9ef5e9a71832089476f9ed1aecf144a425afd30a78dd17d65082b14160a032fa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d9da2e5a7ec124ee9ffe8a998a54725_JaffaCakes118.html
Size

131KB
MD5

6d9da2e5a7ec124ee9ffe8a998a54725
SHA1

051b97a96dfec14b72a9df6b119814463d9f6f0e
SHA256

9ef5e9a71832089476f9ed1aecf144a425afd30a78dd17d65082b14160a032fa
SHA512

95e1107369d58650ed7ffb6bb282cd06acaa0bf4e22332dce99d5fccf4cd4b6b08b0adff476ea9078b6a504cda3aa619b52049d987cbbb8bdcc6236163dd4117
SSDEEP

1536:IY8b8VkeO3fON/tsqyojOc4/rMLaMlXbeTraS6cgRratZ1b6W:QeO3fON/tsqyoSc4/rMLaM5ASEtZb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
4252	msedge.exe
4252	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4736	4252	msedge.exe	82
PID 4252 wrote to memory of 4736	4252	msedge.exe	82
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 3720	4252	msedge.exe	83
PID 4252 wrote to memory of 2840	4252	msedge.exe	84
PID 4252 wrote to memory of 2840	4252	msedge.exe	84
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85
PID 4252 wrote to memory of 3220	4252	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6d9da2e5a7ec124ee9ffe8a998a54725_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9cb046f8,0x7fff9cb04708,0x7fff9cb04718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8489500912014995027,15241297843784694084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
9be780bc06907ecbdf0320d88e6da1d7

SHA1
5af34c97da84ba9319b4b8d6e63352eb9299bead

SHA256
bf111ba484d1fe1d7ebd0f2c1e3e61a844008abb17383c81610efa5f6ceccc3a

SHA512
ffa99bc96551ce59af822011cea136142aba10ea600760012ecc3bc5391dbdd3269e365770f4650e9de12fae39cad2a6f11d2e70a8c3c73ef17cdd93b2fb1822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
54KB

MD5
3d43ad52a5e97214b6780973a555d0c1

SHA1
ac5dcc5dbafe9781453c87ee892c8769cff3df25

SHA256
2760b7d22f5936561faebf3afcec848f31faab71bf5c95243e36908178d33342

SHA512
e117dfd48a35fd897b052e4623449bceaef0b9d9742ebd078b36d6029743598e1a91c81c0f984f0b3e2b81ba02bd6613c78db6f477ee202374ef94bacf48b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
e4bedefe2836b39d626053935cf2f803

SHA1
105fc75ff4d76c2ae06e422f6304dc9b1552389d

SHA256
758015e3cb56989df5cfcf912d2c3861a62e623d386ef12d4bacf15891a4eb81

SHA512
041aa8392fd5bc2922301312c4cd315b9af15bcb5502ac8467cf13e9d4e76e726f0822b50392d3fcdfcd0f37a119cc8afbe26e75130c36ddadb102d1595a0cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
58KB

MD5
6f0126f86afced26c1701e0ca4a9a2e1

SHA1
47b2969b8b9fdf8b6f56989e45b700816677754f

SHA256
52d7edce7ad52f5e8cc1ff7e24460a03f14d2960c41f3a643833535fd03c25fe

SHA512
8c767c0d16bde9bb474fcc8681db081ade207a846eee79d791b703210751e715c94b8c332a34034b6d6ba69e4b7de516b986318cf24d21e925db1d1a2032f004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
43KB

MD5
66bc6bb65f6f81b7a22cb33c654a7340

SHA1
cb35c4c494dd014c64cd7f41b8a4230d796d8646

SHA256
aa920573cb213a875c378183424c3ee2c7bca0f028f1fe1afa9e9b0cbec3c479

SHA512
6d4dacbc87cf73a6d4eaa6feada1f2716d8effca75f7f7b8e73a7959e3a03f18b0f4a21b52d9f840e7bb1a21c03bf788d0b4893204be5c06f2763c9ec589562e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
244bdfce32114cd9d0eb1c71adf4ade7

SHA1
d1ef7729b912f3fcf751dcdae0988f63978d8d65

SHA256
2076657c35af672405ddabb98323b73a6847a3150cdc74cb07a681a97ef94eea

SHA512
8029e32786123457d57f8f7f5f855ce67005cb2c547da88c5bb5b0d9a866c3e1d03892337bdfee9af7b5488189b9207a920122ecd2a03f6dba0a3333de3cf6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a44f462b061a6dcd9b9879bde22366bb

SHA1
319a66092977115f91ac78463e5775ad6b71d698

SHA256
18134005b7a04d618b65858e7b3061002cb5b5d1061d0ee66261a47921257d89

SHA512
385660622b17f804853bc6c0c4e60df04c0bff2aaac0ef20e9d5d05d49053c589a4ff77617441e6eb2aa1ad8b03941ebcba0fc45befbc52a92b15ce19e6e5d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9723e24c3f80b66cd0376bdfe84e1d46

SHA1
b2977fe5fff0cffb3d2d2d35bc78bed37df34686

SHA256
5f7619c0549f14464ea404a58298ad9dd1910c286be6bcee759d08b491781c06

SHA512
221e1ddd2bc65712122770a4a69b40fdc73b3669f21867c6db7194ac3a452952adb88a7c5df0fddcc58840dd60cf718ce03a3dcf642ecc08deb8c717e42feae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ba3e1a775f102416ed333eabfeb693a5

SHA1
308a67bffa96be4ca6293fca51968bd8712061ab

SHA256
0f13bf71d624d60524daa85b2d33b09b13ced01afe18c017bfd0fa5becd898dc

SHA512
c92af385a796afa0a40e36fa39416261782f98545d76685cda456b342fa97ecfec91bcd903e87488908a87ac5afd097aab173c0498f652af91f2c44e1a3a6ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ae12a8fd584e402b1f2b3df1f921b27f

SHA1
2af0a055f055e61b23625cb116307d4361cce5c1

SHA256
122f7baa8c3ed26f1c57d7954d5c950783ea73808c8fbceb58cf6d5e5e38cc8a

SHA512
91df8f6c648b873d922cc7b3668250bf1f8c4de1f825096bd7a62290ecc3084de22261a2c1e35b58c5cf167aa939aa773597450f850cf1b3c373744f605cb167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f3126e7c41bbc2229cbbf80be9876508

SHA1
bb156bbc7b0ea05642ba406cf69766f8863c3355

SHA256
bd0e21d0c301782b607c94673dd4d97413a5344a740bb4fe81dafdc0a0d9bac8

SHA512
35ec05561ae185f3fa4ebdac1e91b7e6041b95c5ce115d5cbe08921e7805a964ef896fabef6ebb940535af26dea538078338c94a60d8cd8947c63671e21a3aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
949938146b91f93df5c7b101d0a3a8af

SHA1
75c238a1e17efcb5e55c12de9601111ff648cc16

SHA256
5078e13929f5d563c2fcd15d159f5dcab770d77c7e94ef166785f3f02e28c4ed

SHA512
b4bbf8facbbbbbb5fc01887c0e67c0195d659850e672482e76f979d4122b552ea2d7b3fd9e690cf9aaf7ea3214bcab1f019b28db9d6f502efa87b15bca8be510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a2d1a3e67948168075cc9219d2c449a

SHA1
4607f99e99d20fe2a1beccfb2c9d44379310e06d

SHA256
d0eb383e78ef503a00afe9d8ea659f51056d9cb0be8cd1a3ab846517680aa9ab

SHA512
518ffb5174d31fd54ba508e592893ac671844167cf14b68af6c1b815a968f4ee9dc42cbc7a757541942b5a579059a86bf2187f059868ec286894076fe646e897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b8df0e3406141d912a5461d914ff1e6

SHA1
268209c582ee0b283041b4691beded296f5d0473

SHA256
f6146a8e911cb7574c3a0d0cf4c75ad1efe343d508bc1db48295ab0d1fc7052d

SHA512
0b77fdd28f693a195aad5bca8d84566b144c3aefe893b8b2f66271d0945ef5b69dec20a1a6376b780524e4f9a5b1652cae177bdeac7b55a083810df72e04502f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
47cbd140b90a8a4b56e953e3edc9af9a

SHA1
170ad51301bf5780c996a664fc2ec38fe0077bae

SHA256
a0963fe6d9534d14f795f4b3b8fcf7dc6d29435be6ca2fff3a9e613221abdd73

SHA512
3a985972380a52c11afd1375c10d2c89147ae189cc3f18f238bd0fafb8bd410a4171b1558a55b34c49d653720f20062c5e19ec70c26f87fbfed9cbb3e53d3446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65f1d14ee1bf819f1ebadd6c8526b1b8

SHA1
52e42143012e6ae4392e00f39aa5714a7b273c16

SHA256
5b1cbb806b4cce1a79eac617eb0eaa9d4c710b95e868c1ed1086fc1f747a094c

SHA512
f8a6a0d46afcb3e5aefef66c48505cf27c1bb1e6a4c232dec51ad72ab2801017faff214c5da0026456323f3d6f6a98f5ffb4190d68eda44fce9d9df012c8044e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4245a3d84a64df22a3cc3ca4458ef095

SHA1
1f50e60b9f35c59b10f778346c2b5f9ee655482a

SHA256
d59f9c515c86e9e7936c05954d83d952f5bf7e9b06cce7981e04bdd51c774a8e

SHA512
165cf721d864ca0211be9c9c2f48321488829d3fe09b2302b1ad61f93645ad22a8924b6306c17d1c2c74f3bc05143357264c9cc1741a96df2eb7037ea5228d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a209bc3345c8ed43f5400c169972720

SHA1
b49d575f8b7eca007274d57ab8f65c00777ac861

SHA256
66323b25b2c1de9c378f56c599c0db214af3f1ae7d4593f54cc41504a8e8d347

SHA512
ad2ed4460a13777b4fb7ddd543e72dd39984d9c9cc1328767b90a94bd3e5e5e2a3f0ed105043cd277836a8fec0c8fcb4dd94699d039afd57e350c47b64893737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
420e30d653bfe3f5656d5e0d680eafff

SHA1
0efbe7db727d733ed676910be5efcf247cc09f44

SHA256
2bce1ab1d0f6aed902178f11f612d86d6cfa91e3d6097b31649e27ba29c7eca2

SHA512
0faa66410ab8d0c6d684a126f1aef83f9f0dbb26e9a29a1a40a795770fa35328b99a4536174229eb3cbf647b776417fe2fe40399d907b47a78fa2ddb05a89609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
b6c2c4ffcd874fbdddb78e488713c42d

SHA1
5ba0b37f433cb18be2e16cf81b12f133476f7bf8

SHA256
b20efa8b4f51c64a8f265f8cdb14f1c13e84719a1159b02471058a9c6b43e7cb

SHA512
4849d8d03ec3d2b8d7cd4a1e78a6acdd69d8963e45b00b8ad5f7da93b9c02737da6f9aab0e23a01bca40e2235c58e68049c53a3e02e31d56026d9fc36068f6c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2130f93ff9cf11bff2ab473e25024631

SHA1
585e5c2da96372634d6b034e44cf870ed43371be

SHA256
e83fd5ac496a993a235818181818f8ff781c73c0813994e9f9518e5f5fff7cfe

SHA512
135485714189abbd6076227074c127beb4c0cd03956a2494e00ea2478a390824e50726f30d06494dbeda4cc72461abdc6f7409cc03b8dc818ab77ee2b0fb2648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
3a8c6042f924d4f9e1be847d07875e41

SHA1
f3412da392a8a4e973189b784d309db9e53c4ccb

SHA256
80f219318e7dc606cc0916fc44dd749dd578df7a175336b9238b71d33e270496

SHA512
b8e1aba1e559e520f2d326558746f347669bd85fef21271ee87dcb399b7cb0fb0239b045a54c99d0096094edf5c693cb437af72fec3841a312ccdc2422590f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581057.TMP

Filesize
706B

MD5
0903a55a209eb8ca19279abacccfca12

SHA1
b9ce3d54f2681de8d3e30b58c9cfb7e4ba00fe85

SHA256
d2d50e659f10717d33a0f16fdc8ede9df08732e8b241a00b1fac344ca45c15b5

SHA512
08613459c58e9d7e8a0efa08ef674d5ee20e3a9bf502fc1fcdef869c88dadfca45470d5cea760838b4fc948322bd764676e9e71bdbe880d7f39adf8b50b8797b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc9efd8f69df22128881b701b2ad1172

SHA1
c05edb52ef0a1ad3926aa40deca5fb696764a2de

SHA256
4fae9dcffc03fbb38b992705bfb0c52516b85ff229a4c46c90771f847b8c388f

SHA512
a6bd32268ec1f305db44010d535d0445db12139d1780bf1c1edd6f8212a6d1c864f4a7e0b1e1a052ae00801688811294f14547a7ed92cc04cb7f85722808ac36

Download Submit