dad7b3e97b7dbc01abc7c4c771b9150062c85d5247bde077d0ddb9b602115431

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7350f58e4d704931f902a8778bccf79f_JaffaCakes118.html
Size

808B
MD5

7350f58e4d704931f902a8778bccf79f
SHA1

6733738b787a9612d4dd7abfa6caaf2ee07ba6ab
SHA256

dad7b3e97b7dbc01abc7c4c771b9150062c85d5247bde077d0ddb9b602115431
SHA512

77c82cb5418c24f7fee73d5a2fd6a5a153f35662e032ab6a6b5cb8c48b37ad99d120fd9601f3cc95fad148be7a9742bd646c833ea3d3ee1986ab2a0a240f6edd

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

9 http://btc2016.atw.hu/index.php?welcome

flow	ioc
9	http://btc2016.atw.hu/index.php?welcome

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
968	msedge.exe
968	msedge.exe
1884	msedge.exe
1884	msedge.exe
60	identity_helper.exe
60	identity_helper.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1884 wrote to memory of 3572	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 3572	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 1624	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 968	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 968	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe
PID 1884 wrote to memory of 2372	1884	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7350f58e4d704931f902a8778bccf79f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
2⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
2⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
2⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
2⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
2⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
2⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
2⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6936 /prefetch:8
2⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6936 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
2⤵
PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
2⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14723286686343500629,2948634311686072991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6204 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
624B

MD5
82c8999e699efd8d05130a42800256d8

SHA1
31fdeebcd39b602c6c733c4176c094db210b913b

SHA256
12c26b181d41ec126c6af3d4ce769dcd84c0941960baac228ffec0cf68ad9389

SHA512
d00bc3a8717c92746eea4df09c2dca39d3dc29791a59f90b979fa6528a0e5b53219b8eff4f1076758272d79ec517bf87fd38df88e2c7e9c110b0e5245a01eb8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
b7511ca56ba5a4c2840522477a58144f

SHA1
1dc6ff32bff0570d3f63259ceb6232257a5132fb

SHA256
ab896e79fb5e366f5f72e3eaecbe0551fc718bbc6d9e01427f4118f7f250eaeb

SHA512
c7cc98962c70fbd5e0c22b809d699b06a8f439a40fdaa03ed10fe1b4f259feb2d082fbc3f5cd453f9341215cc6664f7a7ccb36d4d9e829e0b55d2a5ded2c3764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4dac13c37d3fb07025ca64179b106b38

SHA1
122203a023946c863d87aeadd43e8b45528f0673

SHA256
db5c62974a5695b3dac7f39fee94f02ab4635b90284fe60e1b47dba04d376542

SHA512
29d0969ae3a67f241b5e2732c789d9cfba0bbf61e2b9f9d05b6f8f6a9c1f321049864ed2d68fb50aba2cea232caec522aa32b4265ca55b15a174f23d18c1313f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
cc6e5b68812ad3a89d23f2ac7dc0cee1

SHA1
cfe2918a7b523f254fa4895a3ca29e055ed1ed14

SHA256
37845f4eb25ca0809448ae556565478cb445dc1060060971823800767f8aaf45

SHA512
c70429049673774a7e955c3eb7bafe8bae1da48dd0bca742a7d3b5dd895cded7d28e292ece7b0590d441c374cf5287a54fca5ff2b3124510a2e1d08d4b051806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
4e3b2addd06166a7703698572f0c7d85

SHA1
d86398ef2f80e0f4751093ded29920605d8661aa

SHA256
e3ee3ea2df47d8f606be071fa439723049746572ff0c11b2dba2bffbb9ec6038

SHA512
5c16c1c199ebdfe22f80be085b3c70fb4617be1266371c189613ca10870f57967dc885b5bc9d464dbbc64b8cf45ec453459363e1587d353c9f77fbdc6130d7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
cda2e0b488abc088b4259cea8e852660

SHA1
81093b6cb31b32e75b5373c5669b6f9bec6fe8c4

SHA256
284901faf1c943d6a1761e77ae200d5781f7a660987456527ffb9715d7956ad8

SHA512
50e52706ca0e5da3bfed3e2df7ce6c1b2bfc1f4e15a2990cd6c4f091def1b81295cb89a2cc6a7220150515d297d87ed66db638a7838df1c21fe6f6e77ff0a46e

Download Submit
\??\pipe\LOCAL\crashpad_1884_ONULVIOEWNGFUQMT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit