eda199bf39809de8d2636e42d49e59de15ed22d56712c27764b602a69c57d34d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6973228c970a5ba429981932598e0407_JaffaCakes118.html
Size

64KB
MD5

6973228c970a5ba429981932598e0407
SHA1

5a2d9270ea4b7733962997668859a26b436c938a
SHA256

eda199bf39809de8d2636e42d49e59de15ed22d56712c27764b602a69c57d34d
SHA512

bbc811eb0d097c27122ad7ab943f00455aa36fbd783599cfcbfdfbe4c9a8394500dda50b8f70720985028be79ebfe08b6919fe6329ebcc5da3d6fb37357a1948
SSDEEP

1536:2wgr8VkeO3lO5De7Werege7reIye7Z0AeyyWUquQgPhbed2aS6cgRr1x7qE:aeO3lO5NyWxTy0dDfx7qE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
588	msedge.exe
588	msedge.exe
1836	msedge.exe
1836	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1836 wrote to memory of 3492	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 3492	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 1724	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 588	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 588	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe
PID 1836 wrote to memory of 2548	1836	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6973228c970a5ba429981932598e0407_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1763325466915927926,1445691939888817933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
60KB

MD5
bae4031289a34496f20375f4753066c1

SHA1
1e9410fc14db03da999f9de5c9ac35b4487d666e

SHA256
148311fd9d4168eee55dacbbf217b836ce3da4dba6127619def0059c1a87db52

SHA512
81c282f2542fcf677686d1ea515c655b8eca616f6842e55b856db78e1728783793ae200e4ea0be8c31cbce02c5a969e62d4b6befb6d74637736cfa8223550c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
58KB

MD5
962533254708ee34455b048063379c89

SHA1
7f536b2fb980e8212a6e9cbf5a93aefe029eec82

SHA256
ce5ac473f6e04a785e70ebc34381eb24e021d516cf78dac1b478dcdda54aeb7c

SHA512
051e6f8e70bf238ef90528561daeea17422ed6d544613b86e6eec49e38b744cb07ecfa308f9680806ebb9f1f69d102896efeafa33b3473a07f13f78ce2924c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
48KB

MD5
890e8f7da0eb1cfbb08d840727532eea

SHA1
750c3c0931a60f4b199782e04b49e76bb89b9efc

SHA256
b8302426d2437d882e514e7ac6368252145f397632157357db0d41fff9e953d6

SHA512
e0669f910e57720495e8d7c8289febf3471386e0ef4e428b5d7b0d5022f2fe7742ce34203806a8500a185addef3f600745fc46100ba227c0b182edb327f674f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
55KB

MD5
8c9aaa0ba8cfeae03c157df0d249d8ec

SHA1
704cdb4611b26223195d5807f6f1980b02c4caae

SHA256
76a13948b577632343013c1a193f08dc158cdb45f4044660b33d4b01cca398b2

SHA512
4bf4d299df67735f47e9eb02253a0bbd3b663f532562379a27c9a131d2499a4883b7a3d1ad96d259779d725a6e774dff36c88f75c79f95ff6cf53fd3c728e25a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
9be780bc06907ecbdf0320d88e6da1d7

SHA1
5af34c97da84ba9319b4b8d6e63352eb9299bead

SHA256
bf111ba484d1fe1d7ebd0f2c1e3e61a844008abb17383c81610efa5f6ceccc3a

SHA512
ffa99bc96551ce59af822011cea136142aba10ea600760012ecc3bc5391dbdd3269e365770f4650e9de12fae39cad2a6f11d2e70a8c3c73ef17cdd93b2fb1822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
54KB

MD5
3d43ad52a5e97214b6780973a555d0c1

SHA1
ac5dcc5dbafe9781453c87ee892c8769cff3df25

SHA256
2760b7d22f5936561faebf3afcec848f31faab71bf5c95243e36908178d33342

SHA512
e117dfd48a35fd897b052e4623449bceaef0b9d9742ebd078b36d6029743598e1a91c81c0f984f0b3e2b81ba02bd6613c78db6f477ee202374ef94bacf48b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
91abae5389fba815971e1878cea631e8

SHA1
4a33c0ae2bed0d5c36fac7e5857d42fc19e49b72

SHA256
192b049d51c8d7a1f75f525cb50042bc712665ac7ccdd8bf3f26f4217cf96518

SHA512
f6bca2601e075953feb2beb0c61c7a7ea06c59c7de413bbde9ed93da683197e798f0e2a5fa660f42065e919028ed8c501e1a09f34247bdf47a77400e988634f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
27137ba825e5f01b6a90acff9e47d1ad

SHA1
2eb4bfaba68cad1a8d39bc548ddc08de788f6ed5

SHA256
8fc071ccd114d4cc07ed493636cec244358674678a8e7cfb5b118510949e42bf

SHA512
6fd4afd1067bed92007fd1f0b79a8d361f2740dbdf377b351dbf2a711a853a2eb13423b4cd841b5d1969ec3e49dfb4c73b401de6f626fbea470a6a204b3d2074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9804d0a400a81285e623a8fa7e065493

SHA1
a49be28a9e9a5b5e5263543247f1f831222db88b

SHA256
8e1b0edd9a96cf2a1727711e586683bc5b971bd6a0b70618a35d675be86537fa

SHA512
dbd74c4250357244248e4f88b76bdffe81fcad1f46084c5ab6ce164946624618dc40b78497426d6fecda12dd4f373f6e67c8e490af804512a38ca7d88c4cb57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
80e3a5175cededf3d38d23d4f95a7fa7

SHA1
189452cb793ed83c9fe994bf4baefd5bb0b8626d

SHA256
ed3effe2ed42cb1dc0b11835840e40304c092b2ae9f4ea817bdb61589812c0f8

SHA512
5cf88c4418c49b5df52fa7e8af25a0d45466f0186b1ceabcb5e51b62a830ab15ca68e8333418ac0734263fd1f633c43fa4f12822f7851fd01f83ba60b25c9a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2fe868cf7ad5652374849138b542e8df

SHA1
9977008a0ff0289957943df50a576c998cac9da1

SHA256
d9c936d9edb605d4cdf720813ad60e372d760b6ea0a2a9b777c2cb1872becdd3

SHA512
0a2394e142a40288a8a9d1653149c422232259a2b1fcbf275f9cea5bd35e2b73b00dd5fde33e7a262326620023bd689ab1ace820c63b2a1708634c1a0379bffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39c66ea1ad20895bf941cb1d5c97504f

SHA1
f935e2917278a9decc537f2804e1227e9aef7a85

SHA256
43ab89766c03f022bffddaa206ab23972b8bf8761b2c3b50dc7f6bc274fe4e2e

SHA512
ba49f4e40a86b43249c70e3ae36b24c6da4ca8ec0d722f0ca02932cff601ae269a1850719890a350e54ebe939a08f457a3d8e23d52ad3ab7cd8fd8215e630095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
109ed40fdd8508d726e1a058f88c2de6

SHA1
cd4280f5e9bddb11e2c18fb61336d908c0ebe0a2

SHA256
a3b723ab5e7a086e62d23192e14265240f425b581dc39c76b293158b7ba42150

SHA512
9db736fc5b4b90a0075c807aaf3225e266f40e882d316ca847b7e37ec93a15cc5150ef071d52bac4e91faf982b88051177c44df5b479fa649f4fd18b84fe9f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebf65846204cd78c6d6b5f174831fa79

SHA1
d6d141f99a6c5e351e27490a80aa4af4cdbdb0d0

SHA256
a8da9d80aa147ec2cb9b71f25ee172b0ed3a16f6a408c52e7d544eac4ded9856

SHA512
8c25e21d298f4fd9341a3a9b2794c46a8fbe1566a0d87280cad1348eb29d4fb619468912d5e0c5a332b7d3edef682bfb308d975eed3c24a99d556f8a9defe596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d4786d5df2e63f5b0d787da31ae9db5

SHA1
7025ee01593517fe56fae9c6da1aca3521eaa466

SHA256
68f33f1d1c5327e284429fb789659bbdf2e863edd37da3e0bd99cebbc630fbdc

SHA512
2ffe900da05e32789bf52b49c94bbd61143912256677c235f5bdf3cee292aa9f397032c11064e78368724cc04e49d731b3e157a7b848021949b9a3aade92a7a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c07dd1a56ff3cb72cdbabb79938b505

SHA1
056e40cdb4bb0e5e2d9daaa0cc405d5703a45afd

SHA256
7a290e3d194015e71a9e9cfa083f3c163f4bc87a6c0e613bc7e0183c8ae153ee

SHA512
c9b84c200b3eb7e4860a2b4bc61027e4117b6ac82c593ac387883ff1cc3fd70886ca5567420f33ee545c7ed9dd43d036885a8f76a9f9aa531e6040580cc46784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f00a57551b57e618ebb055ffee9660b9

SHA1
2b5b19811f1921b851a1e6da362d5796f865ad01

SHA256
39e12ac418f04c3b8acec8ea216ce02116795683605db756e7a7a7e85af83c15

SHA512
448cb938c33fa3ad091f53e2ffbffd847ae8bb7bf286e397c74f844279f77e156cbb2cbd2a08124c02cce5ae0be63bc0c0e7fb031357c063535fd7529591ee76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0da621e8771db23bc4f43c75bba0aa93

SHA1
5156a8990fe2529d9289c6992e74cf3756bfdfae

SHA256
6499d1fb6aa61465492a63c89c200668919101ada6952b0837ec7b2161ca7db9

SHA512
5a82e28980873743e83577ff899405c43fe4c510c852d28ae7f6ba8c1d7c8571ded6ba2096ab586a3dc276f59c20975c89c3c6a02590eac96e7c09ed5bbc1365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
89156c8bd02332efdaba96b4b9563453

SHA1
2b05a56029bfafcf293d54579ca77620d6c964ca

SHA256
fb55b6dcff9321fbed47052fbb5dd8ba527f4ade7a584ebbbca375f9902fb481

SHA512
66ccbefd2bdd32fbe583c32689575ca4c10456cb39da4f1a464b0a807ccee846441129f2bf6e1cddd982941dd6dc49400be80567034e319cfe61f68f14fbe422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
4a2b58a89370ff898c2e88f75c369061

SHA1
9f0db71fd3b30312349952a6b00ea742e2ed79fb

SHA256
4307645ac55acd3d7c6af1881754100244505887de350318d25697eb7e4b933b

SHA512
35b0876bbf57f337d66b553f05fe18785c457e5209a0c4f6b7ea3106863dad514a22ed8aead814db100cbb7bfcd6a2d33a4e035e82ffa6834acea95c7c9f18ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
b7fc270a9cf1b19bc5eb40160489eb7c

SHA1
4b431844ca081bcd1468fe7e9d73efe1a538a46a

SHA256
26bf53a0150c2423028fa799f3c05adeeb738f1757f6dcc51a844c33d0d0de95

SHA512
196a338516688f96a687bb65b27f8b0f75ce6db55417804ad9eaf085a76a333b830e6e64872e27fbded01be84958181e3ae8838df095c8cf55cb0e99cfa78c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba38.TMP

Filesize
204B

MD5
713dff4da3794b4358ae4158e7e4e7da

SHA1
edc1a28cd6224b5b900ed8264eaa67d520b530fe

SHA256
f9fa87b96a12fa94059512f39bce765d45cf0abc18434bf52a0cd3585dddc78a

SHA512
de9d80c0d27ad64c6e9204ef8b670bb94dde38925775b220590b9e9db1569674a49fed96b6648f5abe2d1b7db48abe8956109aba35a146365e885ac1322c23ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
79161a213ecac31b0ff75bd134d95eff

SHA1
c8a958e40a0f79f8f323b62b3f347ea79dea2703

SHA256
b2bdf22bd7b21bd720148fa6fe5d842d78ec8b7d74f57d75239c1820fe7fe9a1

SHA512
d12fb875fa762cd56f245e78b588130e22afcd90bc401ba24fc138ddb85647499e28878fb449a4416e29e154e3b27378d2dfb5816962c9b990511401696a2e21

Download Submit
\??\pipe\LOCAL\crashpad_1836_KFIUEVQGEOXKAXFG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit