e74f48aec63db3df0d4903de261b102471f383d40df6585ca8e9bcd427e075bb

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69347b734e33b1ffff4ab08d6689c236_JaffaCakes118.html
Size

27KB
MD5

69347b734e33b1ffff4ab08d6689c236
SHA1

30bad00a1cd62adce0d10a7ebbd06d3b9701db0c
SHA256

e74f48aec63db3df0d4903de261b102471f383d40df6585ca8e9bcd427e075bb
SHA512

08397ee79b08752505bbde37d125d03027885690024aa93e23722930bcc5222403edd4608b2e1d6321586e7079bd082f914a4d81b6a216bef14db97d12fb2ea9
SSDEEP

384:CanswWJKC5d7YfxsuYmbMfKfa4EYEjMkbmophb2jrKKJm3E:CqswWJKC5t+sSbMyffkFJ4jrKK80

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1644	msedge.exe
1644	msedge.exe
3124	msedge.exe
3124	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3124 msedge.exe
3124 msedge.exe
3124 msedge.exe
3124 msedge.exe
3124 msedge.exe
3124 msedge.exe
3124 msedge.exe
3124 msedge.exe
3124 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3124 wrote to memory of 2860	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 2860	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3576	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 1644	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 1644	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe
PID 3124 wrote to memory of 3628	3124	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69347b734e33b1ffff4ab08d6689c236_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf48d46f8,0x7ffaf48d4708,0x7ffaf48d4718
2⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
2⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
2⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
2⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
2⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3649784387736027757,9097326434135896547,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5340 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
8034f374ef5c4cc9b9e4e8fd2c6b019e

SHA1
56c36fb12e02963da998cdc07b88d349e80e5a80

SHA256
64cd5307ef8c348ffef58343f6a452a5a5756054d0b5003522bc390019e4bc19

SHA512
e5bf217f0204df6d7d4cf39d96f4c7b9a6c013beae50da19a7082d792463e4deab34120df6672a9835a09a2d42a33f9c49011109d40709ffb9a693471fcb1a12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
4960aaf4819ec9480aeb1dc0d8c8c403

SHA1
cba3a63dae55abeaca89336d18e382f51ec3dba3

SHA256
8330d072ac967eb2c554be1d2ab67089d7ec9c80692b9bb81a9f7a6b880a64db

SHA512
1103ed1dcf6304f84c98abf0f8c2c9d0a7d182b56d36a819f9e371839c733a3738b1747cc79eb55f702efac3a5581b79af0899f40dec1cd04c5a3444d4a432ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
d687f432478ead55aefb184acb161c3b

SHA1
de689452ef89869075963b904f90064ad0108fdb

SHA256
82d1bb5d0545d9ab0bdc22ef8de05c85054ce6e10597571514c29f7e99e5c488

SHA512
ca9900ea27020b0c1f3d1c8a64ae8bea19e5c1ebb45cbf63fdf9d24f8e7eacd93780983a9cb8afafe5cecf7d91f4e85ea8b07a007d5f0c346621140b4f3c9957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
99a2972a442d3ead7c34dc851b6e1361

SHA1
1cb405e50fd184b4c9b879907b0a3dd18adb2114

SHA256
d67a0e0168778b7c4d763ae7146d313119013a3136e4d81f9c163b66426def2a

SHA512
886c9eba09fa3be539766bc40ca7b560f84d0c7f109a7b3b6f68fde81fc6cf4e95d2ac5e480f0fa4983c28b66f09662ad0085325870216bea2462b779502b88e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2d217dbbda44ceb0da20d36a5ec2b932

SHA1
79df80ab8765d5fccf1bb4e565cae481243727f3

SHA256
56ae03b93a819208577aa1b0718582090c1d1b497037dee89e65aaf057b6ea27

SHA512
45ba98241fc3734f74d9dcdc3f0c627a313f88ec7fa9cbff8d3dcff9a64961890e7546e95bf5a12a5f7445728dec1177111ec3cc0281327d18a68cbd91aee04f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
5c21f3fdf608d61aea794387e0f9aa1e

SHA1
00a14f50ec3e1696bc972e919227e206f88466c5

SHA256
02fe4abadc11baab1af7932c65a0754a7e35e2cb489d3cfa0036b6765de0a8b2

SHA512
9203514f71854f2eba958d07a6c20009ddc92238ef14960e31618f9070db9d15adbd0b4961fe1f830b7a87185489f0d8e18b9423d4769710dd70c714be621fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d169.TMP
Filesize
540B

MD5
e5469bce0b9e85ce30f1d5feb8086499

SHA1
65955e88618640d9a0e09626caf8f0ce81b9c4c7

SHA256
0cf423f4ff98d6c5553b950cd03c107f6aadaa4b346dcfe2ef0cadbb4d5d6825

SHA512
acaaaa821708d89286e882a1bcddac39507aa303403c6c6b031a0d057aeb7fc2e07647f4e6573f5db374f0c435da8a3eb43ab09f0d135968d15dcdfcfde43477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4da185177b95dc61c61bc5ccb5360ab8

SHA1
b964710a5a454b8e89270f36e2e0840d4240441c

SHA256
19b24ea34ee7af7672373e94531bbbf2f9103179d88f8bc857e2325f5bc69f4f

SHA512
6407966a7723265d47f701a11b512ac8fffe2cdef459bbc8c2fbcb168afe57b22e6edfa9b405503daba9fcac5333700ccd5cf4b1480b6809201cf8e1dfd0e5af

Download Submit
\??\pipe\LOCAL\crashpad_3124_PAWYEGBIYPZLEDRV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit