418bf368c1f619a9076d97bfd37cd029828cfeb90ef61fda0e1c07cdb4d35c27

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6477f95ec2e840b1c82977800cad71b1_JaffaCakes118.html
Size

42KB
MD5

6477f95ec2e840b1c82977800cad71b1
SHA1

45391f3b69f281eef27f3c28d07c06654b75bd9f
SHA256

418bf368c1f619a9076d97bfd37cd029828cfeb90ef61fda0e1c07cdb4d35c27
SHA512

ba90a0b3f78229dff542cad5585072f8d8c48a6c0b83dffba956b4c5e68fa19e41aab15cca32922b56540e1331c5dcf349b3f03786d09459a11a89ef46dae616
SSDEEP

768:jNod+0Edi4xEQ1A7g00zDIyN7j0fFbeZ+0M2SP7GtjUoGaBhpj4nMiZC/BcEeQk+:jNi+0Edi4xEQ1A7g00zDIyN7jyMTM2SO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4932	msedge.exe
4932	msedge.exe
1572	msedge.exe
1572	msedge.exe
1188	identity_helper.exe
1188	identity_helper.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1572 wrote to memory of 208	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 208	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2600	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4932	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4932	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3380	1572	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6477f95ec2e840b1c82977800cad71b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c446f8,0x7ff810c44708,0x7ff810c44718
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
2⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
2⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
2⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
2⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
2⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7691952291019301404,14447172521021911558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
90c63eaf3903bf77de24d68623c24880

SHA1
d9003aa8dec5b8dd9ecdfbcd89fcce36b728bb8b

SHA256
48386763f9a0fbd4ec20bbee4ffc403cf49a09d338490c5d2b76f1d3e98d481a

SHA512
bcd7bafab432ffad825d9a683b28b3264b348995dfef43d0231b11893ff21827ff4fc65b141bafa40f65e412d3fc1a746780f70f27031f0f1ab9b8ff1a03d67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5efcef5d129998475d3ca6c7c19c2259

SHA1
6c0f2951cf77b92d4c0d7d3eece07dd497dcb2b5

SHA256
333b17a0144e4350c8a7ef01fc7c0b240eb350c97f24d884a328195383e653f3

SHA512
67b5697e90553f7bde4319d2e2e39028e56b249273c395864f2d1370a663472f8e3f47df38cb9485b1083e0b8d35249ed16db9c33eba8b763b1ce6a814b09d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0b9caa9e4585947eac2a18e700f4eda3

SHA1
d9f47b7fc22c033ab1b3c3fa472fe837f791ac1d

SHA256
a4f63c3a737106dad2bd71e8ab78c1b594b1cf419d6bf24d215e8f835e8b6c25

SHA512
6c750960e5e21f05816952d9db75562d87094975015a807a3b154006080e5050816a86d9f08b3b8453162bc98f3e8d48dfd56308c9020e3a814e8fbc6e48ac07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bcf9721b5ada7d70a3af7b3198f00d23

SHA1
79dd375109eecc010f426e3dd6ddeb679097576b

SHA256
36dff4ea01877f8e4d0f69162c558cd6ca571b56747a3b244aa79ac5a3d4eb85

SHA512
69bffc38c38f3576325e172c49b26564d0ed314eb5b0cde867908bd3f1887cc5423ece83fc8fde3158238d91520ed948c7892eeb6a04dda7f612c2c7119d4885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87aee1c10ee52cb959908fbdf173597c

SHA1
9e7525e0346a6f1c7a0347d2ea2c385172d51f8e

SHA256
3cbe6cb0a21320a0aa3e399338dbdaaa91f190ede6230cc1309997a32ae722cd

SHA512
be8e4fc579f7938b97b0cf84247fc056b30a0827e25ea787f491f3560d4c657e588c086cfaa47c0b94c9a9f05929aee1564dd11057d03eff8210a180d5984afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e63196e7560f935d05036d8081d1b27

SHA1
078d2d629a0aa004c26eace66c40580f1a232451

SHA256
4dcc87e6ae58ed0b176f90b8eb7ecfc899198a63011e4f2765afdf82706638af

SHA512
f06bbe30d62abfdf353e04f24336f9dd44b7bc261e4093da92f4edb8d3eb6d6849346402d88b9ce3964ce28afc575ff12b412edd7def1d1b1c5dc7853e9432e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2176b67887051d904840caba237596a

SHA1
8280718cae81d40b7b529d225e45202c89f7d8f7

SHA256
a3dc4f692ed6ae094e6c29f60ad862780d6f52b902c71c9ecadced5b4e9cb521

SHA512
45f7d20d1c64917bd903e2b230c6227b367ce4625f620674fd532e20af0496d1155fff311195d6bd6cb8683898342bbd5fe9a145f590c4cbc7316b15ce330164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
698B

MD5
1753bd8de68ffff143559393687d1c5e

SHA1
46f3203918f8facba923392ec93980b502d60889

SHA256
1f9eeaac32911c19da1e61f95bcc310b4a450669164869fc933cc88129961df8

SHA512
10abe0fbc1840c42e799337c34d299e19334908e4eeddbbdb071f51fb690f7263083fe7142478d8a70318f6665b5b10ced88d5e8d707d1d1689d2054c6d4e268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580b55.TMP

Filesize
367B

MD5
4b4ac3744c953290bc7e7ef1f56179e7

SHA1
52b11bf64cb5674cb7bf4cbeb894d409e35ef771

SHA256
3124a18bd49616807233936d9de97a17c6cd3772c476de4359c37ba0dd5d9aa8

SHA512
37df283fd70ce8f6afa92263d1a7b675c4611d2fb1dbfe8f3d517d83f813577163451ead3a2973945350abe70da5837b6deb95df59e9fcc10b4e84825db36ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5705b4b6e3760c53fea1a0569f0e268d

SHA1
ec7debac0fc137ae693a3f1afc4e6e032fc80db0

SHA256
6e1d7836ead539ef0a473f3ea0e550aed156ce411bb773e32878e9645ba09f38

SHA512
27c1d7f82f97bde1639870651a47059e02020d66187741f9a1cf5bb7346352e7a1b72e55bba41926158cc19d279149959b71e6949f957ff926408adf01623e6e

Download Submit
\??\pipe\LOCAL\crashpad_1572_ORSNBFTZQYIXILCV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit