630019eeb48a1b8659cc2c431a616beb4788a68a8065bfe4de779be6814e16a3

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65fec7b4b04dc6d68ec90e00d5bc7730_JaffaCakes118.html
Size

116KB
MD5

65fec7b4b04dc6d68ec90e00d5bc7730
SHA1

9cd9f0a89fca4610cbf0038baec1443ddff5c4b8
SHA256

630019eeb48a1b8659cc2c431a616beb4788a68a8065bfe4de779be6814e16a3
SHA512

487a15e49adf34d9fe6a97af5267a389ebff9d3cd91211ca89ef0fdbc75bd25305d388140586157d57aac896dfa5376e2c46561c3fe18204c235b9a5717947c7
SSDEEP

3072:6HHWzA4Yk1w9Pr5PT6pt8aNp1LitK22SeZ1O:6HHWor5PT6pt8aNp1Ls

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

108 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

flow	ioc
108	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3764	msedge.exe
3764	msedge.exe
3308	msedge.exe
3308	msedge.exe
3296	identity_helper.exe
3296	identity_helper.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3308 wrote to memory of 4484	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 4484	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3228	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3764	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 3764	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe
PID 3308 wrote to memory of 652	3308	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65fec7b4b04dc6d68ec90e00d5bc7730_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bed246f8,0x7ff8bed24708,0x7ff8bed24718
2⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1512 /prefetch:8
2⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
2⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
2⤵
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14300006608658602590,15650842748243043962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
312B

MD5
f6ce1f9b3d261a5148b107de74f82d27

SHA1
f191a88f33dbccc6326d0416526948a7fc088d88

SHA256
a8ed951f5ff4c64e8f5c7d506070b0f8d83c6a63bf26755b153a112367998bc8

SHA512
ca57830745422a5c0ea0167dcdc030f7c6ff615682d9a3e25550b202e2f7f3e0168b8404320314fc62afaebb48c1cafdb2dd05e3d228dd80ddb1995f92d6e8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
fbac4e49d6fa41ea14dd4440be001c2c

SHA1
5748744fba0d8ec82baacfa209259b3847dd69d0

SHA256
ee878f5cf0cefe7a7dfcd92e745a9cdb5daac0bc5fa9459f226fd715006721d6

SHA512
b0c133faff647c3e92e46b5f4600138f1445434efb9b5acbeca821b65411f7e40724ef66de596da7d4458fe8109965cdfab08bbf7e73cac80dbb79041dfb009a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
bc8682a7b390864e67b9d06a518e21d8

SHA1
5f7db6f49bdc1dc72ef61198d476788d9284af5c

SHA256
4ffac2c1dda4ef53fe37a2c492ce3afbfe61becaf88368b6d66297a7a9c807f8

SHA512
f946b865dbad070092ecee8ae195f608e191a0a4686d5d250e9e4e83c8e575ac0e748ec99ffa7d04a4222f42fd8443a9dec206571a58961788e12be2140d61ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
17b52719afec4d5072058fabcc6e9540

SHA1
201651af2a1539e94e7bb521f345e0a5ff44fa67

SHA256
030428d57766b3967b3d1abbffc0f5076a13827ded72d62a68e3a923ddc0f745

SHA512
b60fba739327bb92845864b9f9ef5d5e1c32c1fe4d2f447a730d2dedecae5e535f7f6ad7f850af5d5c92e9c8a62e9610e9956d7dbcb1fed118fc065e2b098759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
ea25054030be1b4b5027f60238857310

SHA1
4939cad22f3f65634f09c98923a1616534f76f12

SHA256
93a5ec14f28ffc86b7bbf67df71388e5bebd84d499d8a81ddc3f5bcabb9f5fbe

SHA512
7465764e79cb330a9cfb688fb9a8219c68940e4a91b285d41c923820a3524b5e7a48657cc79738de9ac6d0ba16fb7afe608bf03af90cfcc0c3d72ee4cd40dc8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f5c97ce11b411ad5b50206ac126654b1

SHA1
f49dc10c30c615b2de6fa0a54e4d28a3f687b124

SHA256
d4b174b16189f2bce3da478445b897da968cabff8d7e459bac2d41d9de09176e

SHA512
9c9abad347efbfd5ae7e2211bf00c5f19f1680def485883b3c92f07ee4c4e4dac3ee6c873b48cbabd601ea6cc153d6876d0732494c9d0d3ee7ce246e06fc2445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
49a52820e77e8e039c3344905c106ccf

SHA1
c6a4f895a0306d722fab1623cad8c80312c66f54

SHA256
1eaa0e72b39e4ca069ba034a4453e04c9c0721dd0e5a059b043fd634014cfa54

SHA512
5cae72d4a6bd251d808ba447858d6e6519205a7b75305918c9eb215708f10b8df750ebf3b86370331df332ed2cb8f6b830f55d24187525edf6621ae3834a3932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
edf45ddeff502759622820c69c786661

SHA1
b5ce1d2d624476a142de73b6968924268a83a395

SHA256
09ae343b18ac468bf340bd325117943e0f946e5b7bc0c3dd8a85cc88b44c7e20

SHA512
8873523fb700e74b6f5b3808c76fdb1052392a2e2d96e176f018087cc1a0c9d16640dc0e12097473349d8dc56fd15ffaff3a5b4a056ba4b1081fa2609b716d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
435a461ada1ce69726f9da0a9548c50a

SHA1
35397223edef53eb381bdc9b653a343ff30f6571

SHA256
7f562c3e8c2cbbfb9871ff1a758052f7b17ade67df86a266d8c1ebab9cf40a87

SHA512
ba6fde5ba63610f90726107249e56a643a7403f2de525a31bf2166a0d5386e684f585967f6a6ec1c896347bbfd32ad897632ddafef8204123affb6c897ac7cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
9b4a10cc3885315e0ab4dbfbd4f3464c

SHA1
5f741f2835e1ad4e96a300bac002119872842c04

SHA256
817085d44e7ce83e4eba413b2b1364eb7d4932ac85277a77aebdbfe0c645b47a

SHA512
443f549c4fd904dd221024806ca6c175da5246ed9ce5a1e884f2f491ba836184379e5b91b6268900e3ee9445babb8e42a92847521014f7720d3f3622d4e7c2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b03d101b97044e5fd52619f3403b1b48

SHA1
1b71ebe4a490aefb5eca24a40ffadf79b1057b8f

SHA256
da3c6faed33df093818563903a1be62aee42a5ff2e50ba5449b3d86d8dd33e6a

SHA512
171088fd0a55af544a25d205fa75365c1098f219fe94eff33a1abc0cdc9da7fb7ab4a38ed15bb5c47dea170ea079263a46036977b2a02ee68c5f00c2db9e8a2d

Download Submit
\??\pipe\LOCAL\crashpad_3308_CSXVULYUOPSDLQKC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit