a7a9dfd4343a3f67caa2dc8dbaa26d4fd7c176b0534d27529e7f7c9c2b4c5c6a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

639475fec67484e7d0c2898914da338f_JaffaCakes118.html
Size

39KB
MD5

639475fec67484e7d0c2898914da338f
SHA1

6cc90f288d152721b3112a4556aeecde63662344
SHA256

a7a9dfd4343a3f67caa2dc8dbaa26d4fd7c176b0534d27529e7f7c9c2b4c5c6a
SHA512

06e32e405cb458ea7c337796c8017f16d69deb418602b83a2f9d372a2aa42d4132ab0dab2b3c11b76d58f1a7a53edd0773ea6401e7333e4aaf74bd76f2d9fe70
SSDEEP

768:CQoYw9UFK6MpPqw1E8yjWwxMZMSzR7jGru6:CQoYw9UFK6iUSwxgfR2u6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2384	msedge.exe
2384	msedge.exe
1148	msedge.exe
1148	msedge.exe
2064	identity_helper.exe
2064	identity_helper.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1148 wrote to memory of 2984	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2984	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 4516	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2384	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2384	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2652	1148	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\639475fec67484e7d0c2898914da338f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dd7f46f8,0x7ff8dd7f4708,0x7ff8dd7f4718
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,13618768166292726994,9132091438932140557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
120B

MD5
24cfdac4a23740f61345f6cf238e2a5e

SHA1
5fc537481dd58ebe9fdc9b2a28c28e77140c87f4

SHA256
2fa749db94fbc17d6ccc88b0cbfcfef8cfc6059f14369a2e551081f385b60b2a

SHA512
1247b3d3d8819d5605578c785a4ea73eed19b33963dea2205c839be56fedecbba19c9a2874c82c6e33053c119aa9c3fd6c5f107ec2e565fa2f7ff007f770a534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
0867c05c3217250947faa8a26e34f64e

SHA1
728384b8c2925c5127ae181aab5a387a0517cc59

SHA256
806b2865489dce0ad172d0fb3fff7f140183db7adbf59e647bdef97725c52869

SHA512
49efa80574258b11fdbd3b408012948f4384a7291ef5c45a0d5f09fefcb1bd9d370b42d203a12de96def284552b9945471e8e21080b00ecf76606f0f03b99853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e33802c144d0e26a8d8c9dac4016f6c0

SHA1
d5526e061b525cb8627142091435ccbe6b0bb8cf

SHA256
b7335c387ad797326e481824eea7674ec0ff2dc724123e708b29be54928f167a

SHA512
8b61e90063e2b28df58170226967ccf49322f8f30f8ef2de164c825bf3f8c5de1fe3d8c4f3691d4ca88dabd021ccc2d539a32d316b80b9d176dca1e6e5116fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3af4910a20be62bafe9acdc5da65d8cb

SHA1
a9e220c6c3b14969c0a54a91b71adcbe08d11fad

SHA256
0c59c02d3e0976b329d85244d4e0875a22025c13b8de32fdfffb8036a15cfa17

SHA512
0786d9a863cd5ff7917c5af1fd5af08337e3d8fbde96309b69dfd43bdf8d4a2dee60001ff9e83b12abc12ca9f70b451a1de4d1e8333ac81aaeca12ffb904b84a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bc1581ae6dbb5c4e8e90147e7ecea14

SHA1
56887e01c0f606795870f2b9f00f9859045399b5

SHA256
bd30fe9c29ec1a0dd9ab602980578efce567acaba8f3f464494edb91f1f2e0af

SHA512
40a97794b6d94f078ddd5ebe52a83b0a9403493c4f7fd8d1ec1077a2820853bda485a29ee6239276e2d264f58ab1d9d75dda94926dd4b53025c0d04dccaf8483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a636904c48d33dfee60497e0e5658b0

SHA1
53b896d26037a4eb7ab96282c6bdf55a6a0e7aff

SHA256
efa73ada87b4e6ba0dead2699659843f83050fee54f3f379f9201d77fd90b50d

SHA512
5046c41f3ee7f199806eeb321fe02f0b5087d83f7657b7cbacd69baa58401cac8716861a9595b6acf36d9d169e2e6e913a10fb6c10e8877f6162444ad0d18de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a12a26a4b730dbb73ca07be8f3ece7fb

SHA1
2953a5f96131c56538c2dfc17c2cb33127589596

SHA256
0e97f184c0bfac2a7265f9ad215076d466d19cc87c7f786bbe478c81fce1df0a

SHA512
85504c8afd5db481b544d24ac534ea4d12201a618b1b7f9ce95d21bd58839913c6ad2d49277d960ade49b82a10a762445a67850a498b59fc2552401c798ea15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
0ccbd75b3deeead64e7605dd1173e85b

SHA1
c350a422958f55ecd1eb28c619d4646b03f8b901

SHA256
d81427cd5bdbc669a0988633141fb990b5520e289d6d102469219b99a9f93c22

SHA512
a3c34d0e82920077800a0efba7b1c938261b42a3d749cfca685d2def96112ee6ece698037cb992df15cee57b23991bbf88ba17cac38380c11c06aea6b9bc8864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb32.TMP

Filesize
204B

MD5
f62801e152d6f3933b143ccfcf10c628

SHA1
01493f87d821aa9feaff3e38749fb1d4137ebe66

SHA256
75614df5f72516a286bd9f55f414898a645e565c91a44c79985f92a235adfc49

SHA512
1d7fb56c1f32feb8e197afaa91c922fc03be61e40d55b6930d9742d43474a06f5ee8d9da5daf86897d388a57aa73c439393d2ccbb36910e1df14b30947e5c7d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64abde9cf7d7c54c4076df4e2dc3c742

SHA1
6974c75aa356fcce97e39bac262f85950e9dbab8

SHA256
31615971d3a952c37a7a50a63339266d4fd1b73e4803e1c85cc07a417f797e48

SHA512
5738968879a0acc93dbd2a1293e3476aa2670a08800b878062a97a5d4ff15c3fd318a936df8948f3c36afc182dd2f39288c051abc576f049f3b1d3a941e605c5

Download Submit
\??\pipe\LOCAL\crashpad_1148_KNQGOCDWAIJPYYFP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit