e9f0c908442245a2fa02bdf042f2233589c83b33c871cd466ef52e0a9c045011

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69682a9cc305821c76ba625cc5f16bc0_JaffaCakes118.html
Size

211KB
MD5

69682a9cc305821c76ba625cc5f16bc0
SHA1

52d326e0811f9906237fd7b90b8cfbf5a3fd9e6f
SHA256

e9f0c908442245a2fa02bdf042f2233589c83b33c871cd466ef52e0a9c045011
SHA512

654f5f0be2aea995c228de1bdcad4d037fc563e8fe9e1cd78634b3ee20a12a56cd9fd322ba781b8a2d24eff1b5e68bf5de13316fc1d26584e1186eff5bf5bb71
SSDEEP

3072:437FFHQGs4ViD27J+BasOGKXLLTwX8AvWeay4kqtRgZjCPEFu4j8gdkHZNqJONgs:osisZAvwX8QKygD84Rysr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4060	msedge.exe
4060	msedge.exe
1148	msedge.exe
1148	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1148 wrote to memory of 3576	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 3576	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1360	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4060	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4060	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4220	1148	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69682a9cc305821c76ba625cc5f16bc0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
2⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
2⤵
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 /prefetch:8
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
2⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,2737241924771180421,7410165072582341142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
be73d0611ae38a85ab5d649662fa8ed2

SHA1
92544e814dbe8321cc3282899cbfbb1af530037d

SHA256
273bddd7a42a592b3df515c3a077aa44e366adcfc450f65912bac662a4bf9f56

SHA512
e6b66ee5c82e3170f0042204601aefa517b812aaa47f2af7ac327d9118682dbe9fd1cb6229bc87e77413abdf7ede686726ceb1086a9e289f0d4b7db8d93a550c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ccbde3828766f0a415eaf9d1715524de

SHA1
2f72e55902404ab09b8af98620a519d243533e10

SHA256
6e5c12b8a331d615ba3d410c450e1767874df1c4cfa95ef689654d4924565b8b

SHA512
feb732d449c83131614fb81c4e81162d45ba0199799bdf6da6b53aa8f5fa40b107b38daf923a634ff2541674ea45a93486d830ec7ce8e936599491d2e49a9058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be53bd2cd098efd54849b62c07b47ccb

SHA1
c440457e7b7ff1ddb00b8444cde16affa62d1ee8

SHA256
712511f2d93f85353f3046865d0bdd6eff4de7d704eaeb83147ceeb299b2e76d

SHA512
94871c19db8cd1fc8927b04d651ce621c41732763ce02782aca309c540ac4652c37f50c4582026a85608f4850010381af5f3fd7833266b12bdee5142cfc87c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8db3a486354986cd765c90690b768ff9

SHA1
a762f1045fb410222e9b8a036a4bbb6febaa0ec3

SHA256
49188c61f1dd7e490846a69a9319568514bc64e36362b20c1127123beec3d2f2

SHA512
f2a9f0d08f2c74c7b2cf8453d58aff78ce1f1384a5d8f3a6bb65b1d5dd7899e479a9b9dc89936a0aade636547448f514f4e81c0a14cdb6d33982ff7a3c5d3ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7527d6b057252761f072335042ae39b3

SHA1
530412fe99079f01549fd3d1600b550adbeff691

SHA256
08a55f3e078ca83fc229f365d2099dc9c599f218311028274bca67e112d96296

SHA512
a5b1f5319c7d8a0ef6197fadec0d79b83b988877273ae9bceef3b55b7b772bcd7f96aa7740d336cac6d6047c0291e13985d05ee30ce5e23f034fcd88da827c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
afa9b8678bfcc16654c17ef1ed0fa013

SHA1
dd03eafcb1d455ba7d8ce994ad68dac8fe3ce1be

SHA256
8f9690f04b8de93e9f1880d7834f4abc1acff7be4eef038ba7c5ea2848092246

SHA512
423b90f3665977332af40301dd5068480cff2224bce1b8c63e6db26501695fd5008e2a6be098032433709553c211cd327af3a511402fd9c61b21bb7fd296ca5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
82e8eef75947c906736141c5abebb091

SHA1
f8c654d89593d930e7b425ac9a19bea206e0906d

SHA256
f0e077f3cba5ab7cec0aa39e58f44d0b6eb9befd5dd9ecbe7dc817675e66df11

SHA512
7f758e119d06c71a75c1ecacf5b50b6308ff7bc263126e34210ea724fc42995a6e03b4d12ed297063615bfc95862e03c5c95e82b6ce64d7be04d3235010e6103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f2eb.TMP

Filesize
707B

MD5
2f7975b1565a43873fe251c2729d7438

SHA1
7df81e16d00b531e200c306094b4be7d65995506

SHA256
44de13067867ba37230cc519eab99bf0f2e1dc3fc8260acff7d3849deb735a2b

SHA512
19fc32ed1f6e6d03a0edbc33c8651803f5aed8e12fe7e9b127545d9136fa3ae9304bd43bcf107f7ccf59c3df7e6b347734c1a7f7409998e963d7ceedea60f2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b00256febdb9ad947891a66a5fecdb61

SHA1
3ee7099c73e4d2dcd186e604ef1c781a7493954e

SHA256
6084b3cad8aac431f481be1bedb136a9a28d6d0cbaadf7febf836e7fdde392bc

SHA512
eefcad305109cd9a40432ec63a10892c3cc60f13390dab4c3554b82021dde9cb8eb2c4096a124749c598c3e64030bcb35cec407ba1b0787a1ca6aa10763b0ef1

Download Submit
\??\pipe\LOCAL\crashpad_1148_QDLQNGKOWRIXWCSR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit