5d9db1e7b68e7777a67a3d21537c6f9f224a26aca7974ba88e18af4b1c3ecb01

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f592f1fa2020eda2ea417a24c866b3_JaffaCakes118.html
Size

52KB
MD5

85f592f1fa2020eda2ea417a24c866b3
SHA1

2497aa52c1a3da664de26f766f57d9688a4544ef
SHA256

5d9db1e7b68e7777a67a3d21537c6f9f224a26aca7974ba88e18af4b1c3ecb01
SHA512

253245bd3c073b37c1914f23fc701b79e77e7089e67ffc4fc67cdc2d14c4824ab8c67afd071e6ac7344cd25365ff8ffbaac199d8e2fc24bfdaa17e5d42a07f25
SSDEEP

1536:0wgr8VkeO3LUX8yfF9YsbdwaS6cgRrYbpQf:UeO3LUX8yfFfbd5ebpQf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
4884	identity_helper.exe
4884	identity_helper.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1896	1460	msedge.exe	82
PID 1460 wrote to memory of 1896	1460	msedge.exe	82
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 4488	1460	msedge.exe	83
PID 1460 wrote to memory of 3116	1460	msedge.exe	84
PID 1460 wrote to memory of 3116	1460	msedge.exe	84
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85
PID 1460 wrote to memory of 788	1460	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85f592f1fa2020eda2ea417a24c866b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc66746f8,0x7fffc6674708,0x7fffc6674718
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10334133000293320680,2466120874631641965,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d423798-bb5d-45e5-a8f1-c037ac370299.tmp

Filesize
6KB

MD5
f2621e40effe5d58c05270c1de598553

SHA1
f498fbfbfea9cc094f8c4645009dac352d3e7144

SHA256
6824f3a8d65d4b51394bda229232c8f53e7c48f9d7b37473f96eb5615870bcc5

SHA512
d843a1252d6e46836baf358ccf99b5e4fecf933599a4276cc8dd7aafffa72386f27bb08963adc226f41710ffacb0cc925387d8d05be5983fe0b617e6f543d757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
22KB

MD5
0ddef5c0161785e03ac4e8ee9a38a155

SHA1
272509d725636a8021286037dddfa8742835c2cc

SHA256
b7912cc8b9d1d5c3f276bd1cbb393ed6c8a633e5f74bdbb80a6139deeaa9d649

SHA512
9496e789c199555d7d723bc47dffbd592d24688516e0416cafa50c75069350e8bdde99306d2b83aa1478c3f79dadec5572bf7cafc49287f9ce1e360d895b5201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
35KB

MD5
0ac2fb54aaeac4d1aa480a674ebcfcf9

SHA1
f6ec501e37fa404d4fb1716fcd7c84f5bfeb86cc

SHA256
aafdda456f10e112fd67c617208d5f5b5a6571d31ea667712fcba49360bd2612

SHA512
a27a0b1a8798c76ac43e8682a2db40fb2fa1cbf4ba114ad6482fb8e9dcea20f2dbb9ba6f0f6714b9602624b5ac004b085467590ff72bb2b4b18b57e4f6462237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
cdc9f19a52e87121bdff5faad76470dc

SHA1
61786f32243b3384fb8bd1f460070465d32ad556

SHA256
fb5b531776f398b46eda13ed3ccddeece8fc54653f27b93fec45290a31cd840f

SHA512
d80755833280d63ee7c894510ba25d1ef4ec55757798126bb0a2880b9d0f90489c0d5f5765d90673ee7d6670931be05d38c42929b938aab3d6f643e5cfa0fa3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
24KB

MD5
af69928ce6f4cf2645fc42a64da48df7

SHA1
93199c873d4e802d50a066a5aa71931129c0895a

SHA256
3f0b130a8ea054a3a1d9869b6649bf5e2beff1766df443c38cd8e69276e7e748

SHA512
5d5fb5e85c91694f7d148fc74c09788f7507c88f25b562a60e28131377e483cf64e577ef32e2e1ea5059a95c31e4a027e9812d3cef729877fad10428ac1b98f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
e9a6cce8d0c7d40ef800103486632215

SHA1
e197161c49f3a50041f1ae70f5592688b8397667

SHA256
a419720a0b210ec141182c65d2943ac0c40d80f7fcc61f790764fa196b2cc38b

SHA512
fbb16eecbdf05d2afcfc2b38be9bf9539920ad01e2bc1c9a5297deb8b5e500d2206eb350a115cb94b0e4d03135c8ed65dc70da23cae45b3a334a5c299987bf31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
564be91cb7ef6cb7320d73790c21b568

SHA1
97c0c90fa1194cbbe5c17bff1dded992908df604

SHA256
6fbcee96ff03dda5c63564f0ffb9d19b21785809071ef8c06bc51f225daaeb6a

SHA512
fe6b743b8fbbefea37eebbfd28b8780dc02a7ef06fa41150b8ba3c74d74de615a0ea0c303f017b50af0b37470a962f7e4e7e9c84d6757fada831a2e841528483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
a6082beeddb08cea10530163e2de2a34

SHA1
bb63b90c4b8f725db5b0a2f2f5e03cc3039f3a5c

SHA256
3f57e34c0f39fd9254e3bf4f405b72c5c5d9bb17e4a1f43da84abac484f7b58f

SHA512
c2d67218f433aa66a6d38b8c44a8374c4016743e5a3657883944aaf2db36b4f3b54fae9ce4b9e745a3c130b29c03e3520116c4bfdc5318446f183d7ce5f3ed8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7c9eb263123bdab174a11d9ba1e70a4d

SHA1
3e867bdd3f50f0d67a13e2ed8b049e55e10d2180

SHA256
c60828622258ec38c9de542ce70e0333d802c5f1e949648c0424e7a3b7dd89c8

SHA512
0df7b3f9fb5655e44b2de547127ef2be3fb1c844f8363c713dc09aed2e05c2dfad3d085c7d9e01b1f671df55cfd65161d5b9e571b8861882d658d97167a1669f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
10294cbfffb150bf6fb048546f4cf5ff

SHA1
26c91282a4bbfb0879455c1154c1eb707566a01d

SHA256
8f55586656d390d4feeefc0a3de18148e4e7611dc4f0fe4ecfb81f076be0c059

SHA512
053d018e2f8d4416c2723436f2f36f80c89ba71cdd943478cbaf5f7e74aec897e1fc17ae9ad5b69189659f79b84bef571fd84042e1703095527c8172f560537d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a9f79c6c3d7d09bb1a9164d5191303b2

SHA1
70c2542d842001634443446c74c1077f712acf16

SHA256
e106d41831661a15fba6248cea8802f76c8f8b49a64939fc966edca7d7f6952e

SHA512
273f8dccb16b7c32c99942a1b2fb27cb6878c4c91bc3eac49f7efc886659acc4d99c83388ba854969a6e3b06ba813b247dc2d9c4fadd6efbd3f6456684e35ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11d5c2056b05068af4efba68a09fad3c

SHA1
3be5121b0a7f8a03d93407dbce93aac25b1c0708

SHA256
7267c525e219a1f80d48ae17bea8b8a6584bdff17c3c260193e7deb1b9a943b1

SHA512
3ea575520da342b4155c2e1adc7481329915d4602f908e8b15ef233cd7cdf9233617c6bf64df8e66611850a373ff594669e7b69405717ae8fe60970ba53527fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
258d4d68f23437031188ea2cfd8f8639

SHA1
527c16866207f542b32f404ee2646e7b45e6bf65

SHA256
82cf9c806f9007ab15949fe2930bfa9344aefc4d20caef2ac7caf4a920da2cbc

SHA512
b63fc5659a2cdf31e45e9345dee9cb340cd2aa526015c1c7d0a9a3e934aed1ddebcfa8fa3642b72c76e37bd1137f35e7a40f4a20c84516d6a1371f3feb9a891b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cf9f1123c70e97307366dd9b95ce032

SHA1
088924c951b2a84e427aa53bffa7f53ba91b026e

SHA256
2a97152ecf8ee061483aa5d8713022f4939f8200972e15e8ef414ddd33a4179d

SHA512
ad970939d19510608e9e7fc73a694eb90919891e33e10c2fda057ae15d3fc2245966b5d1d76b56d6837665855856ef0ca0f10bd09ec3841c0ae8961dfff528a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fa4d37e807929f6e825439fd93895b2

SHA1
8cc6da6ad59f0c38ec3692a8c71c265180aac472

SHA256
e4e4f6fa47d1677e332f7473fa4d714d4d1edb1ecc8a8e43a320847c9f062d0b

SHA512
b02bf8dc2e12a3bc45aab21e023794778af89ce4a15467237bca0f471c73cf073f57941bde9aef91a4afeda1fe91375ded2af7156182905970ea0e39ad07005d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a061381060e6110945ef1f965a82481c

SHA1
2e1e52753093bfec9dbfeaf2e084c649cc2b084c

SHA256
9a337b6635f891f1fc2c36046a84bf950cf671a20967cfa3cfa60687cafc6aa9

SHA512
bb8a110142054d001291982d6efe6656a2617659c37ace9fd74ad2dd3e441086d56fc9a53e4c25815c058a65227f8c641bffa52789ad937e0e7d22a9dd0cbc94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
171d5923abf653159ec2f852c75aa232

SHA1
97ac73d584f28aabab26e33c38c8576521be3651

SHA256
599c3cd1b2c59b651cacac4bc5b52c5216b270430779fefd2ae2cac425c2cd3d

SHA512
5b3b0046d8740227f88e05b87f6373a1d6dacc1281777e1cbcb278e66275bd05074ca5f45c655634111cac6118e7de58514ba0f322fc42bdf720efc56ce684d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e971deb25e4ab67e78491d25fca328fe

SHA1
6926aaa3e11fd794ad70112930d6c1cc84b42cd1

SHA256
421ed90ee8ba12c0ae716cfd8b7c29ca9319c6bef8608500d76368001a2fd8d6

SHA512
da223f1de5ee385623325ce6c832b00ca080689069e75eb6a00915beea0037fa56994c5b687c72ccd8847c279d897ac9d41ec320d1a8fb439b86b750c3868f89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583ee8.TMP

Filesize
371B

MD5
668d392dce4e88af4aeabbb620eba7f9

SHA1
a8aa3c3ac045151dd1678e4fb9f4b07b7c5ce3b2

SHA256
d7e3740b4313b51e269f75e2fd39a22fac9e25385f45475452f8efe46fb95c70

SHA512
8901364ddb53aa556b6d0cc9cdba9a567d111b1a7a062c8d39dc8d5d4b7ba1c668923f8ffbe5028bd916ff97d285c97d64806952c495e01b64ecf9c3207330aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a51c0fad729065c7d133eb7da9023a2b

SHA1
a57de9d229d65c1f0cddfa72ca8f604cecfacf19

SHA256
f948c2087d18aaee2c7a554e53fc389f2e5e5a19b248d86559819fc56d1dd425

SHA512
9828bfc49065b12ede73c4ff5f432c0e178870a4c99ede86f78b3fffd3ef1542d40dd77afeb189282d0b60ea3cb191ab2b91b174e644f212cf4f1a6c4c5d412d

Download Submit