5ea06a37d8e5f5f31661809ee5e9dd315d23205612ec15777a3c2db4c618414e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e3e8be7c11be46dbc01837a5f538d7b_JaffaCakes118.html
Size

40KB
MD5

9e3e8be7c11be46dbc01837a5f538d7b
SHA1

2ef4b1603f08970518cb1dba8ddd7180b2c3ff9e
SHA256

5ea06a37d8e5f5f31661809ee5e9dd315d23205612ec15777a3c2db4c618414e
SHA512

9abc17a5f92aaae2ffe485fc52269094a1f3b3c3d68b48c431ab4c23e30ea61a0d2d35f7a047d9b71748f5fd43c84938569a3ab99d897a96fbce5564e2a2d3cb
SSDEEP

768:zbUDC7wFUeBq7f7g8fpM9Lqqm/RCea8zwZprvgrh29vDTiuCtLRMwU5IJ:nWURf7bYbm/TrzWprYuCtF/64

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

55 http://btc2016.atw.hu/index.php?welcome

flow	ioc
55	http://btc2016.atw.hu/index.php?welcome

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1016	msedge.exe
1016	msedge.exe
2908	msedge.exe
2908	msedge.exe
4568	identity_helper.exe
4568	identity_helper.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2908 wrote to memory of 2936	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 2936	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1176	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1016	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 1016	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe
PID 2908 wrote to memory of 744	2908	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9e3e8be7c11be46dbc01837a5f538d7b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb633a46f8,0x7ffb633a4708,0x7ffb633a4718
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
2⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
2⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
2⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
2⤵
PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
2⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,9292745763117818132,8721050427566079801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5540 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Filesize
202KB

MD5
6a16cbefd2e29c459297b7ccc8d366ad

SHA1
40da0213a9e5ea4cb6948f4a8e92b5e8b97e6cfe

SHA256
9462da5aa6e2a762b02a24b7305bac86349e5b5ea182d36fd6a163de550cde60

SHA512
6a9de0231f9987554a20208a89c6c802d28c57ecb6f9e95771c94156b65c61ac1e18298ce6d3f0559d3a08052845cc2014dab335e119fde731d745e4857b7d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
97abdb1f7bf2d2d06c786db0d78b66d0

SHA1
7bd40904122fbe8a7083192eacbf5b8a8405ae57

SHA256
9d1d7e05e19a231e1d355a098192097c4d3c8462548633f6ae424d1d50f91500

SHA512
a02a507675703b3b7033cfe0125185e2483fbda6429ab50ce3a3fd5ea750e3518830640a19815f92b064998a9efa164825490e5a78b78c1e150aac8ffd84edb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
f70af579f5e71efe9a7cccee7bcecf3c

SHA1
2e2df779d1d8534552cad941bd5b2d98038509d2

SHA256
d3657b28c00939a03d564790907e8a71187cc26147aac1c4f3741de9acb7389f

SHA512
274556d4c603cad0a1bf07b6cbcfcb4fbb5032ce320c74bad8130d8cf022644fe2d33035a51720c0e79c7b798c5898abdbb6934a32b0dee53e9ce99fb67d3224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
91e844bf0c0c00c47aa329e6f3b50179

SHA1
1ee2921a7d7b27ab1c487fa391843ed3bb220e4f

SHA256
ecb484bdff5479b8591d778748efbc78f5749fdc1cd526ef98ffde1a51d8462d

SHA512
c71ce1e05282db19d1e1574112f4e3ac18a170a1f829efdfdf5f7747d5416f233c090eb60161e2a2033a26d10666f279d58c217e55341e95ae55d495b20b6ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b7b5bc6136d87ee8681a4c7eb3796feb

SHA1
53cedb468c4b66de321906f42b87bead7ce7e8f5

SHA256
0ad58541190ef2f26b14951d1fe35c5887533846178cda1b128f2aeb1d350d51

SHA512
ba7500d71409964c6bfe9fd820f0aedf23fd99bf737c8be44ac1eec6b3ba2ef87659f987014b62d3209a745bf2a4d351b34aeebe40bd7fc7e509e2be09caebaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b7cae19e118badb1ad67d523bf9c8ea2

SHA1
d3f854086f1b66fd31b325b98955c6ff44c353cf

SHA256
8b7e1671884b6b94ad9e593c3010498d86143c681b266a5bdd4a262d669f0109

SHA512
01363bf0f8880051100ba12cfeaa6cdaa64bda0eebf497bb3b430379a191e5bf35fcbba6b47bb97272897e07cda90c375caf3da232b91f100c6bd203f8018942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
020bb07caeac88ad511cf754f5b17a54

SHA1
d9ecf54c7a673cc04dfab8adeb3c94846b6e9bde

SHA256
02b4b95988a01b6c07326d4f6ee903fb7622691d4395cfd27183cdc9489e6f69

SHA512
33632c75bbf680c2f24dfc8df9a22228f9319f2595c2131e0ecfe36049c92c263c016f701fbb63fe9adee8713f05a0f65c4c2f68b7a1efe91e8c336b0185d7df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
7ab11470360c0a973b56777f6818c297

SHA1
c428b93532076e723f40e3c2a23e856a5275ee4e

SHA256
c751d3a10ca270894b9dedc1bfed5ed85a1eaffc22bf7f8f969f517f152e01af

SHA512
d97ef19e0c591fad6ae07c48dd3eb47af17c9d0f69c64fad0104606a023645e35ca74fe456094d84ead01f074a77f57a4526b490e8d8d77ef2aae689bac36410

Download Submit
\??\pipe\LOCAL\crashpad_2908_EPXWFOSGPZOAHYCK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit