0899470498785249b609d660948e23d85bfc5d185a01414fd90eb68602b0b51d

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a9e698e1b703725d3784d690913ec8c_JaffaCakes118.html
Size

57KB
MD5

3a9e698e1b703725d3784d690913ec8c
SHA1

24f6159e0b27860331cd8625f51e8785f2001ed8
SHA256

0899470498785249b609d660948e23d85bfc5d185a01414fd90eb68602b0b51d
SHA512

67f09ab67e38836b96dcda64488674bf95336d2f8fdd1ceebea37bb0656e758fc1db0fad5f88f5b21bf036745ca339bf49b07a8eb21edd06e42e12c4ee74c1c2
SSDEEP

1536:9PY8b8VSeO3b2fwXNSWywXyaS6cgRrmr3RHNWje:deO3blNHXHgr3RHNWje

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
4352	msedge.exe
4352	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1408	4352	msedge.exe	83
PID 4352 wrote to memory of 1408	4352	msedge.exe	83
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 228	4352	msedge.exe	84
PID 4352 wrote to memory of 1956	4352	msedge.exe	85
PID 4352 wrote to memory of 1956	4352	msedge.exe	85
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86
PID 4352 wrote to memory of 3812	4352	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3a9e698e1b703725d3784d690913ec8c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad17946f8,0x7ffad1794708,0x7ffad1794718
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7461595341081745750,2865459466497085460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
23KB

MD5
a54c41cf7036861af3ae7a24f14b47c6

SHA1
6c19bbaa0f4c7926d269519602444ad93dbccdde

SHA256
6b700aef791f926a10ac46e8afad3515706e03db96d36c22dbb4a818f217e43a

SHA512
a1e49368cd6b0da73f78017332d0f472c1f344d466687b2f931e8b4eb99eb637ccb321c5e009cd6a8b920f788f3d58a713fe9a0578fd6ef79c8981bf7b5e8267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
56KB

MD5
9aea170ad0cd436d974afc1513f3b5c4

SHA1
f8232c587e63ed752260d2941a78a269c01c16a7

SHA256
13383bde9c3cca3b1b575c4fa92917d33fb77189c311169fd370aa8349536dff

SHA512
f426814d6a8986ec512d25de2de26d0c3c77c2c2f9e4773bba8830c75764460adc8924ce4bfd882b875fe64ab97a0d1c9bcf743cc7efc77bc9c3acf0a4bbf125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
43KB

MD5
66bc6bb65f6f81b7a22cb33c654a7340

SHA1
cb35c4c494dd014c64cd7f41b8a4230d796d8646

SHA256
aa920573cb213a875c378183424c3ee2c7bca0f028f1fe1afa9e9b0cbec3c479

SHA512
6d4dacbc87cf73a6d4eaa6feada1f2716d8effca75f7f7b8e73a7959e3a03f18b0f4a21b52d9f840e7bb1a21c03bf788d0b4893204be5c06f2763c9ec589562e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
a7d351ac048303e281bd72270f5b0a06

SHA1
8a0aeeeb57e97289a59a953c2fed69a6ecb040de

SHA256
2fa19d3048225933b687e1b6b25d07407968933f109b0d532e9cfcc1363d8acd

SHA512
eda7d22475f4b504b2f437eec1a64b7320b6516dcde99b125ebbb0f3f756e16553a010e0d3e60291c088a0ca5404a44a7b1a3b860ee8936f3c5fcdbb81f1d1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c6ada2795bc5d917ff8a16f879d8530f

SHA1
efb3604506e66f14b07148b6c11eafe0ace97d04

SHA256
7b6d326c440291db6f502e55c053d6e906b48b2d3ad0dab0345f777e6a9f07d1

SHA512
9bf87ce9123fde477fe4c771721a9f43d5aac0e27140dc12ab87cae10b973c18fe4eeb1b2f7e2ed8c8dab1794ed20fc13b538bee1c269e8fdb410b242b6371f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5dee9d2311c129b36303dfd438e704e4

SHA1
0cd92dd8a4f8ab9129cd90123a1b6fce57660f9f

SHA256
4f37fba32744683a1de5b9c48b3d39071ea0c1a95e5c456afe386e35135f8f06

SHA512
682b05b86cb8b779189ca959056806774a061a9ca69e5556fa82f1d472e86f6bc0c75b307899cd7dc77b9418d4e476970f9e69a11e2a4ba7a6ca1e1e176efada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f9a46ce94b5a4521fd90f6f6b9c815b1

SHA1
9392b318f9c644fdf0c80e536d668cce31d89ecf

SHA256
26ceadf08da0a1b6a8fa922c9daf83623ff993f0aa261f2430a0ac94d9661996

SHA512
78bc96d212c6815808cace2a07615909296944b0647c929e2aeedffa3025beaf5d61d8f15aafe3ff045d6d3d5fa30f25643a87e6409f899ea214fff1fb1542af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
bf26527466359a4beccdf00c71b71ed5

SHA1
097359702bba6163bd5fcbade2ec5dcea49bf7a3

SHA256
505259a2adccad615f22430f74c9edf89c8e0c8623780e2a555128376605b242

SHA512
b80495ee7b0b29dd0876d2beeec99e48f9783f4174b9da02d378bb4907c2a42fff6b11308869a7bc4225aa08bfd77078fa00abf7f06af07d90a85e6206e8b767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1f683a8ad7ffe43fbcb670fad10901f6

SHA1
64d05147cf3b78c9480a54025d955db3e264b8c9

SHA256
01623634f724d8c9938618919d1e1f267a0f178a013d9dea3d8e4ab1573c2b5e

SHA512
471aedda69c1d520d10b7dc963507457e8d0ce8b702f572c1b75564e1a7f694fcbe19e0e5a55c51bedbb51497d3b1e9da541bc8553f315b5d2b066343ccc221e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a7ebdfc31311aa56589cd2fda864d8ac

SHA1
d6a1e57fb9122287d61be8f9cc7bb96901fa7c71

SHA256
c84a73dd47aae788a2899fdaf29257066803c4e1816399b82f3204d258d19f3f

SHA512
d5ff078c31e5a2d70c103899246eb904e98b6562b74fb42a0fd09d939ab92852b03dcf5363c0f067f7b5c745f067dc3aedda1d0df768695644419bf665fa59ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc4958a6ba2cfe23edbfafea44e9dc24

SHA1
a3ceaca7453dfa5e5cd8e4f50492c0fc998cbfa7

SHA256
f88ae524a30d10e101ab65db9309d79ef971f843dff35636779606cfa503b24b

SHA512
0667d9c0de2471de9c002c742fa3151a64b9fd1277108fa680683d028707753dd68bc60103c1169ce4ecb24115586a6df7035c43e4bf2408a2ac3949928e2cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31dba11cfb2377625f2701691508621d

SHA1
dbb4635be484ebccfa498f27dd8f526bb3a34594

SHA256
012056757a8b9f789f72e49e3bf8f92fcfc9263e50de9fcd205123109db0c624

SHA512
d40f79e2b9d566b9ba0c628e20d221e701dc637b51ee6c74d88f93a55c2e88386a9516788dcc31a1d79ec23fe1f8427c3d9ba81b1a6b9e663081debf102a7378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
683014d4b619633ad31fb763dba8749e

SHA1
d8140269504a0fd9c4a2ce573adafcaad09ca4a9

SHA256
dd67fe7966a8dbc62e0b340c29ac554ac83e65b94bdc9b10a7b3421390291559

SHA512
f5f0202c705bdbe02e180aac9a29866a2a7ebf39c1b2f1e01cf53f6e4cdd646d93904cf1088aa2cbf64d185cec824020204c1bdaebbed4d6dbe3cabd36e6064d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d9a66131bbd12d4b46b7e1de2890b62

SHA1
cb343c9a90c02d6a80d5c5fcc6185a1b4e564bb3

SHA256
bbc010e48e7b6b9538b50da3b90acc2a703e176eebdda195ed05729cabc7bd4a

SHA512
ae52cb3b024cd6b90c2f89fb2b83db783dd705f8e9feaee4564206be0585ca516b03123b745995896adebe6d9d6fea4c79d293207bc488047d58a38e113f0ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71a5b4a2d5fc0148c4f223c59aa6f6db

