fb5f0caf776b31ce851f499b8f3759a1224da2cfe70afe854a43e8df1431fc04

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a3fbfe228db8968beb9045bceaef26a_JaffaCakes118.html
Size

129KB
MD5

6a3fbfe228db8968beb9045bceaef26a
SHA1

92846f5020b3d2af5f23d4219f75b47277a44e0c
SHA256

fb5f0caf776b31ce851f499b8f3759a1224da2cfe70afe854a43e8df1431fc04
SHA512

dc85371091bbe18ce84d8efe5a845fb4ecd4a845554a3ac54c5df3d0c9b83134c7f70a268bebe9c019d2e7bf4600d2f291bc81e3062d9cdc3cc26ad87bfecea9
SSDEEP

1536:tY8b8VkeO3fXys6+4+h/0d0Kp5rYhPaS6cgRratCLb6MO:NeO3fXysz4+h/0d0KvK+EtCTO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5004	msedge.exe
5004	msedge.exe
2832	identity_helper.exe
2832	identity_helper.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4480	5004	msedge.exe	84
PID 5004 wrote to memory of 4480	5004	msedge.exe	84
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 4688	5004	msedge.exe	85
PID 5004 wrote to memory of 5052	5004	msedge.exe	86
PID 5004 wrote to memory of 5052	5004	msedge.exe	86
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87
PID 5004 wrote to memory of 2272	5004	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a3fbfe228db8968beb9045bceaef26a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8517946f8,0x7ff851794708,0x7ff851794718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3099848546466417194,11601209280307856016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b04b942-279c-45b8-9e42-f34c71d53f39.tmp

Filesize
706B

MD5
e2d8fbc29aaf0681670a8c8929ce6def

SHA1
5ae16aa5c71b0d6ccf560c6aaa8891d06960917d

SHA256
8ebd7432326097e074197d0d075e5839f4503cb544c70513aec9f4dd5c6062e0

SHA512
0ce100692b5450db1451a57569c6b444e052fd7ed9692cfdc0560055b999383eabd8fa7ab653c3cdd3097f792b3f8f7d03e76a4c1a13ec303daf2eb9716f0d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
9be780bc06907ecbdf0320d88e6da1d7

SHA1
5af34c97da84ba9319b4b8d6e63352eb9299bead

SHA256
bf111ba484d1fe1d7ebd0f2c1e3e61a844008abb17383c81610efa5f6ceccc3a

SHA512
ffa99bc96551ce59af822011cea136142aba10ea600760012ecc3bc5391dbdd3269e365770f4650e9de12fae39cad2a6f11d2e70a8c3c73ef17cdd93b2fb1822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
16KB

MD5
d22498cafb7740ed67c58f526e6d75ef

SHA1
dad787621d6b3a631198597961fec79ed9ff40b3

SHA256
71fcd720ae7badf7909445547b5bbaf8fc56fab64678670ea8f534e3270f83c0

SHA512
f1e85ccb4b033ca84971f21104b50901797f99512e065c609ef2a356d6440fa5b0e4fbd473524f6225d87bb0610bfab3b01bc5db08ddeae432d1bf098e781cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
54KB

MD5
3d43ad52a5e97214b6780973a555d0c1

SHA1
ac5dcc5dbafe9781453c87ee892c8769cff3df25

SHA256
2760b7d22f5936561faebf3afcec848f31faab71bf5c95243e36908178d33342

SHA512
e117dfd48a35fd897b052e4623449bceaef0b9d9742ebd078b36d6029743598e1a91c81c0f984f0b3e2b81ba02bd6613c78db6f477ee202374ef94bacf48b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
e4bedefe2836b39d626053935cf2f803

SHA1
105fc75ff4d76c2ae06e422f6304dc9b1552389d

SHA256
758015e3cb56989df5cfcf912d2c3861a62e623d386ef12d4bacf15891a4eb81

SHA512
041aa8392fd5bc2922301312c4cd315b9af15bcb5502ac8467cf13e9d4e76e726f0822b50392d3fcdfcd0f37a119cc8afbe26e75130c36ddadb102d1595a0cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
58KB

MD5
6f0126f86afced26c1701e0ca4a9a2e1

SHA1
47b2969b8b9fdf8b6f56989e45b700816677754f

SHA256
52d7edce7ad52f5e8cc1ff7e24460a03f14d2960c41f3a643833535fd03c25fe

SHA512
8c767c0d16bde9bb474fcc8681db081ade207a846eee79d791b703210751e715c94b8c332a34034b6d6ba69e4b7de516b986318cf24d21e925db1d1a2032f004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
43KB

MD5
66bc6bb65f6f81b7a22cb33c654a7340

SHA1
cb35c4c494dd014c64cd7f41b8a4230d796d8646

SHA256
aa920573cb213a875c378183424c3ee2c7bca0f028f1fe1afa9e9b0cbec3c479

SHA512
6d4dacbc87cf73a6d4eaa6feada1f2716d8effca75f7f7b8e73a7959e3a03f18b0f4a21b52d9f840e7bb1a21c03bf788d0b4893204be5c06f2763c9ec589562e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c85c57482bc9dfdccf8a8d85edcbc830

SHA1
864f43cc0331be32244ae5004a3966e47049a467

SHA256
1e0e24f76c9ce8d344262d040470e784dbef7261d3385629a8441ce0bce02d96

SHA512
ee71ef9a8bc661593502d2b57bcf75b3178e1b531fd1e017054c848331d676595e53f3c924b4b68164bd365ece8491d3f95ce2a2855d4ae64a9f73b9c2c45d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
808cdfb789e05f911dc7a9a1c6fc1d7e

SHA1
c1430b4fc8d0c6c5feae24b64a15008b7ab5cbd1

SHA256
cd387b6d2600ac1dabad8bb2bf6d9bb2d1a442fb40104a8ed26b4bf680658966

SHA512
0fe97d042255cdae0caac22f00600e0164e664d1a590cddc871b68ff693ee92d3b429cb6426f47c44440dc9442797ac6359a6b644cb767984fd79a73772a02c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
458cf4d753a8e0b413bca9c4a7d1ebeb

SHA1
a784e9749e8c17edc0b5e053a3167d9dd5b6215c

SHA256
2c175124b8707dd5bae8b717f82ab24b55d5ef5f9a6968bcce6f79da8e2271da

SHA512
16979b74cb6c8432a63064c87f1d9d7db15d0a3b45fbc941f850bb4f07e422799428ee39cdb5e6745e8ca95169a0813fa6f1291ba08194b98bde806cff2c4d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
0f84b2710aa5e94a380ec7b765312afa

SHA1
5a4f29716e43758e73ab16daa6b10fafd503b478

SHA256
0726824d9314f73594d5694bc1e58b3e14d346b9260d64251ede4943196f4238

SHA512
7246533de3156bda0bb9f073df58e8d340099eb1546045f760438a598440f9f7a1c86aabe187329b85cb49dda677f9d93aa2cab7ced9086c19f87e28218f417c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
db131e57cf7d99343fdb19b92e847e07

SHA1
5afed31303fd47d03ed1c4998b315addebe77d17

SHA256
158e61796c6b777ab55736eda0b43f34b47cd21ceae8cecb052fdcdc5c45f021

SHA512
f414c5ff656ca7bf5722ce0b859a561eee7feff0312229868f2cb76b32e39bc8755dc487b1acc6418c72879566cf19c8f5d79ddc0404a2332e25e6c1179e9db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7dd39e505fcaff7f2c12c07b0ff25744

SHA1
3dab187e5be58d303d15b1d2f1653c981dfc4e2b

SHA256
607d8f4b04c3fd1d72089b6d92052dbc4cd4747e233c36e3ee242be2be5a7ce5

SHA512
72e65645f40c8a8c6271800562dec860f658bcff12c6502f3d63ae2872791b62c6c2af90589b2feb949cdfb0db534bf0bf457403f48fc49f761833e0f5a4b8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
317c500d6effcd5eccc38f4c95fd2c7e

SHA1
7549f1b6725b6b4bfbcd4f5f0f1a9f06c5bbb08c

SHA256
f53f5172060be8eb0bdaecc75f79958c9d0050a2a6de132ce9e34498136eaf66

SHA512
9707291a9f2ad64df3bec265cf1f4b0e424e0cd9b0fd9abfa7cea8dc83a9910b9c8164dab6d59293717a882a2b4d135313fb34aed01cd564d65a1f14117da54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1136f85e271965877d2af463eb6ad6b0

SHA1
dcabb42ed17f65b1f4d3b5646fe8d2ef22b7cb41

SHA256
074ad56dc99a7eb6ac743eea9c59aea0e62d93976764108e83abf65c72174892

SHA512
c919ef3fa08f73defab52ef10122decc7ee92a432bc01b9d712e891820287df20ef853f7b93ca601ef5fd191397d397e73ea2a3808649741bf602ca4ba38ed9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f79c5dd5331c25832c40a85a0cc6501

SHA1
1ff50ca1235e8506a31ec580e2a14160162df023

SHA256
79c62531d4d7a9a63d7a335ab592ce371eb0dda7736306861baa3a5b5e6b0fa0

SHA512
e428bb922b9ca409663a33f5f0cbc3125e8f6e198d48451c7c11d23f73c90f44000b4ab7544024de35fe87b1cb17bb14d95789d02e2b35a89769d3aa994164de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b1934aa7387e248dea8f1da47f647908

SHA1
ad2099ab52b8f86a443ef5fca7ba921fefd847da

SHA256
c747b90b6210026de2985edb68a496ab63d74e8bfe9043b713b4c31e9ca05730

SHA512
7fcc9af98c282efa23a616760f572621034fd62ac2eaea2d17634e251682ec9724c1022209e3bb8a6e529c1815fab5f863379d6ac4ba8c5329546df0d65adb10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
584fb91ed5a7a4275ca510756bea48ea

SHA1
6823904ec441126d70664661426364aa65014474

SHA256
9e93c0262e468ab07d7c84dd62a562f0f72423db5ea4d263708439b59272becf

SHA512
e72938982207221c7bde3787d0469e903e86ae96caca9587efa93b4da9dc24f6206e614d7222cf0f4fb6b616bb4a9de6175f05fafed1538c583bfd137dfb1195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a779fabbd249e2b15f92171fbe30025d

SHA1
c259480e3231e0a433050a1cdd5cd30693e3a7f7

SHA256
309e7ffe39433c45fb76396acc80a39979c428dc273dc20159659f7d9e8f3c64

SHA512
43e3c12ba58425f2409303aafac87de36c55a213409b8cb018cda9fc532891f7cefb15b9bb73cdc57f85389a3e053e68aaf676c8f0eec90cdb241c098712206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0aec7e63d03e1f7fe19da9ba5668cd6b

SHA1
1e2ef9ee0c39cb2e35607cb97ba979acf6b43c09

SHA256
f590a628524a29ae7ae358832158be240e342a507edacb45618dfea135e1244c

SHA512
07d145f275fa3d65b5b4abb93b43aa9ecc3a11bf1a0cc6231daa98a3fc5a2da5bec7ee2adbc8e24b080ba6d7a5b8e12254ee67ab0a5f560cf63eca6e2132b0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
5e792a5aadc9eb0102281c65f291bc29

SHA1
d12b1f53ad660ae00a602fd24393cc8d77c5683a

SHA256
bbd384b3d6e836932afff4cb4ddb521ff2d2d9ea056f772b4e09915985d5ca18

SHA512
5e156c0c3fd7dfb6f0963ffec6756e67fd132803ad852c965a9c4930e9fb1a005cd9fd6e54156dd48735b60fb39d7ecc52ebea68ebce0df02cf5e5860e5771e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
a7b225ebc8a3450cf522f981f468cad3

SHA1
32bcd6684aaebc55aa53738281972b9b6f2cbbb3

SHA256
2ac8ef38ecac067aa1d2d50244aa4b98d1c4e54c67e10bbe56daa3f2be0b75a3

SHA512
3285fe7eb5246f0048dab0b7a9dc8d72cc85583e126488e7af2024762f58168d3a05642d837bc2b05fc9ca998ab2ba717a844d54acf565ea1ac4d81c99e604b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3ebaf380e05a38f3e35ed2f992163188

SHA1
89b0613f29c26ff757a6adb104cdaec8aac8f9d2

SHA256
c401d539d9ef39ef65c5f218fe9537ed22c87d1df239d5231a25f56e10159681

SHA512
88fba85dc2a108f36ff769c36fa1b1b40badaa3a61a81281ca0ae21879ee70101555fc306d1f486eb773a29cc0cad6f3caabeeeba09d84ed3faab39679c1da72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f898.TMP

Filesize
706B

MD5
e08c472fc4f69e7fa608a4f6e3ced025

SHA1
7954105a444eb3400ea82d71a02ef22af170c98d

SHA256
905154552123162b03c7fef52563909a33fe4bd222a1a5909598f1734568d27d

SHA512
4146ec32e55d9a1e618848fd712bad5ffda30201e226db0b69ae21183901589e1842b52da46026ea1f00f274cff7d454ad370d490ee6184ed3f31caef2bd9565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a3765b289d5debb7b8fa9b523e1f477f

SHA1
07b82d1c2fb234df02aae7bad573ff45c5e1fe18

SHA256
7a3df0aca85cc5549527add768320ccdfb7aa15066118022a21165ab75b724f7

SHA512
94b9af83fa182b1519f2fc44af0820962fc535195173998174c776fc300652884b6c8a7deba6556fe374053075cb2a62e36a1ea3e87e2561c7b0317bb15cb0d7

Download Submit