36c21601193b190211273df92b527a60c26dd61b1eacc8464579cabb454e9f5b

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648895b667d286df250713de6767e95e_JaffaCakes118.html
Size

319KB
MD5

648895b667d286df250713de6767e95e
SHA1

9f94380ff125e5b0b7510d092895db892f4748f7
SHA256

36c21601193b190211273df92b527a60c26dd61b1eacc8464579cabb454e9f5b
SHA512

59c13b9e3deb0b01e65222854418c3232a9661fa8e7e0407da5c7b6df6aa7b75558bb11ad9c6455a186d296447dd8b855e1c882d35cfb84ee2dae6041fd49fb2
SSDEEP

3072:HeO3IVGsyAZGxrul5LpQ3DMreiEvx7DLlPZ:+l5LC3DMqi4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4504	msedge.exe
4504	msedge.exe
5052	msedge.exe
5052	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5052 wrote to memory of 3740	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 3740	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 2536	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 4504	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 4504	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe
PID 5052 wrote to memory of 1208	5052	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\648895b667d286df250713de6767e95e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce95446f8,0x7ffce9544708,0x7ffce9544718
2⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
2⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
2⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
2⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
2⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5104 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
2⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16543978540304746268,7278770082418910828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:6092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
17KB

MD5
b0613cd8328896adada565dbf7827b6c

SHA1
04a54e8f89e8fb2b2e94fbe68fd0598df8837138

SHA256
f262cc22d0b01a68ce200ffaaac7b49dcce02df240121fb33dea837b23348256

SHA512
1fad7b1786ed468d893d275e2cae6ec911b1ce6ab3c8fb407046314c42a45498b61837f6ecdd8eafec8334f8e8ca217f5be24b5754e2bf471a0380706e0845e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
18KB

MD5
c41c48e9b07385b83c8585df58ca653c

SHA1
9ff51655ef6a05e0a23397a596154a7b2bb5122c

SHA256
5086269ac2f8fef7c3d210f0de40d9c7fcd7e45cc2d56450bdc1e77cc1fca0fa

SHA512
ce500c147de90b2380d5b4c1ca5f86f23abfd72c1b16c8a06a73ad37da15d3f1404ac76b09306448236712b6f81c2a66483f5a90d134831d580fae779caff1ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
18KB

MD5
6d9872121af942f14295556c320180f7

SHA1
a8ab01b5e13db6432589ee3ed50ce98e0cf75284

SHA256
ea0c824235d18b4e2fd542e30070d0dce2f848f7f43eb41352c91d2d9fcd0305

SHA512
c5bbb8e237fa66bd88972742f10d90ff76ea3a9c72b85cee7a905dd376f19ba7e2274b7d5e9dda77f86fa701d5cfb556b24f33f4b7f5183e0fa04406a9306412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
16KB

MD5
5eeeaa41a3c707a0d1c7b698ce9858be

SHA1
73d894037c0de036854ac26d1db4da10473d9dc0

SHA256
a85b5e6510866d003b11d3a5c3b62e712197adfd0e9f95e75fca38db4eabb6f1

SHA512
26f8787fc59f5fa6e94aba69df33c49c1ae0cdc092676b142146e84abd591e70b5e075a156b9388b63143929f8b918c2e857fdd1e63951d178e553b9683a93b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
21KB

MD5
39c4f7de9b5ae008428cceb9ea5deefa

SHA1
d4b788c9e2e100d3ec55be7477c9c609b58f6757

SHA256
267f2b0cbf201e44d9b1b477d2e816705ef5ce87cf9d3591c7e6966c642eb679

SHA512
ee0bfdf349c2e55cbf0a58ef32065f36d8699a90c327ba566c09f57738268bd0b569569b3fc1f9a2a10d708e8fb7e1a73efb68497d47d5694f74afb97ac58c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
4887f48c42a44405f7996c6a675c9aa1

SHA1
8e61cdc1b76c48eb78750a3ba8da730fc4900c72

SHA256
15d8a26a73dfc16e5c6db6a1d457aa4f64b079c4532e4ec6798b8f1d7ecd14dc

SHA512
057e058188a1f913786669b806ab3621eefa924a1716394bf5d06096ef45ed9fb6d5dc0c090af3f69c8834fbb760d50ced35f20673850280c64935c779884e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
27KB

MD5
cca1fc2f60ff9fe3187d7cc8e6ec23d7

SHA1
5dae6b182930149d76c0d8feca27cf44f5fe0872

SHA256
c7b31b0b97173048a7e96708bc29ab9e893b738910eb0be8b492eb60c15aeaf7

SHA512
099d057c09b2ba61b0e1c75fb289747482bbbb3efc73daa15d5c383e592622dcc0403f53b76870ade9ffbc31ebeb434afbb0c2c26eb19a46d5832cf6b10eda58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f272e0168fb187df0d99f494aeac4b56

SHA1
6ae0380af765af1692c6683b1dd96b0dca004a75

SHA256
8375a6a3e5e7bfb8345ee3a98f009a0799e32cf25a7bc41154291f184977a21e

SHA512
ac97a7e131c55d7993c6e42788193f73476be00c82025045b84300872be20d74f2a260577741ed9d0d46c572952d4fb67421e4a36b133d08167f44c8da2e7c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f4ea957216446158f8441d9e580cc42b

SHA1
084af2eef175b61a79e6c21bce114359a03348b5

SHA256
f5fbdb89ac51684f9528cd44deb0c535b14021401a629f1e5e870dd551d9c8ff

SHA512
e73e55eb599c97e2f58ad1679b5c63ebac737648ab1b202e27cfa092732c226c87a6014e4e0359132321b0f2f841492ec7ffd63cc652cf821a108bac677c1d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d0dd05f07d625fac5daf4b0a588ee0fa

SHA1
1ddaa72c402090b753a2dc171f05f854723d55f7

SHA256
b3993f9281967e8453c83df9464ac6e8821afae168b6a3ce7bbb180b0fa2af0e

SHA512
0c87a67a60b3c16bf0c32fa44b326c4fd4fe6d34e2023360f034e0cfee16493acbc7c5390c29924ed6f5ea1713f464c9ccefb67bbbcd2a0162fb0be05c69aff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9689ac157118f875ee2a7c9997793bc

SHA1
b0955fa5c42150a761b726d0ff24bb5e76648b81

SHA256
0dcd9b5b6a7c2b4093e959e499ace9df107fc31cb30b47c89586dcd5388947d9

SHA512
ec856af010d8966d53ef6d33d65bccb3323fb7d4852407cff91037d1deff78cfb64f1c247435d5fe11b581d84b38a4003187dbc7974c286e3de38ab28b79e94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba31a65cc00e75fb42b6e3f52cc4e17a

SHA1
adf06b0d5203159aa443cd74515ba9c01f8575ba

SHA256
e56234f20197b0f86ce2881b0b0987cc5d0e337ef61df6f5e73cb0e72c7f57b2

SHA512
1be0d9817010ef16734b51c350d8a0e26003bf8ba179504fba8aeae867f199d93f13f58ab35d24673bc6cb2aca507fe7be5301af6e9f59e3acf127da0f75de04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a826e3c95d61fd44e3cc537271ea712

SHA1
b49c3d01e2fbf0cada84d96a6e8757300109f208

SHA256
531315cca4e9c3583d5bf7357363bcdacf15dd3c778e8327539afce1b2585851

SHA512
6f2cda4322d4c7fbd97ab4305f654f22dc9a7336e338210425d83911cacc0be5091aa32b29c003f9a71f44d57fdafcdb3a0e3ae05e4785252c7f469b66eed5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa1a5921dfcaefcfc8df869dd86666fa

SHA1
e8aa581117ecd6cda424b20de5117803dc3337cf

SHA256
8e1fd8821e4affeffaa38313ba53d5044ed7f1c69d6122ea5daf8e09d93306c3

SHA512
b0740258ed21335b8076cbf72e4cda0c2a141b9066bddefad6479fd6e1c018bdfa75c59966329b44926b332c910ce1e623436d109f489fa394bb5f7b8f4554aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a76b1fbfd80fd63ee16dc7d78f92985

SHA1
fcc282be24bef68e22ff07c7488efb76fd312475

SHA256
119f127cdf4c3122e08aad7819a5897d71eac55897dbdaf78aa31b28ff54d193

SHA512
fc0ecb6c9d6b99a576eeb8c17207661e388e24d2eba54eb95cc8fae978e8896eda28f46832d1700107172d93037f269fdc8596bef186c0602305f4c9e5871606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
528b48d2ca9be134d54bfd0297b35f78

SHA1
0f54df09c98e78891b084a06b9e66a4441d0ad10

SHA256
3d1e7986f5339422e6ed5818dc5a2ad44480da609bc217b2fcde180385e8c729

SHA512
aff634bc647fa457e101adcca6814dc362dcf8b15b84c6d260f8a1f4992915ba4ae439f32b26cbc3aa23e97ec5aa32f06afe851088ab93050cd625a6c426cba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c09f2449888eb3badd92b75f0d746637

SHA1
9cb448422996f5d8829f66a9fd1863f80a87eae9

SHA256
b6d99118539796fb7714488df17a33ea0fad5a49096d9ed1968a11e4c1bf5765

SHA512
448a97608109462d525eedaaeb8ec1fa9938c4cd161328f9338498633769d6b98030a8bf8881adc78e5dcca06b372245b78cec4e8e1c7fed800bb158f71c9f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
7e189c2b6873145e924b5d5b8fd0a6d0

SHA1
2a1de9ba8b086e533f4f6b591face0562017802e

SHA256
0d6e17a32591d22d9c5f137c1776919dc7a2288d7770742ca96aae613d17242a

SHA512
40c1e83afb31da1400ed11e97512ab612292dfbe7b3d1bd22a9650aaf2bda6ceaebf23c415a8b0ee3d1fad278173c829cea8f351dc1f3b65aface3e36ecfde62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b898c712b5a7651817fad0f0a544ad1f

SHA1
0cce8bba4f180bcf25512098c6c97772d9631818

SHA256
551525176b31a7bf114f9774282a24464d290703b546ca7ed275d82187a1d9fb

SHA512
0340dc21c49493d7b5ab07e6f2537bab10f16946fb3df5974a134ae6eecccf603deae634f0867a31e213fa86e6a9157da380e65ba30904472b702f7ee159386a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d4a41e44b39246bce25eceb2b7557e6e

SHA1
cee5e6102c71bca78823af5d6d59e80de2fca2fd

SHA256
8e66b91b2bcb42dcba6f5c3f58c5893d13adba252522ae9bc479f7cd2be8c941

SHA512
da1a77fd1fb27966719889b2bc3f0819328cb1adea968b529e57bbbe1c3decf349f62b08e59f657b2a06c51433672996de800ad7f647ac7d0dc20cd69d035b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582fd5.TMP

Filesize
371B

MD5
e799b835de28772373b7bc9dd9d953a2

SHA1
92aaab8bf74e17d33c99e45a907ae60b94cac8b5

SHA256
90f45dac6d176be55ea3bf51e3b275cef413566770f275e67c712afe7af690fe

SHA512
5c0511d54d4c662d2b5b2b92b1f8a03c3a6cd4435fb7befc57271f46bd4a96bb36f43e8ebb837e61132eac91fd22c14c9253b643644da2e3b9f9a69be623c636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
112387a97ee9f5d2395000a6a91ded36

SHA1
a3d232939f4cbe0fbdad31dd5087a8f159e2ac9c

SHA256
5e6f08d6a5592759ab2677c301579326b03b30293df7e763d7978bc39e4daa30

SHA512
aebc20d2e8c835e7d6fe7384737b9f78b468a70137c6dd9e5050136dff3ccecbeaa6258ceba8529d8160ffda445221af3332fb51e7129d108f64b1ad9d50e65d

Download Submit
\??\pipe\LOCAL\crashpad_5052_DFZGFKFOPNGSBAWD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit