d36767c22438616dc66a43c453cbb83db56142956dc050bc57f991cc7a567c15

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65aecb0c609df033a2a5504cad9c1c96_JaffaCakes118.html
Size

40KB
MD5

65aecb0c609df033a2a5504cad9c1c96
SHA1

fc59d46c515b611e7e6d1a4687a79b25268b167e
SHA256

d36767c22438616dc66a43c453cbb83db56142956dc050bc57f991cc7a567c15
SHA512

255ddbe5f332476205f4fc22a5c86471d4a0dd56658d682678211d55a63de02d25ba25ec70129a498f95228f20e4e9fb5e66c0f3063b98a6475f282c7059f8e1
SSDEEP

768:lxeO2L3X3+3I0v6sZAlMoM0sUWHypcVdSunMZr5CLoZzfL6K6E:lxepXO3I0v6s+lt9sUWHySVnnOVCLoZv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2032	msedge.exe
2032	msedge.exe
1608	msedge.exe
1608	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1608 msedge.exe
1608 msedge.exe
1608 msedge.exe
1608 msedge.exe
1608 msedge.exe
1608 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1608 wrote to memory of 4756	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4756	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 4788	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 2032	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 2032	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe
PID 1608 wrote to memory of 1072	1608	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65aecb0c609df033a2a5504cad9c1c96_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1e8a46f8,0x7fff1e8a4708,0x7fff1e8a4718
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
2⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
2⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
2⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
2⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9738613254900629504,14520977002330755758,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b06742bc3072201af165cfdc22f65542

SHA1
bfa5391eaa2f30c560f254b967c24c250f578024

SHA256
c1f09394db410522c4a190f43893b080429d5561f84e2e6e5fa303ecbc14b543

SHA512
08b731c5153caf2316783c9bc108bd46d8d87560e0ecb70b21ad896b1b0f7cad68c3134e6778982d901ac3eea741cedc62d5c9453df1290b91f7b4b89c586d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7d433c364af4b88de39f9a859f43ed51

SHA1
cf40643ff200872247cba0282211b2888cb979b1

SHA256
f7d1b125231151787ef2ba34569d5e8bc9461ddfeea68b0f054c1ea0bd6f1063

SHA512
27c25df1de93699b86f65122074192d8bbde64d33f863b6cc4da8f6943dcbd77b05fa0432ac3d69e7b5c2d85d7336dcba82948e478dcab5837a7c72c34f74bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39b8e076ee688621a1c5cebf90a3e3fc

SHA1
b94a3de1e069847811dfc7845f2352952dcf5fe7

SHA256
29e850f27ba40e20a2e576ce2c41c41a9599bec139fd550d1783897487da7b5e

SHA512
82f94e09c220665ea1f6400eba6cf9aad2f0a3dab8cc5549ebeadf4242e6cb88c747e60cdf750ae9b4643c7a3d32347cb974292fcd5b9a6b91b90dbbec36d48b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11152385835207f19cfe4394f3da55e0

SHA1
7fd3728b56ccac5aa7fa5921919389cc276dc01d

SHA256
b235e3a2cd3688918e6b79549f50c480db93886028e25402da7539007bac4e7f

SHA512
8b8358d42acaaa78bc42b3364d09296b318d336dc1f2389ae616fa853490489efe19089288951d219bac25711ed3d8b6975ff8d95a45021dac8cb128642613bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
832fcb4611736396fa9cd729498d66d1

SHA1
d395ac119226d391ae8160cc1f7fc16e4db15435

SHA256
deb29c7c27f667e70e1797ae12783bcf8d3fd7767c3d9f82d21cadf192c08952

SHA512
09b2b272c5831c0d6fce882b3395635ac7f8f317f4b33f852c96daf079e38211908ee0993a9051bc701a67b01c395ff1b90f14a59255ddf53a9367dfed1af965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
5b880c128dbdc585b342dbcfdb58dcad

SHA1
689333f58e2083ba78fb28162a418fab8f43c398

SHA256
3a4063935a46196314e987075344c7fe26c80386b418b635b6f383884de383df

SHA512
3b7abee62788bf512721ed1212f495f349ee630605ae2e995e1cf5666d04a830a79c0e551420b0247ad0ba06049f8a9114c3ea34a00ef6054b52b01536af75d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e75020d6e1f271ecf4db832da5cd077c

SHA1
e6577f7ae62a3f823a3191737f7bbc0d62de8bba

SHA256
08500cdbad0e8ac6eb04d61e97a3621a1cb2b2cc9f83600a5f48edc5cb0b1d38

SHA512
9dde0a48375b9f3cf4348fa3d08b4998940d21d7bc02b683ea609806ff8fe77a28c2a6b1cbcb3f41f8ff7b2b630edef0df70fc3b237387c6d1fd7005906e990f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
de0eb480408e71619ac218094e831ac6

SHA1
a32031559c033b80a3773f1785a4695a4e4c6d06

SHA256
26fc19135be848b745c3e3a87a57d22e45efc75336f99ddba6e7818517d5759d

SHA512
556c0003a0d061d0506ead022e847542f3f90eb90af5c120687135fd898c910e117b6a9fb6fdf1c183f970b5a125b196d08485790545ad7f52c4d2525873611e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
0aba491dc1d687bb0231c25b1397cc37

SHA1
5f0162ccebf4dd7981e3b99ef70166309b102bed

SHA256
766d3972f8fea63e71e95ad54252dc51938c9ce35fad2dc7dabd9a104c73778f

SHA512
998dddbc4e182bf32cd8455538603204e38625fdbc3feb07aac2c05c7c40f0a8526aaec1266dcf6368e6012a3557a9d1e09732fc92cf84d2d57c0f5fabc72267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b817ef281d3b3cb15c128a78a771fdd2

SHA1
61e1076e46be85fde2f9414cc25094366c843106

SHA256
bdb54328db413fadcf62601a670c5c4f920feff8414a8df78bb2a4d12bde848f

SHA512
6691bc85ee8dafc979ee26d63b7c8024aa6bb4b20ed29b61581585a7af49ec44b46819e768dbf51c84b612235b7d8fd9253cd02130d33189c33309015401e704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578b67.TMP

Filesize
539B

MD5
69555d99397f9ca604042c23c16c845c

SHA1
d529877431657a843e3f8d730e9f62e37ccf72c6

SHA256
b386cc3c61235471cde0fe904b8f87129036602d8b1153ad70c83ed04829772f

SHA512
800fc6842f277c3f5a569f78317f385654c3bb0d2ffe48118f75b316f00a8a9cd6e792c077898e41abbeba788720c06ceb77d3f79bfad1ce4b2db1d073292207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aeec552682b7c43c1dff883ff3f33570

SHA1
56e023545fe83eba8646a9423bf122f80a3cf620

SHA256
91733a3188e73cf02e891ebbb4ab5d8a92812b48853a0ccaf5094e1a58a37ee0

SHA512
ad176138e5308bcf5232bff4b6f30c5eacc37dcd9e836c31963fdb94c9ea2e0517c4a61f50003ea47a7642231abdc9c2192f99a16051631cb00d64ec8b04a973

Download Submit
\??\pipe\LOCAL\crashpad_1608_DVLPVIVRGYORCMXI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit