cc43d9a0b8e1879ab735a416c98049db30fab1c3f54f478e040cb4027d3f47e2

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d567f100f6dbc9a6c2c62fa1755ea8_JaffaCakes118.html
Size

175KB
MD5

68d567f100f6dbc9a6c2c62fa1755ea8
SHA1

a36bd5775b8223205bef7bc3130ffef13a0452c7
SHA256

cc43d9a0b8e1879ab735a416c98049db30fab1c3f54f478e040cb4027d3f47e2
SHA512

e5294a5b596f29a33c9fcdcf57bf66fb1c4ee1ba8f3965213b536ca4647bd765ab5b2f81dee6e7b51958f6ca2513a1665c4f6220edf11d1dfc3eab1c216ebee3
SSDEEP

1536:SqtO8gd8Wu8pI8Cd8hd8dQgbH//WoS3fGNkF+YfBCJiZP+aeTH+WK/Lf1/hpnVSV:SaCT3f/FXBCJi2B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
852	msedge.exe
852	msedge.exe
756	msedge.exe
756	msedge.exe
3344	identity_helper.exe
3344	identity_helper.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 756 wrote to memory of 1564	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1564	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 1036	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 852	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 852	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe
PID 756 wrote to memory of 2636	756	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68d567f100f6dbc9a6c2c62fa1755ea8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff824c446f8,0x7ff824c44708,0x7ff824c44718
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8471975381698777095,13881448727586291997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
19KB

MD5
30a3dcc4ee88cf2bada770e056d306d6

SHA1
81ba8a2b86ade9021ca9cd1e5ddabadd9da4913f

SHA256
c291fb809399657b27b0f4480a1814a8a8bfcc2039992d71c324df203c1e063f

SHA512
dc4f443f3cfcb0418961c32101f6365b6109ce5340db1085da299e10f8a1d9d623bcc094f713121b10674df6630dcb00b3560f21907203b9bc6e9a082f6605fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
95KB

MD5
0f978383950b924d31b77aad56c0ae79

SHA1
4481f7635c1cf3d98c542542d0106cfe498446e1

SHA256
afca43c7931d9ddc33882d9a079772bddced944debbf84143192c4eea3292c77

SHA512
b8ffaaf2d63b9582ec4917e970b2033989bd414b9bbf2b9d3b5359aa4a8a15cd3206e556514483e511df2433adab4c8cef9b8a251e2fb942fe4e7d846fdf936f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a823991cb43fc3e4b1a6a2703411b292

SHA1
a4e0528b2fd53615dc9917f1d100b9b896746fdd

SHA256
7a959df5fc1ec41ac98b2fbf55e0bb80d6ce99d27b3ecb317f74d77499c27d25

SHA512
4d30540623e8dc22f67a730186fe23e494c9bcd1221d06c5298da6b7806c858882e291752f6fd08277b867807893861e1023695adecb733c7475814e89ef1b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aa8281854dbc207451685a9738c74c6b

SHA1
a783217de96d935d3c5025b5ceef3cbf735d43c1

SHA256
c91e6b69845af1cb0ed404d4848d1ba49a4975714fd4a11061a1da31c5177316

SHA512
bb56f139dd81156f1b845d6437ec19730b4f4aae97dc93d01418a32c3633d152fcad2f5aa877417410479445f5aacd74523ccc278fb0cd56bd63c7cf9e246984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7ecc314ad203df350e9a75e2ecafbc48

SHA1
525dc26174632ba836b38a00dce90ec962e4fd29

SHA256
61908d26deee4d0c3100d34bc8abca8568d18667daaeebe1cfc643174cb4b9d3

SHA512
9fb92e91881c62d8e615b1abc1f551cf7cc1c3a4a8e245b0c4ff8bc9270ea2d931e29e2560063399e0e5bf1df42d1c3f7db6ac9d066443551f3d208df49d9207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1aad5128ecf5947612c8a0b959a2231a

SHA1
5ce52496d93f211ce252f62cf102a8e7e7cda877

SHA256
621c5025342a5b5de0520cd22a81eada93104af783672ee9570ea6754a945f5d

SHA512
fd2d94ebe16f9b3c90c418432dfb2074296d979670808bfc9b2d07606cc7e9a3b015bd16521728eca4e53acddb1217be35a70805d56ba19e2fd3cc88f128612e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a28ec31009e06f632bf4c3623ea24f9

SHA1
a9a9da1d64773a17a7ea3769cb4ecf74326a79fd

SHA256
ecf8031bebc978b2f7f9aa6702190aa7b8faed2d3a7cd2108ebb26880669d052

SHA512
4cf3fe7399c0b96bcca13a556c8e769fabbdc01f0fe6befcac8f55355dd4611598429ce9deeebae9c7841cc3d1c94024743bb901de1c20919d97a0f1bbd6ccb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f19cab9d8da66590ca418a6045a373ff

SHA1
069a22c168a853e50c92729a69fad5e84aa5055b

SHA256
0826ccaabfbfcbaa6da03e4061f9bfed0b704d3fb7be50c2a66d647f1303eb9c

SHA512
8fa744eb01993408a71bb8315232b1215739901e7660693d230ace9af1d302a308c5ce169c4c7916398ecb58f4023306757938a1528cb5db7f0f9aff62cb6aac

Download Submit
\??\pipe\LOCAL\crashpad_756_KYDXYAURZELYHTBT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit