b5b9dbea70066d4e2e565b26a7bfaa38521f15e17bc4ad99428d24e3fd05b60d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e97791bff52aca2090b79c385c91e96a_JaffaCakes118.html
Size

93KB
MD5

e97791bff52aca2090b79c385c91e96a
SHA1

8b9dd3c883da30f6aa04dbd61e7d1481bf6ba9cb
SHA256

b5b9dbea70066d4e2e565b26a7bfaa38521f15e17bc4ad99428d24e3fd05b60d
SHA512

a256272d07e904771098c0b14150a90a08eb722d8e07ce6f8e6fd7e6981e9e537b728dd2b7622926d2393811d08986aa0e82a0a4b40ad9cf9b606263aa856f3e
SSDEEP

1536:hwgr8VkeO38eWrGsPySpIhSW06hIpu1MUOKaS6cgRrmRB1F:NeO38eWrGmySpIhS6hIYMUO/gRB1F

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
5080	msedge.exe
5080	msedge.exe
4360	identity_helper.exe
4360	identity_helper.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2040	5080	msedge.exe	83
PID 5080 wrote to memory of 2040	5080	msedge.exe	83
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1012	5080	msedge.exe	84
PID 5080 wrote to memory of 1916	5080	msedge.exe	85
PID 5080 wrote to memory of 1916	5080	msedge.exe	85
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86
PID 5080 wrote to memory of 4064	5080	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e97791bff52aca2090b79c385c91e96a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6d9d46f8,0x7ffb6d9d4708,0x7ffb6d9d4718
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15062201595357785065,9094805672348121969,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
232KB

MD5
e436a692a06f26c45eca6061e44095ea

SHA1
f9a30c981cb03c5bfa2ecad82bd2e450e8b9491b

SHA256
7846b5904b602bd64bea1eb4557c03b09dabc580b07f18b8d1567d1345f0a040

SHA512
1b09a98336cbc0c8ff0f535a457a3db3cd3902e4a724bb2e56563648ed1a36201dd84e63f45dcea80bb6edfe80a17db388379417386dec76341fb9eadbafa88c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
23KB

MD5
1ff53dae34c4555156d935d6455b5e8e

SHA1
7b0d480ae156810635d33de2750d7de405c41c62

SHA256
b60890e621ee1f1885e164572c092e6dfcaca3d7c7e2b6cbf65b5acbfeb6a998

SHA512
103de10e245e4eeddd8611d30f62a74b16b364b5aa90c866c1d239649363e42cce013d83520b7e3fe2c17ca709421168f78736477e124dfa841dc021f512bd1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
34KB

MD5
31f1d1fed0b3abe98954e93a71b31177

SHA1
3477be6543740f61b614f2600b4b8e7ddf682759

SHA256
5321d67954e08afea1d0627fd496a70f9247a4cc38e535a6f39ed61ea1222722

SHA512
51ffbacf39b4dceeeba6af340f7202e273c5d39eaea0fe5b1ccf6f762361ae4653ef24ee9abd86c52061201f9aa35f62086b70e4a0646412766c8a0066c5e9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
e13028e8de4e6e259ebef451b72b1cde

SHA1
96e0eef6576741cca6f1b3e4cf1c025d1a0f202f

SHA256
2a8efd9c1eae87e0dd1e352c34ec8ccc6e29f1f57babe29faf7ac0d5a2bb5181

SHA512
d915ec0d5f76b3f172f0d63ed05cece6dd6757c33e30419bd23ce3d218e506b3b4b6899e7648ec694354aa3170d147d4eddb8fef2e7cb5eb61ce340266219ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
154KB

MD5
1794e209c784b5f1d14e6b9b3dd42fdd

SHA1
1c41e8364a39722c8c3accf6514af18534a0e883

SHA256
3306123926341119d694833ebf674b28191c67910f2835f7430dd9527a89143e

SHA512
78d17b622edb2ce77f6fa1fcc9ebb89465693a353ea97facccba6317c39d714468cb7d1970f47b67bffb0c923eb9b40dc3b741991d1d216eadeb979a199c3f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
45KB

MD5
597e857c3cfc7ba0efe51510471ca91c

SHA1
91302a57a65431d4d6fe1fb4a263fa7b65c63647

SHA256
aa52f9f9a3539eddb9fed1db88677f99759809a50dba6402198c2ea33819df2e

SHA512
f7d659f2404081fcb0afa35eca836a68626f6de6fde7eb09e9c870b17576fb5ac0f125c049efbc057fd4beb09cd02580d97d8b31b77461ee0d8aca8902acee44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
37KB

MD5
96e565978b48cceb007f46cdbb994e39

SHA1
038b12e2de6f9e5b881ab0858516b55261d6709c

SHA256
aeac669e85d2b6c4ea81abc77abaf8998d729dadc52f0b24249cff93633369b6

SHA512
2c7799835744e27ec674305633792136b65d8110201d33ad615c2cee428716389d1c3be42af2c025df56c800b067451e30842243394b5705698608d6ca3c17de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
34KB

MD5
c8094a17489d29cb62d7daffee6ab51c

SHA1
3a7d4994cab79467c5033c7f68e7deafa3a0c2b6

SHA256
03454147a0b1ee6b8e22e4ebd8b959fee69ce952345457f890888cb16d1a73c3

SHA512
8f8701f452acea1ae4733acaafd8b7d93bffc3e0eecc1202af0d22b4cde5e267300c84515723cab73ccca925bd974c8bd231e5fce0ea71b43046a1755a478ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
21KB

MD5
dbcf4268ec42cbe884ca4bab324b091a

SHA1
0e941420f0d73f6ab074db314d77aa5e10bfc506

SHA256
0f5370103601457f613114ebf9ecaf76e1b6ccd430b628822a808deeaab40cee

SHA512
8a160540abe6c4ce2a3abedf82a53ee6f8987f466316ede1eacb8d96cf266352fe5a17f65218d9f8f37e4d5e7e644ece3d3a32fffe7a693d10ef5e05e4361464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
21KB

MD5
fc468e37b80d7a60a9e14425cbf99111

SHA1
bbb705db9c80485db05ef8a0f76de86b9097b4ec

SHA256
8d8309d8f708e1f671e9ee14bca05e4fd52c25e7148135d0f3f7fb278b6d0d65

SHA512
26c023a0c189bf0c2e4f89db0cb99e2e627d1258f09eda4cecd2cc5a9342554e3cc0ead6dad8cc1f2210c5e3aaea95db29e828c8de52b1ed81c716e739ee7dd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
31KB

MD5
074b647f3e3683a8fde4e5afffe32c60

SHA1
c174cfa8d151d505c1affcff3902ec6179001c63

SHA256
c2a04e02e7ee5141866a16503bace664b40b846b7fbef3f0121c3b6c97f05428

SHA512
f8a1c4dcad88b37622b0416c6150b06ec4e5fcb41849d6261af5552d1932877c5055bc3834cf17e63f04b4f5453836e742e314110efd1d47f2b1deff32cf77b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
75KB

MD5
c1165ab37fdb40d889a5b061de2cd8bc

SHA1
6d032003254f83ec24242bda01d058b831a4da62

SHA256
ac915e8363b0dea39ec3cbeaca5f79c5543ef518841a85b0d1cd1756b88a2670

SHA512
0571ba15c38259a1f012a51b859ec366851c937c3c30bb44e0f08baf393cf87fbd07d57ddd9d0a45f725691eb7b7a54030811be01e666a229551be3aac340daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
17KB

MD5
9a7dd9a35901af572b85bc2285c31570

SHA1
dbcecdc6e62bb59b67d353fbbe581b80fa73f996

SHA256
11f3acc6794c6a6ca750e20311a1bd3ba577403a8e4da9f3c126a37979611d33

SHA512
ce51affa26857732cd3396b080828f0b72135c08f3292f81bcd97f2969ec2c1c1914f59dc0389a8aa71189b174be97d7562fb5e4bccd9be72b96efeba63453d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
95KB

MD5
55f9638da2667f3ec837b1003856d5ac

SHA1
10693675e88f3d6f9b23384ec5823b438f6a4669

SHA256
fee0a71c11e473d9a0571d15b033e7738db7c6ea14688677e670800c16e7eac3

SHA512
dc6752bb60bb049f2707ce1c287a9bcb47987b19abe614b0553cb23cf7c52be49cef40347202dfef30ace66de0b8d95a211bbb690461019d34df38ea07869a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
32KB

MD5
0192ed367467fe7293cb47794a339b71

SHA1
95edeb67c95b036ee3e18272cbd0b9eeb5e30f13

SHA256
7f29573f91e4ab9a4dd83a20a9751930fc827410ffa0865eda610141b6e34716

SHA512
1ea83ee50325d4c5c348e0cd3dd3a64efe4b26cec999ce42a9dfbc625e1061badfebdcebd6784e536ebdeb0641ae8907a87dfa36c46ead7b4476e67ebc59798c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
117KB

MD5
236f80e0e354b5712b62abedbb440338

SHA1
081a7fe8060e5b216856b7a76778018937b89ce8

SHA256
1519dcf66285b2ab49173d8147e127f2cbd289e3a5575fbf61ff6d69302eac78

SHA512
2b052bd5838aba7ff16b7288b40a007104b969117fc60a15afb258590c0cae10c3c6ce74c8f57ef8de5a0bbd9b6f5a2d624a77954a85848c669bc8d233ac4e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
20KB

MD5
e6538552f12832119e51a654d11d6195

SHA1
64ca67029c032f9582a71b21861906a5d84646ca

SHA256
27c7d5b3c5e38aea4b3ac4fe1d21a174ae7301d016b280cf61887819eb09a011

SHA512
6c678b62096f4764b330c9440a3890b13a835fa1a73b552d48ee1a08958bf179a687a15ad7b430b094fd01b0a97ad5b27b3d0d26e0af99507943461eccb7610e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
70c30420103af17203aa55ff3c5a4528

SHA1
3c8264c8cca29a26efc25b3b32193b5c87dfd91f

SHA256
4d9f7b8c5278bcf59e7ba80fe8e138c84c8cc39a3eb5e338db297a47bd2812e3

SHA512
0ef866f7d24ffcce40d699ae1d974001053345519995802189751afe47ca3bd9f9a0a9a212bb0fedd4fd7d6379842f3b4c2364318c8c940e6318339af17eb66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
aa7413925a50b8fce43e74869baa82af

SHA1
5d4a4d35c919a554319a8fc9fbe346c98ad26a96

SHA256
959a0c8c690c08b18f6c643c29bf7e716614faa496939abceecb3c5e4e6f7b21

SHA512
6a93b79697abe456542d1ad050bc91d1c31feb8f5a8ec5c1489942ffb07a988f4b65c8cb9928972287892a14f61617ae27c346a21549b9569720d71e4c99fcfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
211e41f70aa8b42645e4771852f64aad

SHA1
d54898a5bd682d246c857303b8a8d4c16a288c4b

SHA256
58380924f0355c4b6b8f7b9ca5c7663e0b07dd72024a888f0984f254ea9cc786

SHA512
db2cab4ed3502c7157d38e8dab2eccf93c84c448252a697c32220df806aa063e41a9e1fb55454cf1ecdba2208da4348d94c2093021c357eb3333253d86f44b6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0568bcc6b8a3918236658696b2d1b88f

SHA1
ea8d5d4edf4bcdcdc23f47704f89ce013923b86a

SHA256
1e5ce7827a0329238a751566e2c3a5995517d360adb8b3c7c7ad7ce7b86ab3aa

SHA512
81624ffa852b0e6a09e8d7c8e11e4067682dd8a524e367d73e95fc0d762e0c9262795880d1cb43e371873738a2b8153767655f32a0147c04ee45b873c8991168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af51683f3bc5bffc0ef01763776b2494

SHA1
037649e8f339a2d032cdedb888e57f50bdc7d257

SHA256
d6573d20f0be189ddd428d6c7e174236422fa277a78b449c4887a83ee4ff0fce

SHA512
2d089bf5a0a91b913f6e7482612db36ca99df21a89635ed8e68dd26891237200bd6545723d75a6f0de58aede71c342d4e68d68bf182b5c5120bbdcd0150e15b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c72873b383df758e19222ab6d45e5a0

SHA1
81fe1fc76875e90a1a4483f6ca8170ed12ea54b2

SHA256
146f653463f94e2ad91503eeffb337ffd77a9eeead8082e26dcd89278eeb3313

SHA512
8ecd2d5c53f46f51b965ae5d59d0013d764b1bb207ea21ca7fb15097b42c312d9d1ea1b758bba0d9065907a4a6662d89ecc34c095db4ab54f27e19c803d21b09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5b5972e123525d8caa4c2f0b6742b46b

SHA1
425f5148d50d8e99356146ef830dd0ea72f50e17

SHA256
b5ca3ead62bab1ccf69ad2c7f301fed416b69ca9c04c021dcce1dba312a343b5

SHA512
97487a10d6107a3040abf129cc233927fe47033b6783281ad63180871991c78589ee27de600ea1c12a66ec8e97520b84b1f7d36ef3e7ac9815fafb0916a4e0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ef4dbaa8a109f450977f3b4481b73b70

SHA1
5b1de5517a8935ddd802aab5fe3c8d2ae9f76705

SHA256
6dc31b5fe7cbb7de58511ecd8bd92cb588504eecdc68bb31e803edb2cec324c5

SHA512
567ac6e1fe266da0e4b7ae7244cfd2843234e6b286642208cd23c71c7c1d039ba5a5a9a83b21ac01997ab441016927879c71eded776488b0ddf25725d341d277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c9386b13627c98a7f0a77bd2aa4d7e70

SHA1
b1d0a147e9834d636b22781c3285dc295170dbff

SHA256
513b5623087d7f0b7a83096d80fd6c1fde2adc703b05e24d16f4689951fd09dc

SHA512
941c9b4800f6f1849c177c6714501621cb42436427db3d359702a53475e4f6b10e1c09ca2a50cc2e0d985061e9e8deb8cae1b3327cbab50540f14219a0f378c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73ed1b42f05eb7e37c28d58bb9df3f96

SHA1
2a6d659412ffe5a6e4de1b01c1619998de3ea372

SHA256
c16c66009b9960bce0067be5d9a9a9574770a11115380d2bad7297b135dcae9c

SHA512
f7ac477814be77ca59334c78c99610331e53015d9444aff0a22f1abc9fcc1c3fe1204b57502cb8b841a859d5d8b1d89124f5783c9ecd3772721efa0fcba9f936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e4a4c2efa062d5acf782718f8f85139

SHA1
1857d1e746afb6e3c50606d0abbd4f57f66467a6

SHA256
4849e27c4ca934d3327d709cec39829d3a0ea8b8ab9d9bcb658f89689a05adcb

SHA512
54848f8031dd9ef7a05206f0e6fead0140dda8e7ef8cabb0017e85dfbd7ba28467185c090ac7ff75166a216d16346ad19e0af5456047f6821921c8fc8284d185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
c59487598407d3fe202c33e028713593

SHA1
994e0e10d8e23ac684b206d6e29eff81d29dda41

SHA256
2702248121bf02ceb2ae0bec448da93ac10541550c8b1a9e26e9b056d881d32a

SHA512
80d817cd1334c827182947c52e1c090d3a0b52f132fedd1a49772e7d3ed31cd9862dcda7810ec81c4624cc996896d00da53b77f3d0d2634ad2313e25880c6bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
71ebc652368c02c5aa5c3fddde373f0e

SHA1
e5afac4c3a0b113171e0273d7e1d18b51b0f7412

SHA256
979da9776435305e967ca0ee7f2d38f77ab84106947dd6c0a5168a99307e15fe

SHA512
61b4a0e6abb752af8fe9a27ec6ff6fb116b63902a0faa255fe89a1b70c0aaf5fc3a4d474d84cf9ae64fceb0d9f00a86b161961c20f13c1a21035bfb05b5bedcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587f1e.TMP

Filesize
537B

MD5
b0a3b4d103cda2e66b4e19eec398f060

SHA1
2ef9f7abfc052020373df3aea415fa86291cc845

SHA256
7a7070bbdb7561f2b84b1f40719b81c3898d3ec3cb6141d88bcf007ca0529954

SHA512
5c598ffe4fe54f6890fb744182a3ab5e577a7e5323b7c7ef4cc66bde9b1509d1cc7bdad6f97ea5f7f419fae3ade95d90c9151268b6a21c18885fbb40df6b50f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e01f7f95b38270fcb593adf669b3f993

SHA1
a6e6e54d925aaa352ca25a5ad6b9dc57f9876796

SHA256
83b0731cb2b93efc1af28c516f1aef7fb0bff5274e4782c39c3807c73a77c140

SHA512
f764bc4557139680ddcf96941dcef78bac61cc7bd09039afa6906e8a2ea5282e0fe32162208e03525f9485f8e02d8a14c4b88873c177cc22feaf478e60d685dd

Download Submit