SHA1
2149bcb010c8f6663cee60d072a1369c11358795

SHA256
27d7ec7267410f7e41ef5115dec17fdf1a413dd950d7cd8b87dac5f8f96c05f8

SHA512
49e912c4b98d1301a0dd46ad87fcb92c8ede9fc051004b3b93ad47eb46fd27ac46f6010b68543636e4b0e60566176fab6be5f1235be0d2a57f4370167e303033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7ef0e23f48ef737a87b1ccc96b4f24d

SHA1
01afa88c14d83fa8afd18e0b57fcf45340f7fa97

SHA256
d53013ffd9d96272c47375d0d2e2194cc6ad841fd02f2d45cc8430c3c0f704d3

SHA512
dc26957e5583ecd5d839ed89e7c0b3f82accbb2a4b9de4dfacd8d7e90f8e76a07ad2fd03bdcf12dace04baa76fd89ecbe632b5c6eff24dcaac62d88f92dbeddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
093223aa5a750ea24a881faaf19daaa3

SHA1
da9e64ecd53581545a512dbb7e23d5f5ea408a47

SHA256
ad360a6c87ed25234864849165a2a8e80ceb129fdb3343d7ebe6cf2ceb29a71e

SHA512
d2b6d2a715b729cfacf101a684d29401196a157db8ef7a0768b515a549d8390224d458341e3504959ca8ad4187d907743555e4cbe55e75fd64a7781f45e8bd6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
477611da0858ba525fb57f1af39d34c0

SHA1
7584ce8c37159cbf100943c2d336dc69a1ac2ca4

SHA256
e875c9aabd18a6d46046135809b65c8bdda94c29cae97efba37aa60b386ca50c

SHA512
211ca6985f70e5e94a8605257fb87154ace484eff7920745566b55000df51831760fd59a3ce8d2b7ceba3965b56a7a92807f9d7af5700cd37893adef7a5231c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
3b5c5899ebde9a6646b2f3ba3a39b772

SHA1
0c6cb5ab9f5df645839627e5a51730b89679acc2

SHA256
eac9afdcd8762c280a0053a10054be66d0e731996a8c3470e737562c5761a844

SHA512
55836821f88f04e8c0b85b3510368b740c51988c96cc3d663fea26cf3d1e578866633dc22c24d086a2a600eb56dc131b4f8dd4b434bff0a982a04a2c780ccd9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
a69c40c6995730223489cbfd8f090f7e

SHA1
9133696c0cd9520bc23d2677830138cf76e00466

SHA256
1f27791410593332330f7ce4efe7301df42480990a61e212165f40dee7ea7fe5

SHA512
273d7c87c82b62a28d94daf146e459285c7dcb123b06f9fb3421ad03e6d6129cf70eb7737fb2352fca92f8bb68a452e8b0db112d09d789318a4e0497dbd7a0fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584292.TMP

Filesize
203B

MD5
c63d7144e52a18e7fc615f7ac34967ab

SHA1
c1acdd98bb82291e134038512e5ec4a76f879859

SHA256
ab780e5468e5e5499fa3211cf9ca8c16699aa8eea9ed9af4183a23f30f4ea35b

SHA512
e1aba105618e085975dfdf0c745f64032fa4a6271e14be15837a2e12224b7908655f1f2957919f1ee33a09897019c34fc358ab3d8d673e3dc8194775edcbb5d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
45a8fe6f4d2a2ba54f24cfbe09503f96

SHA1
49da6a4e4a9ded76ab6742e48fc0c21bee2280d0

SHA256
ab9713f263b4141ee6a54af6b257b5a5b44d4480ff92da363fe428c163238dac

SHA512
b0791a3c70d6f6d0b8f3e3c91d67f74c2a21081c87805f396e1b346de3bc2ce2a3380787393a8d077c3a236acea5d7f1a5f4e5b4e19928a5caa318dcafc38be3

Download Submit