3ace9942ea907cedc7cd04d98e3a16572e28ecfd8682377784900ba4ba29c140

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ae90987c2c1a0530fb2185ec16e444_JaffaCakes118.html
Size

89KB
MD5

63ae90987c2c1a0530fb2185ec16e444
SHA1

a6362b1304bae6ff920833ce4865d825d1857898
SHA256

3ace9942ea907cedc7cd04d98e3a16572e28ecfd8682377784900ba4ba29c140
SHA512

133c163438a660df96768de7da0ace3d6f632cd2d01f9ac865c5e9b3432d8cfe127021e851469ad8d0a3cb8fa19c1031185842dc4a88a541cf6b8dbcf89a07f5
SSDEEP

1536:gcTya5CWpwHZvDwHFVJwH3FuwHTIlwHo6IwHithwHe2qwHvmMwH/MOwH2FywHrt7:gcTySCWpwHZvDwHFVJwH3FuwHTIlwHoN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{18064020-C74C-40CC-8F81-D320648610AE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4652	msedge.exe
4652	msedge.exe
2760	msedge.exe
2760	msedge.exe
3736	msedge.exe
3736	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3668	identity_helper.exe
3668	identity_helper.exe

Suspicious behavior: LoadsDriver 8 IoCs

Processes:

pid process

656
656
656
656
656
656
656
656
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2760 msedge.exe
2760 msedge.exe
2760 msedge.exe
2760 msedge.exe
2760 msedge.exe
2760 msedge.exe
2760 msedge.exe

pid	process
656
656
656
656
656
656
656
656

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2760 wrote to memory of 2800	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 2800	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4192	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4652	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 4652	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe
PID 2760 wrote to memory of 3292	2760	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63ae90987c2c1a0530fb2185ec16e444_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc114846f8,0x7ffc11484708,0x7ffc11484718
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8120291607522010739,15569000754143487865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
579918c3c9fce834a9cce807a57186ff

SHA1
8a29bb47e5e9d0f9df4b6601535c0ee532e7cc4c

SHA256
2ee926d7c14d2f2a7b32ae357b723009157b1a3c6b364f97cccfc3706a2f10d9

SHA512
bb3859c1c13bbd112c14bb2d65687008ac386a6458d1e2dd650fcaeb83ccb3a39f84939d04d3432298d670a28209ac9c4f3a631d979bd12f03df094224c349b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
7446b1c4bb476747fdb5b2c56b2e409f

SHA1
7eb5e4e2f082d2ff46eb593b1c943bca7e2ecb43

SHA256
61dcb30a6e48badf9b92aa132084ba2e6d71d990053e97b530dd184eae22d1f6

SHA512
ea673db8de9815909971d51b8bb9091f02e8d729ff8a73bd27f8e57f06a4ab28ffc42e8824e0f5c3c3516218d85e77b0dc2dda600afe939ae61b94b508e8f524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
174B

MD5
bee92706dae6da257505d1a88bde30a4

SHA1
0a4b4e856594718f8c9059f0c70228b1bdd60243

SHA256
4783eae0c3cb7533e572dc2f1ad3e877eb07bac6977fddfdee407e1ae8f67ca9

SHA512
0716eed89d04efdb0b0674d6ec5ee80b8480e6e1543ed5c9ed52cbac939a8ca61fc1ffceb9cd26640a1d441efba962e54e17e20a6acf83a09ac7812d30905efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
978B

MD5
9bb5092d8ad4c462088640cc0ceaf7a6

SHA1
03e99b5ed7ad069da37ee89eeb54395a06120405

SHA256
9d891741c7ff8ed758b853f6c063dbc92bfdc3fa1df47210999ab5e581166d2e

SHA512
2a315cb640edcf16df301c739297f2a0ebe88e10865b83c7f758a2590c8af891c919f5679e0b2de914812d967849b18a310892a5e2d00628a66d0d24020027a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54d20b4d332b31e6846aaffc09a33e8d

SHA1
9a7f5c6325e683fc1b45203295913fee81dcce5f

SHA256
8f459dc21315e7556c36725081323ce02e4bfd6891758aa50c39b338191b9f4a

SHA512
cda601296cc94e8175c311386fb3c014f45176611e84b39bf113c552d6a0795b2d9242db23013e0e2ef8a5e174c303cd9cca38624485ab51fb9a0bcdfc5e1dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7e949e7e48e6f9fbebc2925056a8a1e

SHA1
df0f62077c33f52ace7164310e2f75ff0cfdadab

SHA256
2ba546ad5e27a9cc8cdea005f85f38bb5b064cec925a7a01d589d2a4a3051c59

SHA512
2829f5c1f8e32e4602a321e0ef08519edc6a69f90801b0f6e0b4215b4ad410f4305eedc64747393d801c9b11c7453852d48ccfbc4227f2cbe2a08c0c9932b300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1b7f1fc198dc3eb71f2b76151289bad4

SHA1
35b7def075fcb397a06d028a4388b40ce46845f1

SHA256
9f0610cf383bd1239b8381e207eaf7a0fc6e0656bd7cbee06fb849931483fa9a

SHA512
f42007e90ead30585d2457b03747fc094afd91daa34d9eef5ada975d5b3e51b12772e0773f71742cb9e2a8919d7282cfa4f4912ed5e1a34facb7773462cb1c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2bc7919ed66813c10e47fe45b8521ac8

SHA1
bf65f25b211ff537d12ab1eb88b6283681dbd876

SHA256
e2d3fcfb7a63b3914a932d3d4268605a84c037032897e0008a0a11e398cf4684

SHA512
f3278afee28f80d095f05ce21525e8c62b99412a7b3fdd6154fcf9a06e0074e1a9bb9cd2c0b046a55296ecc4d57375f7aa15fd9dec8b9accfc641bba9b026ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
701e3f8b8c22bb4cb107c8c59ce4b96a

SHA1
3eb70f5d66634df6e35207adf32b1a326a3f7760

SHA256
1f3187d97003b28fa4ce175ad222d09eab421d603040a2e21b05488cbb4e1455

SHA512
05ba613de3fa945fdb0474dd0a4ad6b0fae949dfe7cec53b054535d178762832962d9bfc61e5cf1f239d0ac21fb5a7a419f064714ee14f99e6c87dd5344a03a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c8ff6e1a806be7189bbeba9a0d4e8e9

SHA1
3f6572a8c6b443d5ee19403669ac3df7099c62ca

SHA256
7d53724d8375bd581dcb76b1b299bb972fb83396bfc9d5968ed99bffa5d20c4d

SHA512
63206d01c98a189c432250e9c15474d80417946aef80ed451c6c4a8f208109876f5c92ce18e86d8d7e2492198531a06cc63b2ec598f055f5f7e295061296b30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a9f7.TMP

Filesize
204B

MD5
69db52fad3981c2e3bcbb3cb9926c99e

SHA1
5616da45b194aede08480d1e4872a22be2a5dd0b

SHA256
7d2fe371f31be80f0a6a765d8f0c34980f51e598532cac7ce566e098ae27ff87

SHA512
1a0c87644a4894157672e75778fd0879eebcf0c37cd2688cce2382ed23f95054b4086572cb0b22432ff64e5a1c837868a630b57a51a6ce129a21513c6ce41a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d838e2ea713b6a989b8ee593240683b

SHA1
f4c87969c0c0d47f0077f5037b8c67cfaa709736

SHA256
0f6573d37408a05fb180bc2dd34be03c812b17f9db14a7d527b4ad35ed6219c5

SHA512
a20fd208e68c42ba271f76d63772bdc258aca6f9602be7b33da6933e5759d94720eaf271fc7d837173c82f7d2e4c6671042ec53bd39ab067ade205db22ac874d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_2760_TOVDKZPLAFXDNQBY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit