195e13c4e4862a1298fcaf96092f1a7b0b81b86bc58bfb20f30ab454c200333d

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33b52bea6e4a97338c67f609eb74afc3_JaffaCakes118.html
Size

44KB
MD5

33b52bea6e4a97338c67f609eb74afc3
SHA1

29e08662b9bc2ec3e49fb90bc0380e0b7af5bfc4
SHA256

195e13c4e4862a1298fcaf96092f1a7b0b81b86bc58bfb20f30ab454c200333d
SHA512

fb0de34774c9e457acabacaef4e3bc86f8da0f14c62fddd208542f4db1fbbf1fd7f1e94c635f8d6789e785aa6e7dc4640c0316c6837f29a1aad29a2dd43b206d
SSDEEP

768:fVydVpu7oJLq3qiMVgs3XCOzL/CHsmj8yghDbkv1o8D+HA:fcdq7QW3PMVgsCOzWTj8dSoW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3248	msedge.exe
3248	msedge.exe
4340	identity_helper.exe
4340	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3288	3248	msedge.exe	83
PID 3248 wrote to memory of 3288	3248	msedge.exe	83
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 2652	3248	msedge.exe	84
PID 3248 wrote to memory of 3480	3248	msedge.exe	85
PID 3248 wrote to memory of 3480	3248	msedge.exe	85
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86
PID 3248 wrote to memory of 4416	3248	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\33b52bea6e4a97338c67f609eb74afc3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1424 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16843316887271207695,17392858944349441059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4842771d6eb8d588679506a0d15a8629

SHA1
6521554dff36d4229450a57f5166583f83f0b7a2

SHA256
e0e1e4cba29df5fc01eed967340e5f2ba2f6964184f4e83493595456e6d1fb27

SHA512
711c0ad8069b6d2d5c944b4e0fa1870093e6406f9eed9214110647d7f664a28b75a8d8f8d61d504f8f5d3a6f1f828f111044bb6e8b2f598aedf6f87e9bc48ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
e0dd45fc9e0448c4fcf9106d5e7a862b

SHA1
6ca4c5bdb67f4ef96a1e05f29efc573dbbaff600

SHA256
f1c2afcc538edf763dea88be93e59e1cb92fe9d10e23b467cf944322d53b1770

SHA512
ed60066356cc42fbc3fbd279d129d69c7fb2893083ec67d6b93697bccb0e7878fc9fc6b44350282e83594c83305bb9c6ef60f2f939a47fd4fe660fefea18dd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
506b9e56efe29351d4c9abd224bb1229

SHA1
ce732ceea4675828ca33c0b8294735965aee3abc

SHA256
bec60d7fb7250bdc7d322150cc682bcf5d065a78c232793ea9f496900fd91efe

SHA512
a7072a642742dc081733add4240e46d5ebc4f389b83c04587189b5847cd7a3f98b9f93b4f0ee9f11917faf7cc8a4ae11e801d45b49c2597f7f309cedc75af017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4d9664fb90ccfb4f5f5ae2a8a4041209

SHA1
de55550d23c30779d03d262461ea9599bf4e73f3

SHA256
c119af305b04e28f914a01167342f3886ccd0a62dcc285493ac94503dbdefafe

SHA512
fe3b64608826845cfbdbc1b5bad95b301d740f035466fe431f0e659e8d11d4f568ac873c78287eb4f64341a63e37ce5b2bf9b7f15f424f625eb25453b6773f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1dc22567208f4029e34c7ce2b27a5dd7

SHA1
dcf330d437204d4b5b737e42e05245b56c307ff9

SHA256
d0dd40ce9697041840fe5aa574f2b7426a084442415338c3b549be39f41311f6

SHA512
187e56118fb5eb794a0e6465246c10918c58d7de6a8c6e1db69e02386d96899bb74befe4786e1b3c878502b783fe692f202ec246fcca4a434799e5352ba84ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
babdbff184ea588478ca2683be773716

SHA1
3f06e6e7817662833260070ad53043e445393dea

SHA256
91f3b2b76ed6b246caf8a098dacf2dc20f99ded30b03d82a77e90d62cba06a6d

SHA512
d91aac37373acaf3958fbdcc0f962755035f37be7847149dfb2a6f8ae52cf89b8489299c57bccbb9163db448d0728728f3521ea4db744e704452477945e44786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
177286de1c0341ba13a784815c7240a3

SHA1
41a172bdbcb7c045ee296787718df399e2a124f7

SHA256
6d3f05f0026406376c640871e02efffe84b18bdffc1243f774e27c70b7908ce2

SHA512
e789fd90672823a9b21288b3469a52cfcff9387b4c502f86d390f07d6cbeccf237c55b0d1a0484dfefb7e317fa19e422503fe3f905850980cb1967fbe7391652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7253a09625e756ca36ff7eb631a521c1

SHA1
7130a31225bf7bd83645175ba64079b02cdc94ea

SHA256
9c55f041764d111d5150b13d1116d6f79f188e1c235be0b99a54bdedc30c0a79

SHA512
226e08e45ea311c09fbe477014c043728d0af8b310a7dbceabd0502b9428e31f40dd06077131bdff6fdd2c8edeaf8fa96fbb28df8af27ff81b69f42632bf7b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e98f2329037d89e8be2ce7aa309ee440

SHA1
19db53d8db4984bbc25edaafca048192491755c9

SHA256
2d9916e98a6ecc2ba9c786bf9b81fa19ab01a9515eb3e924ae7d5c53b17b54af

SHA512
ff3127c6e85ed2c64626a8a39de71aa5e10336da91a1a44d17618dcc48375931c781b7a1fbaba0b1d3c9edd7e04167b367e152cd932d9c07d04480f8c08e7e79

Download Submit
\??\pipe\LOCAL\crashpad_3248_UTTMBSOYZZPDXHYI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit