53b92b174faeb2aacd95402ca6013c51ac27d7ddc78e9d907dddca5518f08918

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf9bd4d1bc7b6950227d094b85c39fe5_JaffaCakes118.html
Size

58KB
MD5

cf9bd4d1bc7b6950227d094b85c39fe5
SHA1

78250b57fab28b39b08198831772c5a1d466eb40
SHA256

53b92b174faeb2aacd95402ca6013c51ac27d7ddc78e9d907dddca5518f08918
SHA512

31577c482f6eebfb1f2f69a8b65998a584d977de26978748409688621ffe6ce650e5d77c8e60e41461236be68c63c43263796081dd7d75cc3f4cc8997fb17655
SSDEEP

1536:fY8b8VkeO3dELvvIyrURyld+zKaS6cgRrMlXI5c:3eO3ovvIyrYy6z/OlXSc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4824	msedge.exe
4824	msedge.exe
4084	identity_helper.exe
4084	identity_helper.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4232	4824	msedge.exe	83
PID 4824 wrote to memory of 4232	4824	msedge.exe	83
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 4528	4824	msedge.exe	85
PID 4824 wrote to memory of 4528	4824	msedge.exe	85
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86
PID 4824 wrote to memory of 4576	4824	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf9bd4d1bc7b6950227d094b85c39fe5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99ff246f8,0x7ff99ff24708,0x7ff99ff24718
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4096687621019562161,15836947588168331012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
23KB

MD5
d0007015af7e55b5874b6f7711e9ab67

SHA1
fd514e45401ab3c27d2fded42f34024260086150

SHA256
95c98d45b7481d60c8078e04973ca86a67833927fac958ed6d8c28593454aef3

SHA512
375ea404a1c847f5b5e10803277d6a54fcf22ffdde3f41a06efbf4732858d749488b7ac67ffd9461a3d0b7bfd8f18ad465946cd4123c54383a410db6e699a6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
163KB

MD5
8d081b6e9d6934eb63adde3355f9a8b3

SHA1
193e6e9e3feb35f854e201f99e1c9de2a2435554

SHA256
4d357846b85b33441b4ba2409f7affa2212ae546890a8b42f8a8baee386a54b5

SHA512
4eaea391db80a0ecb0bd9ba7d94130d546e6e086f6dcf99e6849854b222b82052c54356a87b43b284ab36b3da46c2fed42ce5d798d4f86d234f592bc75c55ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
43KB

MD5
66bc6bb65f6f81b7a22cb33c654a7340

SHA1
cb35c4c494dd014c64cd7f41b8a4230d796d8646

SHA256
aa920573cb213a875c378183424c3ee2c7bca0f028f1fe1afa9e9b0cbec3c479

SHA512
6d4dacbc87cf73a6d4eaa6feada1f2716d8effca75f7f7b8e73a7959e3a03f18b0f4a21b52d9f840e7bb1a21c03bf788d0b4893204be5c06f2763c9ec589562e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7503562514ad0bf93d09431685ac7fd6

SHA1
6d6e7fd61f305c1fb72d1a3e8b98f32addb59638

SHA256
ec9be52d12047b5c65d69ac9303fd1c99aee819a2a1d56688f4088f998dba158

SHA512
7c7615c1498e3a653f127f782fb8fb293ad59f2e68fac709c898a7d4db51f40de831e48c9c0c5cec8aeb739302b310eee2622c57d7cf5501d9ec72b42f8ac34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4c1beb82242fa0de5d57bc3ef47af815

SHA1
1a9345abec20c0c2c49eef3c3fb55b2dde4f8074

SHA256
49e76f0b48fe3ff46dd7673e10b4aef6948923c1aeef9f9eb47a3281b09483b0

SHA512
e9f3cf896af51cdf0335d661a5fbcdd8e86d47a85b8afa138c65cbf581670c9307c97dd164adf1a4a6506e487e37df06d084f6b4dbf21a5738c7a2dd02835187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
0381bcf8a2b1f25d8b21a67073cd6b34

SHA1
5c72b3f373855ef3bbfff6a6a85ab0b35345d887

SHA256
2f1fe5192cfa777868d6ca893aaf77677db36ba24f45af50a12aa382f077e5b8

SHA512
528ec8e59b836d5dd21da6606aff4f740805d9982f9e555856aaaadf40843a389b80d9632e095a47342f3166633cd314af7c6807715da599f32500544be0bfe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d319c717c2dba88dbca3b9faa8ccbd80

SHA1
e46b8158480e89073fe2ac1674905a17b13416da

SHA256
7b07d0d87cd248581f0c4d015b7b9077fc5be764919f276e382fcd1cc265c55c

SHA512
dacae29de09ea53a3aab422409ae689348b343de70433777d410f5ff037d9fade7452fe7fd19923ea3e9a4836a22876ff5da0ed287cd79b4498aa476f516f56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f40bec7836e89a18a1af1b252ff15974

SHA1
ef3e23a51faf21cf7126768d65d3219bc7ccee5a

SHA256
d096442163fcb3bc68a089a8a8369173ad37c76663e1610c0d4e12e2fea5d952

SHA512
228745c99a506d5933f21ab978b1d34a7e5d63c7bdac15fa252c7ee5e491b9ef789b2b99e95e0b435b8ea2bd2c5b89b50fb5555a7db8f4412d699d35efb9ba53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7ee94ce29927869fc79e61b3cf1f47fc

SHA1
c40076ed605225e7db0c12e80e5296563adffead

SHA256
bd17b35e7fb0894df932315117f1d9c24e297db2dc77559fe675aeed02637c2a

SHA512
bdce99f4bd40d6d3faaae59e10c15259b7d83a7473c4e79e27f2bfb1af13a691750899401eb6d67fcaae79faacd87fa3d6d47721580b8ac9bcd59c0445400ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e3f6739672102caed786119f55c411bb

SHA1
335595c96f6f291de34538cc12695cf562f956e2

SHA256
e74ce4dd450b045731d7fc588ea07c036aa44159d4dbb816ae0316e199e11280

SHA512
928407fa710c16c87176a33ac22653f32b3f61e538e422aef8ca59a9be064e4f81c141611064b6ba5608c05edfa10516dacba2ddda4f65bb3e0893174c708f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
246ecedd02c9fdf73f99f3bc615afcc3

SHA1
d2e1772b9c02e7e87c04bbeed34fc6eff5fe018c

SHA256
a6b998f487f354044f3ad0aa31dd2cff55a3ba2f8f9b965f7f1c09813281d5cf

SHA512
15202323c9edb31715c63cc7ad281641a09f0ff49cef9e25c3ae784ab003e7b178ef2ffe5d81b31b43099a1cc3fc66214739f0845e43ada524902e6861714f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1571b01a6872eac3da291b3827488478

SHA1
87b17878e7ef9c3f654e89f25e21c2f4d0feec0f

SHA256
188f1dd1a1677f2fb0e16a39ea284869abf6b4cf53c4163dcdef5d926ba4474c

SHA512
0cd290fdae04dd8241c5ca2aaca43422590630ecff0d3cdb59d2fe966afd5006aea1e829058a0762d3cc7e72f37e6685eda4dfed5b3cc382c5ce323bdb7b24ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b7dfda06c69a6a521700a74cefaa40c

SHA1
3dbeb7e0f9d9a496c475d10609d87d44e31f126e

SHA256
160dd5ab30b034a560936963d626cc99c603078b55f1e014947fd43281b4ff13

SHA512
625af7c8566b5fc8acf8c32db91171cadf98e567ca42219646510daf9e58dff0d2613a3394b1b88145d4190e03517798377f105a1e2a28daf38b2fa8410d0433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99d88bf8a01f2ba4b1544a595459e9e6

SHA1
ce2078e5c651d66a1dc6a017584d0ed6740bff57

SHA256
0ea170fd900aaebb5330efce2798a8dcf9dcd300cd45d8445b8ee1cf9bc2a51f

SHA512
4da7fe46d3103b73e0617894e30d9ffafd3192c655c3d503e5a2e0b4c346322a61c0aa9f2cfdec7b6e10cb661b046fa0168b1b5b6697471f9abb276b5da4fe90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dbbe7275fa5544498044f737f210609

SHA1
90e070ae9e34225eeab548dc1cdc04ac1109662f

SHA256
3f18914d71c80a7b154fdf123ea64b0cdce20c8d44b9cd0f1b014725579a26b7

SHA512
7770e7cd414bb8869b43ce7ce3e2e65e52ec402b4e53408de102fcdcb19034c100893eecb4ec3f9f1c1f95bc2ae08a2c627b661d44e53b22986af3d9354f6de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57ac8286e821e90d8c19f04adf45acb6

SHA1
34e7da1721b2bbb96238353c1e8aa45b98fd191b

SHA256
ea26060bef7352a178cba516c2556c86cf41504998eb519c7acfc49acc718ba7

SHA512
514bed6b80d6b06c7a603f02659d47f0b136c83edddb21f3c62749c3187c9c9173fcbeff035d2e0e3d480deb1fceba87d1db981f98e485be4e871c35e7de82a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
59cf30d1ed2f761de0e2ee3b374899d2

SHA1
3196d73d393cd75ed59cfa6d181052602a28f94d

SHA256
19f3008b046c229f4ed8985df5b30b97b162f6e3f61c8a1739d76478bcf19ac6

SHA512
32f6115e1082e7a8ba6c6a6c39535b2ee5380f0429a3bd2a34351fcde8752fbe14b795d357a4af10df14d44032dad508b2579145fd1a78a74263a72edcf603ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
845863e2de4a95ac70b18da7eb5c1831

SHA1
4ddbbbe961658ae9cee7c79e6a45c517724fd784

SHA256
91d924e5cf5e7bdea14e4aea3e617dd085278a1518557c07289b8a80c7968fc7

SHA512
20d6b9a789efc53de99be16ecee4796f4746338b7aae650a9423db2987430924cdca64112dcadb059af54ec0f8c55e929961f62e26aedcbc8c3e9f5b318b8260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3a8aa6f1d5c46081d583cfe54f09f51c

SHA1
5416f717f5386ab019580060464ce6e82a8ef1f1

SHA256
1264a245bee702229addf57744b5d49464cdf2d50d1c03b520d10182e6bd394a

SHA512
9c103030601b63e1900231836eed6350d2cbf576b036cf101575e5a51386b4d59c89aa492066d882fbf692abe8cbee1c0ea8966c25ab4889f84b47fd01a82ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1f9e165b5a2f50c8d8239d73bd83c12c

SHA1
2717aeb3e0226699f5705b1933bc656ae586d2ba

SHA256
86e57e2a35ccf57d606da0981114b7f77eea1045e9830d898f46da199e618788

SHA512
1e760ca8a6835494477d1e631654b932733b0de0dcfbaf49acc17b24ea0c173f36d639e52cf44f3cf29776a712aabb5871e8f8e789e1fa6cf520d2abb653d7be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5829da.TMP

Filesize
371B

MD5
d596ad70cb1e1ae42919a6ddfb889d14

SHA1
85f7492b682e463a9a2007b400a7d9bc729756e6

SHA256
de8434a81ac348e46654ee5ac6e42dde225398c8bb3baa69dec435b3387f3ef7

SHA512
747c04595961ebd8b1967fe67809fd8ae46d2769117eae9b5449ba266a688012ba3b36d68cfb7f2a10453d80a6661df825da2d17f7fc2ea4e9d76dcf8e62d02d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20f75818ea12127b8397d576a4e7b644

SHA1
b5f8b6fd522a638ba1226407d266017091f007f2

SHA256
84ee0d88deec9dbdabc05fd60662e65115869bd90d3cb3597857782f92730fd0

SHA512
19ef5c261ed1244c3107b34ccdb4a9df06305c26765c4e0d2f4537fd2a040762f524f7999fc076741bc28025e58f1a7ad19bc94b832e3b2ce025fbb9620d12a6

Download Submit