edbff9f854c8db357c18a4a9a64a681b3d2bbe9d1b9a9a9aae2fccbb77ce7e87

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64b58a6d6a47377aab6c01d5816e3e6e_JaffaCakes118.html
Size

92KB
MD5

64b58a6d6a47377aab6c01d5816e3e6e
SHA1

deeec532c5d325b83be1ff0d9235ff640d4bad78
SHA256

edbff9f854c8db357c18a4a9a64a681b3d2bbe9d1b9a9a9aae2fccbb77ce7e87
SHA512

d46637bf2f1e86e49fc9fe35cb3a4693d2eb76af815e2448b7398d517bda080d8e6e5fccae0eb068e6ae8ee3946d0e66142f676503e3ee98e9de768c76e2be85
SSDEEP

1536:fJOe5lANNGFvyJ6FQPqRlEausu3lJbLpzJH47NnA8mL14TYjQCmv3dNdzj6A9ApU:f5ENGFvyJ6FQPqRlLusu3lJbGM4TYFm5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1036	msedge.exe
1036	msedge.exe
2152	msedge.exe
2152	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2152 wrote to memory of 3944	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 3944	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1032	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1036	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1036	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 2516	2152	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\64b58a6d6a47377aab6c01d5816e3e6e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffe6b4b46f8,0x7ffe6b4b4708,0x7ffe6b4b4718
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2118872442576106402,10377656611755345596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\51deddb0-94fa-485e-9996-1b4d6edefe77.tmp

Filesize
11KB

MD5
cf4d1b6f70706fff2d5e22184b36c5d6

SHA1
667f7926f1d5364a2b3f072ea53b60573ccbadfa

SHA256
a7a3970f3e8983f78c77d45736cba37a35cefe4172a47f6cbf5bf73e1de0b76d

SHA512
4a948de19e67fdfb0ee4dc6b7d68e89e714e29edb3a9a93c4790115daee8c67cfcf647d517979e4cef4d0578e1bde7372a899587a8283cc427697aab68613083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ec00bc4ab237ab761cf5e80a78329a14

SHA1
3aa42c52c4e47ef3c6f80b88b4110e77661f1c30

SHA256
7bffc5ccaa881003a51b018405dc8c08848c0539a53b14ad0a9d6e06e5870e51

SHA512
c255ece5c26d9823d4245bc56d35d5d437918b3d1b92d43ccc9b1df2df9e2d168a7643cd0062d14983b9c82bf7e875690a613f811f173eb71e9c2d6ccd4da09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
968B

MD5
5b44f7a8b78ec89e1cb963e81be5e74f

SHA1
21baaf7062b9d763c1dd813dc22b446dc6bf8243

SHA256
9ccf4b0cee1db28805ebf2569cf77280aaa18e4c97547feb50f3b2a809e7b418

SHA512
ff1b368b130c5a37962b3488b92087e94b456433fc81a093b21bfa8cb9a0f7fb258fedd1f2ad0f672155b595bc5454208c1260412a4e0d88d2264c3f8110d985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7cf4ba5e050f53d5c3423d54db5d2fe

SHA1
6dd3bc1609e2b51d7f690e697f7a335f16570ee8

SHA256
34a910822a0dc1542d64c4bbcd44c18be086745e022bc89ffc3584af40c1b7eb

SHA512
74b65292b64e208d34d857563efef7c935ba0ead45ac9d6a5d8843c13725449d1b23023c711ecbe1a93edb4f3d5e260099df77147bc2a7aa22551f7578e01f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60f159fa5de4aa9b8d0543921ba4f7ed

SHA1
05e00d6731452648437195994dae36945d8780b5

SHA256
f4f2449ac4fb0c2976b40057281ed49e3afe4abfdd2a7774c1d8ffd101e4d05e

SHA512
e9f8a14ce891d889f4abe222cc42e3ae6422e26055950a2e8dbe2ab3110ed6989862f1af88685d7ea1d98617e0e0cdc256c4222b91100bf7a26252e1ed22be7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9b6fa9880dc76200d406a3c6d439bbd

SHA1
09068b1aec918269fa4369c0e740a18736ec2439

SHA256
fb59d7ce06ca88badae76fbd8f4d042a3866fa63dd41ed67fcda628ddd5fbfda

SHA512
b9ed943056fb484203eb84a97f37b2773aeb277f9060faba4c6175b1b868a6e587f4e2c737e0e26ac3e3cd5fb258a7d4b3d2279204962367ea5c48fa1fb554ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a64a500bc2abf2bc3479f5f0ebef3232

SHA1
ada7661837c386966199c089e92a23493f6a7b5a

SHA256
7d46607a10c76fd6b8c9c9c27db66e0a0d6e3387f8bddb03547ab5611f263d3f

SHA512
79c92c410440ded7badedc792333a4279cf20859990b2f0ad944691c9767427f26d06b35f2fd6e5cdebdfc1749f0ccb6170dac907fef2e5982d7ab3e6ba8e1fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c60f.TMP

Filesize
203B

MD5
38ed2e531a6014c72cead6138b9c4db5

SHA1
05960dd6e09ebad883f38f045bf4d23c78b28c14

SHA256
fc03bcee1233874b573dc4b6f4ab74094aedf42190d2fe8110d82fa65f72f5bb

SHA512
540dfc3f033ede1332f160f416cb3571c4acf652453b07ba58fe2128e51e7e5942df02569023621970172f755380d1fbe0ce7772cc17fde3f3623db84373689b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
\??\pipe\LOCAL\crashpad_2152_DDPZEPYLHQOOUEBQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit