5ce42ce0b70b951c8a34bedd474a36a2a3cfa50f268bd14ea2b80da56ebcd445

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6942b254e2b419be9d55a9bee713b4e7_JaffaCakes118.html
Size

11KB
MD5

6942b254e2b419be9d55a9bee713b4e7
SHA1

c23a47b59b5c5a975c033d7323980de2023b9632
SHA256

5ce42ce0b70b951c8a34bedd474a36a2a3cfa50f268bd14ea2b80da56ebcd445
SHA512

23e882911dcecf3b5ff54fcb7264ee832cc0b3acedf33a48d8e3978655620916981f41e5363ad060f52f9b95e9024a7fbd1bc567e86bf851097b5beec3bc9fc9
SSDEEP

192:bgTES/bLic2fUkAPiHiFioHLdShPIVzKyNEojkd3YJbuX73Rn9PwslNXu/:bgTEaFIUkAPiHiFiCds+zJqNnhXu/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2380	msedge.exe
2380	msedge.exe
4832	msedge.exe
4832	msedge.exe
4372	identity_helper.exe
4372	identity_helper.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4832 wrote to memory of 3864	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3864	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2044	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2380	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 2380	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe
PID 4832 wrote to memory of 3896	4832	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6942b254e2b419be9d55a9bee713b4e7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8958546f8,0x7ff895854708,0x7ff895854718
2⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
2⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:8
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
2⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
2⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
2⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
2⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11409493928577310870,11336359031091062497,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3156 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
210e9e90450d76f07c652bd9a269215a

SHA1
259bb501a7b394ad4ff70e18bcdae42435db8f98

SHA256
578998576c81e930e756929aaad82043f1cf70631bb1461d32f5ea46ce6de215

SHA512
c73720a48c0c7784bab102a96d6d2f5ec6f7044f897f52fbcd1b0a1139d5b7ae4036a9dfa12aeaa3a3cfff30e63049259fc601be592961750a7db5a4b0488232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
599B

MD5
a9afc5d5152fdb850126c97694794a9a

SHA1
56135b4a6c45faac783189a2e14aebe3b8078087

SHA256
aeec009ca962f637fa32c7594890a585f1dd73f7ee6086f4971f623e329570d2

SHA512
44315488816853c4e4faa4d91cb5d3678a157d4393b0a5d326513b6af5bf21a2d9f0ebac2f12d62d495db10bf5883c1487c260c4c0417f2502c31c4ad4f6b8cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07cc88cf828513499312fe74abdb335a

SHA1
9de0322d0f3dbd1551caf771022407ae785cd2ab

SHA256
8eca6b6f2e21c223b960ba8fec48193ee480a30dbf9fcf96e35e639b7dd8f0ba

SHA512
52c9cb554816e5ffc9e42394145c54f2758cde1ccbfba314b129d0894cf77a6e081b63b39c7484f9e4edc58f92ab1c092c2206ab4d892bba27d7b8345fdd1bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06d82310cef1e1fbd1f8b22bd743c172

SHA1
5982e8ee05fadd55012ab04304fb4d120f6a73a0

SHA256
f3d0587ed38584974d8d55b7a40f108b3d64728a3d875fcd56937b01e3587d85

SHA512
52ec3ed361410b2f12434466604965aa44e46518a5eddab1d3115bfffb394ce8155056964bfb906db2241f3ffb17d34458a8367409a20520e10c6702d1186774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
192B

MD5
b2bf6622063f049058512b53657df23e

SHA1
59cce1da7817abe40b040cb7aea31827a8f4c665

SHA256
995aae04fc56a6a4e0ed78627b67d3a1e79452d21a9a670f2261384fda0e5f09

SHA512
8002f8885c489e8e18f64f6712a7e2201447d43a7857b5f512a25f6c3c455f23bbaaed7f88bf4ae9718e75d847a14a39f754b7a59d2a70654779dbbd135108dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57dbd9.TMP

Filesize
48B

MD5
50d32a447368c4c324e5f1236e5975e1

SHA1
45079dbf9cce8d8cb4f6db60f4ee1179a02bac33

SHA256
f25ed1e3dd395910320e71893f1cdee81a0e82e3aba701d9b67b75c5953b2bc7

SHA512
3cadb1052122cc97fcd639dfc0daee0288f4b9795bfa993527c1daeb7dfd6dc19bf00e6950a9b7b50e923c907e621bfb87fd9d6645d187731e485e9993b5fa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
899e125b0252a4f9a43c0dde15444594

SHA1
04faa4607b333c0dbb8596a3181f3cd6e990990b

SHA256
e11b92eba2dd3c2fd6e1d04c9b205980a898028299036baf7712f241bfa9547e

SHA512
28812fc7924007b89f7b224dfd279d9f46d2efb3358323f2ae3b68b8c4a485bcee240c65334f2c18916ea3bae3930ed63b55172bbc952dd51d09b63d92914f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b3a0.TMP

Filesize
203B

MD5
bcb0a407e7d547775a7e487463763810

SHA1
0e3e48c9ff5ed94d20afda0cac3129c7a5fbf549

SHA256
90d43974472f8ee396d29d44b8d67c8bd1fe59dd81f926503860d5d0e8f57510

SHA512
431ee8d493f7802987ed1fa1dd6e177aafb756e398184b8c7f48dc40551ab301309c6cda6ccd5eb9f34cb7fd95596e8ce202ef6e575e2779d0a0149e2d4b6e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
725108e4531a5f47c66655a3bd950611

SHA1
348c7f6652f6fcb3bf4dc546a78da0a389a9ed9c

SHA256
cbe315cea6c8ceb85c61e233ca833d30ef11f7de63c3b6ba55178e54043570a0

SHA512
50e1df06062e4be3281ebb95fb23ba55fb4c90f085662ef2e2c304671d9c850e95d2934c0a126c99824d665e4ec0de6f00374a19d94d63a689fbebf3c812ef85

Download Submit
\??\pipe\LOCAL\crashpad_4832_MWKJYQFITYKIRSAJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit