fd32432ab0103da7e2455a6a7f3453de9509e5532f16de0e213bc01519781d5e

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c0a0d15c789b39ce5ebda6f632bebf2_JaffaCakes118.html
Size

41KB
MD5

6c0a0d15c789b39ce5ebda6f632bebf2
SHA1

32c14a7727f5988bfab8503388ed1dcf36fccc4d
SHA256

fd32432ab0103da7e2455a6a7f3453de9509e5532f16de0e213bc01519781d5e
SHA512

668af340da134cbdcd88fd3ca07646502723a7b18eb9adada68eeba063000816399b49984e83a168360bec5b2a71ab1265e19f8c482ea4f099dffd061ca9aaa3
SSDEEP

768:7bUDC7wFUeBq7f7H8fpM9LqqIXfhoeRY2sngcQcaa+nGtXFU5I5:fWURf7wYbIpLY4c5+GZF6s

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

72 http://btc2016.atw.hu/index.php?welcome

flow	ioc
72	http://btc2016.atw.hu/index.php?welcome

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
684	msedge.exe
684	msedge.exe
3568	msedge.exe
3568	msedge.exe
540	identity_helper.exe
540	identity_helper.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3568 wrote to memory of 4944	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4944	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2320	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 684	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 684	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 4456	3568	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c0a0d15c789b39ce5ebda6f632bebf2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a4f46f8,0x7fff5a4f4708,0x7fff5a4f4718
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
2⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
2⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3209473501604768961,16912452830668529020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1328 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
01292fc4444e8b5a6014834451dba3af

SHA1
5df2e7948e35d852044f3f1b4602fa084af380d5

SHA256
d256e3af041305d189fe56736a38da2cb9317a3b6444025985f74ba7624be050

SHA512
e3673e3c249ad67dca9cc29edecedc75b45ebc54910a6063652ec8b8dcfa00f4e010d5bcc3c661b10de167294737ed321fb163fa613e5f4edcc1054a7c05355a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
bfa3b117541bed9ab887197e9723d84d

SHA1
e7b659d50d8d375d7dcc33a693c7e4ecc39b84e7

SHA256
5bfa54c6833ccb26e4f01ad24f587de45e77aafecc134a78f72499e3b44a8eff

SHA512
44dea9e32a6b3c872e9492439b808057cea4580fe942ab364bff7a534fc10dc7d5907b22576b7e035076cdda6ef86675102a4ed519f67bea2cf6aca16c461cd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c575cbe2b9de91a3d4d3620218a29407

SHA1
b36af5956686c0ff7efd0c6e0427ab059e695e24

SHA256
7318141df592dd4184329ad2a9649ce0896291f27cc0aab8887e7f999a2f0bc7

SHA512
3112f3c5951b8e4b1a75ac579df35463f370f6977d69205f95cf85ed97cd54c090e0c2f7caf9f3a0b02cb61a7b78bb881cd5aeb4bd96ceea686c8c440a4e870f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
aaa133e72ef3a5dbf0be578e389469eb

SHA1
967f01fa5ee57b3310443bf36e418c934dcd8917

SHA256
063941a27ea8b221aa0a17c976ffd4a1e487f85e0128003e1f766e81c9b79ee7

SHA512
1abeb009f9d95f5ec54c0a818286bda1fd6e9886566830ecb6592672505ab3c14acaa0d33e4716715859094737fed711dc994e1569e1443cbbf0b6f23c4ee8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
761beb9e3194ff2a9c86d3008670303c

SHA1
67f36d1c2fd2e46665c2a904ef1d3d65a2ca1cee

SHA256
f58cdb78099873325e1e0849576f89d67c219f4972a201582ed822a1560934d9

SHA512
79bba0a6c40a3e6c9beb1cd5ce36f3380592c3ad59a8563667aeefb856e5b43e8f70d23c42c7c4fda56f59bb942a0045952dca06d306aa28d1cb92566510bf6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
65a5708e8d1ee3ff818139a300e60253

SHA1
c5c3cc77f733fd3da5d209ca23d04d3e81650613

SHA256
52d761bcfd7cc13473c9d962b0b92a617a8ee5737da7eaa2f98e7f591a2ca293

SHA512
3224feed1020bb04b5aba7810202e1efb955eed7e49abeee192e3e3fc61d0271afafa16be24b7f73a79c32735c698698c2ad46ad2187751ed2f2e825e2383c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4eb57f63eca16be69a49105db86d7df5

SHA1
d47ca6ddf7955e85806f6929379031026a15c22d

SHA256
e2ec5ec37504c81e932c5aaf793353bacc94e723e810e07de00ae86e4479c050

SHA512
8101e0522b864b6a11d24282b8f405413557ec734e5b4523a95c6276f2cb43e9f233e81a8172210cb316709bfa6bd2ba753d711e5c5c7c1a8e156f9bf776ae37

Download Submit
\??\pipe\LOCAL\crashpad_3568_LBFDYDNUDEMWHRLT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit