cb174e45822f678228ee30e6e17f2c7cf95743f4685e8bc2489a4bef24e996d0

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42db40cd41fc5885dc62886c1e81f2b9_JaffaCakes118.html
Size

137KB
MD5

42db40cd41fc5885dc62886c1e81f2b9
SHA1

65fb07c286d0e40ae8b351b825c2665e8ee3cb75
SHA256

cb174e45822f678228ee30e6e17f2c7cf95743f4685e8bc2489a4bef24e996d0
SHA512

f590b2d231eb507214407a88fd5303c26d577172ad302c86111c4f792b68e007ccd8c6e558ee66aacc5246f4c5e5a840b932e6304c2baa63c55d9bfacb271751
SSDEEP

3072:8KnmfnwpCeFnkKcUVnzK9x8TXyMfEV9ZINo:Ufnwph9ksnqODnS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3636	msedge.exe
3636	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2324	3636	msedge.exe	84
PID 3636 wrote to memory of 2324	3636	msedge.exe	84
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 4664	3636	msedge.exe	85
PID 3636 wrote to memory of 3928	3636	msedge.exe	86
PID 3636 wrote to memory of 3928	3636	msedge.exe	86
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87
PID 3636 wrote to memory of 5092	3636	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\42db40cd41fc5885dc62886c1e81f2b9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e7f46f8,0x7ffa1e7f4708,0x7ffa1e7f4718
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,35524282800782121,12512065704068894721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c2ba996-2726-4ddb-be09-83795a047434.tmp

Filesize
3KB

MD5
1c634cd74e7979fc5277f12593bdd69c

SHA1
6996f3844700e4bb63e3e3beb690d6485eaf370e

SHA256
b09a462747ecb42a8eaaa04c9297e6bec6dfe9c4026ad60ec50d905988a5d45a

SHA512
13356158fd22cf118edd08367c85c9a4f2d6694e55361cbb7a875120813f616bbce5c3d43e9431f7e6a2070d555b5b560d17e306a32a69f4ec2f4388b1cdde88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
32KB

MD5
21fa9f94e6db3dc9d82763e327051778

SHA1
474d7a655ce663bf5fb8c38bcd2e1858a02716da

SHA256
b2af0c5afbb5e3506142f095fcffa34cbdb966531c3ba26c90e6967768f15223

SHA512
f96574ec8edb333b194b3cfdbbc6c07f10202da9c8b5d1de928ee894b24f2bc33d3edce14b1e21e9e9cdce3b684e0dcd675e4bb2cbed9b0d5d2d25bc6b253ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9b1445398559fe6f13eea2def3981565

SHA1
dd72485d49ea5600ae1be40c04256efe7a718542

SHA256
e2f8126b7e5ab6c7b582b02a012b723d82f777b20367377142f7498f4bf7949f

SHA512
72b1cdb9e384413bf5852774d27bfcfce6bd815544f58e5c28be70ebf6d9a593cad89c0a4d33be15cfcaee06baa4be17d077be9ecb1a68a2b86310eb44a24aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5206071ac3d6c2c47b67571c2291e050

SHA1
6983bcb801bdf29bd76fd5cac1a3ffa259448bce

SHA256
6fb6fb666b8bd219e94cb54c7b4ebb305bc86c73f1263d67bd7554e0c907eb87

SHA512
c19f258feab71ca1b5b150b6e152439b4c2c81fa7b99a822879a7162d9aa8cc6f77300337690d8a9d3760be5de2f5c6fcac2beed2ec9229f868b66830a5e99d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f13deedc4c6ce856c7bef41c48cf1b01

SHA1
1277e7cbdc6b719b34a052de84731dc8e8df66f5

SHA256
3b30c30051322e7e0301699b86ed48a14bc348bfb3f531ff10da2df36a516dff

SHA512
6d4921edc6421cce8956569fe52d42371d186dbebe48ef955c380988430cf125de4667a493391f2d057976a6d0ff733b0ee9702936fe9c3f32ee64d9a15e0ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0962da2af2c6a774b618b1f1abfef72d

SHA1
e12f0a10cc899b61b9792ee1a9a26a764c3a46c6

SHA256
3c2a9a01601a610cba23df7d6e11beff225bf26273013e027fdb052013eedd2f

SHA512
be41ec80295bba9347fc1149c2f6da1561c8b20ea006e6be137c562e58772b308b608d35e65faa30c32ecc4b0b910df142779672e1964f2f28b918b322e407aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e753abbc08833b08951e02101e165b12

SHA1
a7f9d592bf583323244e835d22fdff8d7e510271

SHA256
14370d26dc36c9e6e8abd23d00b279894b947db61353a9ab58dabafb3a37ff36

SHA512
8a96b41f4798527aced1d757a5071093b59804dff4bb6bd36d5173d03cb72c99b16878c57defd4d7868b158eb94e7aadb24aab4610716be56bdab56739b82b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
6976e18656ebfed86146d6aa529a3522

SHA1
3d269b3618b51c358399ed440de029f03507e661

SHA256
07b0486d960b6b0af49c83343ce2e832ec0908a5513ac95e1665bcc959fe5330

SHA512
c62ea3fb94e975998a2c33b4a031ed94ae02e3d327ec0751acc1f3975d97d623bb95abfb79396dab2a7cb4fdd6a8964d13bd4711f04c67cc64e24d1a4b19c748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e73afa676fcaf7426b7c6aa28126b18

SHA1
80e71748cb6f09704bc2f1bdf4311d820c799f5c

SHA256
9ef3fbb56c63e3291add1e73dc5d9b5615e8208cb612f15ec5381f97ff292e63

SHA512
d24b79fd53fa0f5718ccaefcd26790079ab0eafe1d3ebd271aa3ba1ac95858bf15be04143e9dffb28e1a8403cbcea35a1d2b64cb87aaa73bc6568dd4fce7653b

Download Submit
\??\pipe\LOCAL\crashpad_3636_RKJIYWGRBRWPPZON

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit