6a35bc60d06862f99df5f9a84265e473

SHA1
b169cf1b722ae8d4e9db3b585224926ba4b596d8

SHA256
eb64e865e4e0ee6530592605adf743de5b4537887d645d2fd1c478fb5009c545

SHA512
23e9280e600b3982800b78650fe2563ce32f67bcf826c0d6fa1e18b143b0d29f885f65ed36a79db42cdee1544b69d88a8ec4735da7af74d134d6f371129209f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e80bb5a-290c-435d-bf61-7ef635cb353b.tmp

Filesize
6KB

MD5
95be3d322522fc9aae9ee6d2317f70c9

SHA1
cd4bb77dcd3e599c7dc8f4d981b96a0d44685d30

SHA256
035b4d025f9f048c362c948beda3ab654583badc7289945518e20614416f4e51

SHA512
b27a0e555d37a93316ce1dc6005097ad06ab431ddec9ae2db7a96d2e8bef42b6230790ce70bb2c360560865c957d8cfbced8a09b2e74d2639356888de421f8ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
9be780bc06907ecbdf0320d88e6da1d7

SHA1
5af34c97da84ba9319b4b8d6e63352eb9299bead

SHA256
bf111ba484d1fe1d7ebd0f2c1e3e61a844008abb17383c81610efa5f6ceccc3a

SHA512
ffa99bc96551ce59af822011cea136142aba10ea600760012ecc3bc5391dbdd3269e365770f4650e9de12fae39cad2a6f11d2e70a8c3c73ef17cdd93b2fb1822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
54KB

MD5
3d43ad52a5e97214b6780973a555d0c1

SHA1
ac5dcc5dbafe9781453c87ee892c8769cff3df25

SHA256
2760b7d22f5936561faebf3afcec848f31faab71bf5c95243e36908178d33342

SHA512
e117dfd48a35fd897b052e4623449bceaef0b9d9742ebd078b36d6029743598e1a91c81c0f984f0b3e2b81ba02bd6613c78db6f477ee202374ef94bacf48b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
7d5e3460573d565b1b36528e1b85ca91

SHA1
c0cb63c74a74b12f59d49aec8704a81d426bf83d

SHA256
59b7faae60069a6825f4ea19e9cca877402b21e1459acadaefa253f1e8f2553a

SHA512
b0d082f5bc98f4591b979e5c633fc867ab168cae406a4d1d8a0ba3410dc795d96b900f5f9a2949999457a8d629295ae39ab1ab92abf95474801cd982bf2499d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
53KB

MD5
a7be7652c5b560383018d017fb091cfc

SHA1
7b6f231b8bd991273e0f277f844ff928f51ec2b5

SHA256
2790d23331fe4007d6f4510dda09a7fdc14515515d6bac69ab432a0bac65b1b3

SHA512
2d15c7eaacca4394d11450b8d31968c6ae6a23430ccfdb74b559e18d8e0b87b52aa3a9a2884575d642125ec64d5581c64b91a2eef0062484b3fed1775592a8d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
44KB

MD5
3e50f49ade198c21712bb3b37c8cb835

SHA1
d3db7ed87b7294c2c1211958d5cbba0de67fb487

SHA256
d7f2243b8fcb4c3cc5d787528ba164f18a5fde3b70d07dd7f1d515cb5933ab01

SHA512
aec837dbb21ca28973e20d72260b8cec2eaf5dc4f9e193eb893673ba650ea8eeeb5cb91508ceedc1e7ab847df07a173f4ece4468f7ca4b335567b90f35ea9fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
43KB

MD5
e32d82c08e1d7f3f5b3dcee5c98d7a55

SHA1
9c95ced69a4c7d7cc4c9a5a73580246d679f682a

SHA256
1f99659a542466da7253e89d7b32e7cb19c533a106f01bdf2dd38178f1bf2145

SHA512
c27d67d534a0eb0620be572016a6f5ef7f3191db2c0c7dc532e32c29990bcfc38639b6fcfb801114ba3f0c82bb4969c20022bfd4f5a7775ceda95a0dbe207403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
dfde29d504d5d95a354be54af3e9afcd

SHA1
7c9f20033854bdfa6d2f9fa332f62690419407a6

SHA256
db715221f77eeb1c4d9a5707d29931c7591ff582fee772bd5423997aca2e0ce7

SHA512
97c141943b28325b5467bf95e8cd729f2df2f798b9935e81a031857df08daeb915d7b449c89f91be08746f6f899156a779f4a82a57a1d01758728cfbb61ccaf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
08daddc827394bb7c2bff9e924996556

SHA1
55ab3b681e802b148525ad29e9eb3f73e13b03de

SHA256
19bdbd1e1c743353fcc935e145ee033fe5549b9920f5bac215ad44db8cd60111

SHA512
7bb96d87fc76f26187f5ffebf78667eb41cda9e65e866f2c22e94d1cfc18b61eeb543177f25163724e02d12e57dc1515cc629c9a40b9fca9032fb413735caea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a87c18f4778b9806734c42714636a874

SHA1
c9cdf991556642e6be3bd94592ca6d423e725453

SHA256
64c03ecd5b24cf4df0276f5a96bfecb310d731b3a8163b7211c5150ec565a86e

SHA512
a47bc1875f73bb40bee43a3597108b4eb82881735ddd5a8a0214bd0fe687c9812ca357412281b7eada751162ea4d93cfa9917cc15c56a086b233b973a8647ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
406e92b7cf9e789a04706b775d8e42c4

SHA1
1cea7f5549cb6f0ec36bc244263b9c671d96504e

SHA256
a36212a889f9eafc3f6405a6cd8c44ccc436d6bd3406cbb8c702b8e517c274c0

SHA512
4e2d1f74dff053e3642f668543f42084ec1e8c2636d68581002bd0cfa412b12deaa68f89838346bebc2ebb59a5c26e36465d495494e972dbdbd4594b23c287e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a6e7356a5428ba11c6df91fff5cf354

SHA1
4bd5ecc47c16c8a0e17c515b8328a4dd3c959f7a

SHA256
acf1d15574394ae74ad90da78ae1d8932999799eb3b8f53228f54addff19361d

SHA512
388cf59a99bad11b275fec7b7b33588cc4d0c003d3df76b07324ff42960893816032f77dd349cbfe33e8057915af9a7594716e660cece6f3a4b5a2a13220612c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e06f76071a078fb446d1d0344e50de7c

SHA1
80cd0df934d52ddf36a3e1ac9ec47d5e15dc46cc

SHA256
52fbc9fe0c686df4288c4597fa9234e359d88b0cc210fc073275c83d499fb04c

SHA512
e1164749327312256fe8a64ba024d0471e9205c0051c67b6281d271e09c1fd253d580f2bf154a52e7a5eeadf5a56e9d57600932cb9c90f8d92cd6bc969bad6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdbcc1f4cdacb6a2979a904c143b2405

SHA1
242d14e990ea443fb892f5ec1ba8c1aeec0b4df6

SHA256
943c9694962444503e9e8e7741df105d443b65c7d17bb4071cdcf0f41da66f0b

SHA512
759277a75a8fc98b9bb5e6a9d491d43bf10fef3916dedbddf5f1ca639fc8d528b27bacd64d931651809f27b353a3acde12bc817e129a95a7342226d6886d795b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de9102b25c050460293a8872100cf583

SHA1
1052e09cf2058e3a34ffa104960f12981d7e57e8

SHA256
604edcd55da5a075869a0625931da2fde9abe589723c0409d64a95695544d8ad

SHA512
129170cdd0a3c2ad66ef45344d3fe2ba093d13c7f8ab9fcb56f9e8ea9570cddd95b39024ddd95cd1bb6801170874103f5f5362f64e636574e833fbffcce0ba2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e02d015aa1ea25d524ce316a2f777f09

SHA1
71f4c74356660138610fc56069b5584776fa390d

SHA256
a449c156ba89491f464b8d9e43fca9237e2b5c6e909c38a856a41f841636e0cf

SHA512
44abb00939232869ea5b5aa5c84f7c657aedc979883f2da0245c2c11a8bcb29710becca80ab8f577c02977f7be18a76d059284e135d11289783b08e40b5f71dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
939ba11843a6094c87495315e0b85e58

SHA1
cd0594f082b557ad4ea49885f8da3f5284c3bb6f

SHA256
01eae3672bebe38642c1640991aad8e370fc200477b8bc1570db407644586f02

SHA512
b5ee918e0d952e1d3e6126aef3ed23bfe3c5ae12a77ef25c75169f98aacffaaa5a559de968d9f39c5ae23c5a867dbe52a0a1e844c4b3d4e5bfda8a114134ecad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
267e5ca7f60e41f61a94c58c68787cac

SHA1
c51ba6b9d97769623e0e953362db02c3de150389

SHA256
f26712594d1649a884ef8b87485d70c6bb5c400532835db391738bc871aa5622

SHA512
e67029b0b875aa6a9383456c2ad6c3603ea782743442a6906ef583255a3eb11a820a7cf7eb8cc7093444f1a6e71bec6a7d87bae5be6e9378aebd956685ff23ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5837d4.TMP

Filesize
371B

MD5
00ce3bbe7517818e7127429b16c95229

SHA1
4afaa07421519622cec6350dcfbdcb110314ccce

SHA256
7e9f7c39a64e9fd29995f127f525be79a7058243d1ea8ef3c7e423492797e207

SHA512
73e131688637ce30907a38f7786b4f38e8e297711fab088646860d4637c2edf4ead4525d094091dc21678b8c9955ad0b8f66ca32d1d7a4f30167dfb7569575f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_4796_WLJDHLUNDUXJSKST

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit