1716a3534ceb7b01eba05b78c92e4e3b0db7f727c112caf10d6a15a1c3abab53

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63f430fd8671f15c49d02b8dc711b59d_JaffaCakes118.html
Size

19KB
MD5

63f430fd8671f15c49d02b8dc711b59d
SHA1

2df2e15eb8d1e77744dbde8490c4ec15abe4d335
SHA256

1716a3534ceb7b01eba05b78c92e4e3b0db7f727c112caf10d6a15a1c3abab53
SHA512

20719cb97ce21f825132d0a98d930a4e14aee4680fe7b426903b67a7be7e97fa30fa78cd859fdacdff25709f397204b94c15c5f9bd734f83c63e02413e165f22
SSDEEP

192:c5l7vFZ7vqNp650PifKmgsa/MlaYz4VVky2Ll6Iv566DxOTPIprbr1gYq9jSrSzo:cf+YegAgVV9Bo68XrHuzWk5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
408	msedge.exe
408	msedge.exe
1004	msedge.exe
1004	msedge.exe
400	identity_helper.exe
400	identity_helper.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1004 msedge.exe
1004 msedge.exe
1004 msedge.exe
1004 msedge.exe
1004 msedge.exe
1004 msedge.exe
1004 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1004 wrote to memory of 1620	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 1620	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3988	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 408	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 408	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 388	1004	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63f430fd8671f15c49d02b8dc711b59d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
2⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
2⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
2⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,14311779675827048851,18205950189906086203,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
869f9ebb1b1e8b0def64b8142c759175

SHA1
f68ef9c1ffd8a3e5e18de401de3211424e89fea4

SHA256
90b1ca47696b9db1d233d31b0823c3ce8c5fc8aaa94555b9335d3062126ab6f6

SHA512
0c6e9ebe16a26e8e2cb31281d4b4f9e1c1d8acf89cbffaf5a36f14aebfc36d919f637fdd7d9893cf78bbd865ce1a891f95a4222465ddb68d6f6339ad15ea49e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
68ef2c02838ee314eed99f906b54d66e

SHA1
4de3977c898f412a786075c5e674e99659fd0903

SHA256
720891f5e4e2f51543aef1a0d69c82267071016781e27af3837a2c88ae736443

SHA512
ba471cda23455b5a461d3cc82cb3389b21918d225471f68d491f72355f7da45431b37d01b8e7cf2da37670f444eae8fe7ec0de0d75dede05c01da6d2b688c4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
56965f080887857df52006a5179c2238

SHA1
95d254e8f6eed39f80e690b139605f5170dc969c

SHA256
bc3f354802acfcf8ff2b2132acdecb0dddfe7fdc043e894a15d941edecbab8ab

SHA512
83aa6506a43eac9ffcd6055faafd173c4ae7214a47aa13e8828609f4e7ef4ecde409b21122558665cb4f6fe09d21f43a5d446c7b810f9217ef128d0df78b975d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8157e780b1885715e9f9a67ceccf3fe

SHA1
ad5ccebe6741620bed8bd6d846d2d95a305258e8

SHA256
afb46c3fdcce20912bd2ac841ceb9fc4d9e844ade43b3fff3364a2fad432d6d9

SHA512
2d97f7ec16182f22c898fd060ea106f6659e17080166d80f02ac5d4c462ab97cdaeb88cbfe8f84cd02e1eed782a417c04186f9ac539e8b0beec94286b81f7700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b8dfa8f62cb8f8f83020b9af1f8abc1

SHA1
99a5075067ced2079cdaa3fa77747dc85ee3dc83

SHA256
b22534c64cb11bd34372a7e819710e90f88e55d66fd4a765a7fb690d54cb4ba6

SHA512
a8ac34073453801c9435e6882c1658932dfc4949b6cc659910bcbfe6e584220b235b3fa13615aba741e1a7fe2f1c76dc3e546ee6dbf52acc541e0e62f4d85936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e87bf323954c05795eeef1b4eb2866cf

SHA1
2de0a9233df488a3be2ba0651a11d3e624d64432

SHA256
f7b54980bf16c804decac666fb46f859ceeee69c79fdf972e972b4f3e02f3ebf

SHA512
c90c1a5310f73b668ff1af4550b6e1df4e01a6de2e68018277229ead5de2e1ec5bf40dc44a04ef67022e874ba6996156cf18e226fe34d2bb8829ce231ef22e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
cc748167763e7f434a75c6d550d5743f

SHA1
477b57363d76e8fefa677bfb41c5a6df68be9b25

SHA256
5f3fe1f978fc7e2fe8816c9056b541211f806131363dc141ccb991c873ae575b

SHA512
c529f6596798dfe80bded9986e36a9bde9f3d843ee3ed444a937f4c9212436a5b8eab9422bfe2d08b113e8727955a1e4f033c6fb26a26daabc43d0451eb3915a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582ad4.TMP

Filesize
37B

MD5
661760f65468e15dd28c1fd21fb55e6d

SHA1
207638003735c9b113b1f47bb043cdcdbf4b0b5f

SHA256
0a5f22651f8fe6179e924a10a444b7c394c56e1ed6015d3fc336198252984c0e

SHA512
6454c5f69a2d7d7f0df4f066f539561c365bb6b14c466f282a99bf1116b72d757bef0bf03a0e0c68a7538a02a993fc070c52133ca2162c8496017053194f441c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef9f707e92912f68a0861bd19b06772b

SHA1
2e5e7b3dfb14480c6c7d27f1ecf43d9f576e815c

SHA256
2f1ad726abd9c2a83e5f5c3a7fb825743ddc32c6049b3535ac11c377c324fad6

SHA512
8bcb36007f1ebf2c8450cf6b29d916f85f11cf7b4695a29eea292c4d93199637d67dc807f55c3c78208266ba7927a602a7d6263a5349e255f102d50475cc7546

Download Submit
\??\pipe\LOCAL\crashpad_1004_CZFCMVIUCHRQEGBY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit