fa3fba73c9d0752c9b026f97da045579da8d50fbea062380d2e6f6aef63ccfa5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c3416623700964813c9f669cf200ac_JaffaCakes118.html
Size

64KB
MD5

03c3416623700964813c9f669cf200ac
SHA1

46cf20202829483cbb74e515559f5701d5825aac
SHA256

fa3fba73c9d0752c9b026f97da045579da8d50fbea062380d2e6f6aef63ccfa5
SHA512

3d013322f61230ca8f13714f2c6729a48c7112bb87b69f2ddc64e80fc2f4214174d016aead2aaee70c880f4ca1c29a740ce200a96ac400ac3145443b8202b7d7
SSDEEP

768:1gid3I5Fxt5tRQpVF1R5Nthp1AePyTzBeHgvOCSmU7AjLNcUb4jur2eJCITaTnUI:1gid3yMyTzJOCpUkWUeu6eJCTRpx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4048	msedge.exe
4048	msedge.exe
1684	msedge.exe
1684	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1684 msedge.exe
1684 msedge.exe
1684 msedge.exe
1684 msedge.exe
1684 msedge.exe
1684 msedge.exe
1684 msedge.exe
1684 msedge.exe
1684 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1684 wrote to memory of 2924	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 2924	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4636	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4048	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 4048	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe
PID 1684 wrote to memory of 1976	1684	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c3416623700964813c9f669cf200ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44846f8,0x7ffed4484708,0x7ffed4484718
2⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
2⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
2⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
2⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
2⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,966322681883409068,15219628761699498251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
2⤵
PID:3292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ee8e3da-8445-4fdc-98f7-fed0f829d56a.tmp
Filesize
11KB

MD5
4d7eb4d109fbcf15075d0d74d82c85ac

SHA1
c6e9d55312ff4d23b4a130d09603969497e0b3de

SHA256
65d5e82935cb2c726ee5aea3eceb0f191337f8b4a6d8c331593076531e9cc8e7

SHA512
a97e8cb56c45eb5643660b896c078dc8a16474d594fac4b8dbd4309ca6653292f0374d2edec2b1283e377c53f5132e086bc266d4d9f5d0fe575dd442f112f28c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
ce72a346e6111efb77136ca4e329e74f

SHA1
a3e6f3a18788a150beff333583cc13f01000837b

SHA256
7e9353ad5cd6d173ec20ca54e99472dc18b8b6e41e2cc402fa2ca43a9d1ae218

SHA512
29e76a2aba74a800ee66d5a9bf5f306e505b5e6be74ad6aa6f0faeb08932a93ad766c1b745f25ba00e4246a8ab22333b3e52c1e4c25cf5177db188b8a17c7df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
059bf97b256f8257e6704f9e20ef5421

SHA1
8c1d5d8763cf3813fd0ad78442c611aceae2debf

SHA256
1436d009442e1f3dc7feca30a57d27b3c44f871ba4101a5364c23e8dcee81cfb

SHA512
4f6684b4676c9d8f0b2facf5b3351a5a590ab3f95e740bc0934c88619c0f1ed63d90ec8365df86a30c4960335c6f9a237da3e5a39a98da60a577070a2128c3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
beb0479379fa026419589a0c42b09d05

SHA1
a9af9947ba48e7be4163066de2a3f3b98fdbfe4e

SHA256
f767aa3896919a0517e5243f19c1a24f4fd308c892d0c8e3ec6f330df9310f90

SHA512
c0d6da7d05b87defb07af354c25fd0bfad4a221f35af3f710205c98c5634beb8e07506bc71024364c73fd3abdd66dfa03d45d324c53ed79ff8e0e3ba598f9579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e517005293574326c1fe3096586bc4c0

SHA1
ed49e74c2f94d555c1154e2e6990384c701fcf5b

SHA256
9143a1d483765bb7aa15bbb157a9255c4dbc2b9c503e93428eed2df6c9da8ec5

SHA512
45a02b4bf15ed50896753cf7fe052b607ca0755f957ca19f699ff83e3ca4b7de6727a0f5ed2c583fa54d9a8c579c0b8dde50869a86f0f4dd9d094710b0c439f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
332a14186db03a7f86018c040c18bb3d

SHA1
a37f52feb2494a25b22b41726b99a9b7a455fc50

SHA256
24e4dd4d693f41fe69e25723e345c59c680153c954b996f30d2f80b4d75f4117

SHA512
c34dfa9c6b8a61c33b476185694d65be3e37e11492c5f1cea37949b91ac8605b4f5d493455bb6215165affc4791905bdf85334e7e2664f87d837d6905306952f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
32c95dbd58f4008cc590a15097d7a67d

SHA1
3aba52cdb9592666ab3c62b592c792ede6c61bde

SHA256
88000e28ff5563aa6bb1ca8083051a33f544283576569d49f26f8087b2ce760b

SHA512
5be1d3bbcffdd7fc80813a17e1cfa27953cc758cbb548ccb3f24a6be6d86f965f122d474ef500c381e4cb166755221973dae34559f3358e7dcae7e31a703f224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
b37592b172c1a7872ee4307ac779314f

SHA1
1b3c7cb5beebbc1239061ecb6e4fbfc588f00f57

SHA256
731a34dc4b1c5ff630a4c530b5da0ae4aa234cc6bafad5c64fc23dd4fbd374c0

SHA512
63e45ca0e31c42231bea2be041e040f2fc9c30322a773a0c63ecdb764dd28d301682a402dfbd02e1a8501d7768a5d38841fb8e65a0f998036a64e8d762032bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
fe0191abb9364544b52a6130f4205264

SHA1
1b0237f25887148a8a69f29e878995fcf38b5c4b

SHA256
3a5c90af17c216ca23d6eb6078d167cf7bec95e1b4c267e9b52a676666497dcb

SHA512
44e20e903b7c51cee243041b93c3792bcb685d7c9b5b0a72277d9a205f16926920878a3bc5000b148cd33d2b25a4d1ad0978f945f45bc5d9ea7c127cd081c5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810b4.TMP
Filesize
203B

MD5
bc3616a441b7f03d80ac2c0bba35d31d

SHA1
f988ade2d0d45567899c7f4d7fccd5ba6841cee7

SHA256
31539724682a23fade832c40a6e282ece916da87a5b158b6d9f68989cc29b979

SHA512
f6e3162b8518e571c938060737d3915b9f2f86cfa2c303bb46bdecd61d590231dfc1b34cc70e16c589b6e972d11251546cb53bbb17a12907dbb3c774872052a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_1684_NZHYODDFIJXLCDGQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit