0a23c8daaf7d5a7395cfb881f30b2a4951b5ae0847b22febce6c61617647609b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004169ba6bc63947a1dc99b96c42e32c_JaffaCakes118.html
Size

37KB
MD5

004169ba6bc63947a1dc99b96c42e32c
SHA1

19366b21cfd5d45954ac59463fdeb607cf82a958
SHA256

0a23c8daaf7d5a7395cfb881f30b2a4951b5ae0847b22febce6c61617647609b
SHA512

a5e6d28273d5b3aa71593f520db33c84f9976ddc5087afa9d40d3f5780634ad679a1bea88c1fabe88b2abe8fa13837005c16536cd56d0dbb6d565b3532b25802
SSDEEP

768:SPM0UkxHjVnma9euHzXKv9I4r9/bG6T0h:SPM0UEHZnv9eMXMCI9/bG6T+

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

43 http://internet.e-mail

flow	ioc
43	http://internet.e-mail

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3456	msedge.exe
3456	msedge.exe
3656	msedge.exe
3656	msedge.exe
1264	identity_helper.exe
1264	identity_helper.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3656 wrote to memory of 4860	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4860	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 4172	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 3456	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 3456	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe
PID 3656 wrote to memory of 2700	3656	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\004169ba6bc63947a1dc99b96c42e32c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa025546f8,0x7ffa02554708,0x7ffa02554718
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
2⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
2⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
2⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
2⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2284878427004069413,18235656686565730284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6476 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
1329181395899e41703e867490263dbb

SHA1
4876b9f6ade6e716d5bfc55e49fc3dde399823f0

SHA256
2eee084d522fc16d51914a936f01e681dfd2ce2b9a6dc155decbf155e29dee7a

SHA512
1c61ee27d91db06d8b0284a57b9bc4de463ba6e15c283d6730f5ecd040352ffdca3254237d5ba59cd249bf9614ec0c74d4a0ed07a2350c690415bdede14c1873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
988KB

MD5
70ecb45acd650a35ffbae201fec9b77f

SHA1
8e1d546eb567a86b5a389e8f3c74b9c84d6464bf

SHA256
a75b46a1b094c74bfc9a5aee46a1a145506c88db5be19a3bee8f5c293982e080

SHA512
ce33cc0905c9f124612fdc120d57540da4724bf1a1fc1fc2bb79b6cdaff3a1d252731fa0b3c002f2a00324738dbbff8dfa55459b0d2c532fc50d3d6bd7236f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
1888d3126b629f1cd445c40430717a55

SHA1
5d8e9387102fa613746c82b7911d62834d7763bc

SHA256
ccd1e96c0b96ee5a2471ceaf91f19459126a5142de125b5aaec173139c78dd1a

SHA512
f22f6139cebe8fe774a1555f1617328300d4cdd2bffafeb0b09e5c454cb99c80cf10e06dec3307e9b52f457fc1011dcf4ff7c1933d54229e1a9f7d961574a663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
642B

MD5
b7f57f1f157feb32d72057c303e16daf

SHA1
39f71d3e63023cab77d4dfcc44bc07bc68ac1166

SHA256
15adf77df9a152303792aa0486d50fddadf411e926ceda14462d2e695801d491

SHA512
2c1aa34bbb2e7e9672c1196a5182568ce1465b460a598a5724ea2c9711e4b255ca54d5fd748b9c84c40fc6105165de5362a55c2a335668f2af79b287a6535870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
786b82d7d872b75b41c12cc3e9df721f

SHA1
f6aec3e9470662a68df3a3bef81f4ddd7375b4a3

SHA256
3d9cb7491e6968a61c82faf921bd5990ebb3f67d8230e45e8e3baf416ac0c939

SHA512
cfc3cee70ae3baa2828093b3d768a2b95ac599c68ca308b611f433e59d8c76a203b7473b4b447925d63aa5b80ef9e9509f4d637384cf35007a1625edd0054517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fedcc394092ead6c3b5a2fa2f60398ee

SHA1
221a44c9f1bb5530c013c3bded3a3eef56802373

SHA256
3aec28bd72fca8580428f7d2569bf630d8eff6f1410ea05bce97b26243795202

SHA512
1d98b8a2598f6639672e26ef5c017d96c4be5820556691dba4af3f500449374f138d8a01df568374e04b7822935e303736f837b88d9484a9145512d58644a19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
706B

MD5
75b7073fcbaf0c3d70a9f3df32fe89d9

SHA1
9eb746e07d74c925749c4fbd55ba6566a377f6a2

SHA256
dd5b177ba05992e86f9064e0fd5799016cdf1fb67f440d9a2f00ffb054db330a

SHA512
b39636d17593a704e4b0761281e28e4a04f0b2414561c166f581e65fe2f9647a538966ce6ec5a4b53fa173ef8e111af8911bbfc3b239e6bc190527b3358eeb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e8ba.TMP
Filesize
538B

MD5
51f276c4331b6eba7df53e3136e3ca64

SHA1
ae2ad1470ecf9f9dd966d67586d207a2bcf9d222

SHA256
b6940f4ef7f54fb904309891f570a8bda61ef201bd0d6118005af44d648a1331

SHA512
146e4c012b457b3fb6fce9247a5315d6372217cc9d4eff028cd0459244a116b5cdcee228606f024664c81d4798eaf9ac72d761df059443eb5b4c272e8dd843bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a053a2711af93d644a2c8f932ac59e2c

SHA1
975ed87456600cecba216c7e4a80a0265ecce77d

SHA256
7bfd81dc304bcfe8f9866f713af91a5075dfd4a242bf301099f64233a4e6b0bb

SHA512
dec61c2875d2859083625ac4f9125e9d647ef0917564e387c56ea2b5b9f5c55a1e2e186e46a50f26ae0b75a55d7a4b701ecdb454f48b5d40675c8af61aea9e38

Download Submit
\??\pipe\LOCAL\crashpad_3656_XZTICEZILLURCXLU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit