dbec260d0c7b572ae1c501eb388044763971eadc02ac6a22e61fa13f3a7e5f25

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68dce48bd36a4528b07a70635914a760_JaffaCakes118.html
Size

175KB
MD5

68dce48bd36a4528b07a70635914a760
SHA1

7037111a1e3e65c7e22bd6646b56d706ba3a706f
SHA256

dbec260d0c7b572ae1c501eb388044763971eadc02ac6a22e61fa13f3a7e5f25
SHA512

8c1460c9709970ebac629b9103f9a7ccf639bb669397b16008808dbd4f256c367bb20afaa20b5f5a0e2c5d1cd7f72d027662fc1c465902bf4c8822e9415788a3
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3FGNkFCYfBCJiZV+aeTH+WK/Lf1/hpnVSV:S9CT3F/FTBCJiYB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
620	msedge.exe
620	msedge.exe
3888	msedge.exe
3888	msedge.exe
2340	identity_helper.exe
2340	identity_helper.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3888 wrote to memory of 1912	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 1912	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4832	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 620	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 620	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe
PID 3888 wrote to memory of 4932	3888	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68dce48bd36a4528b07a70635914a760_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
2⤵
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
2⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
2⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
2⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
2⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10901722932663069681,2639122342537726198,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
30a3dcc4ee88cf2bada770e056d306d6

SHA1
81ba8a2b86ade9021ca9cd1e5ddabadd9da4913f

SHA256
c291fb809399657b27b0f4480a1814a8a8bfcc2039992d71c324df203c1e063f

SHA512
dc4f443f3cfcb0418961c32101f6365b6109ce5340db1085da299e10f8a1d9d623bcc094f713121b10674df6630dcb00b3560f21907203b9bc6e9a082f6605fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
702eac543ed9bdd33a912fb38b700135

SHA1
a570b73ee7d31a429a7591baa7863ffef051fe6e

SHA256
edf9d73135c1a05759ccb0598a1da38fed3d5eb54724bda31ebf7a4119f1aa0e

SHA512
1476455d064098814bcefc8beae6240e0290de0e5e7dadec8a25052564401fec6e079245c39ea2aceb35ec921bf7ca554b4cb2529333d7c0b3dff1e1f772db29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b6c54a100eba3f878acb3ef8c5fe48c2

SHA1
fde0cd289e6edd6f0e727dad9e5c54168b115a16

SHA256
83ded60cd0529c0c084aa14e9b7697b281f0bab6fcb1e7cdbca01eeda7ebd46b

SHA512
bf0bf8690e594e8ba6b87d08e714650979e5b1bd15e5f3dfce39c21bcc039e7c259f10817919c50b1698568c37b333cd9bb11c5c5017accaae158211af6c75d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6b60bab2d36646e66fd2f4068386c900

SHA1
455986ff51e347e0482bb5df1b66b70b32c89eac

SHA256
9bd4eb2f0df3f9f0e8fc285bf193ff93a178e613dfd3a9aaf3daf879e69e2150

SHA512
c545eef2540bd48b4a203da920d3dd0ccd2a30c1ad08054501f0928588e58c95bc602d92d1399d3d4bfcd77ebe61f1a697168dc2395d176bc9f9b8ed322d9d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af910b13e2140bd55794c2d21e8f5a07

SHA1
bf1c3e4bb150fe6a13b04db480b13caa6ad939d0

SHA256
5d35da30fd6b3a4e87be78102136fd92551db83d6f50feecf4b12ecb1d4edb12

SHA512
e80e52f211a70aad079674ff2b42737b0eabfda1e89739d6470221c726c560b7fb96c903b906016a9c13ca445277be3a3286043ffd5cba9a8e8ae49b7fc4405e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
934fe9786b135bbccfe9f7cfb5fa664a

SHA1
e9dd0e32e793e833073cc08161e5483bdb3dc374

SHA256
d6bbbf8d8bd6b7287828cc2b7af42bce55203246b4129291fcf13b00ac8153dd

SHA512
1d7ed74f6ec02123e874d5d0aefc0520b137a27c2638d8ab0eb51eff809702d6fc23ce3ebc4b25e609c6881304c5b36552f9372004c90149f0d6d97bd5c489ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1a58aabd4c2aed8dc08cb356dd8b3900

SHA1
6b18c387c235a0d79da2914ad66053b224a6ceb4

SHA256
07fa86c11fe44208aa466aabcfbf932ad76367f98273aaa37d6c6ccc40d5d12f

SHA512
a2f9a55623bc8a15927737e2030be651938b533b08203ad475f54d7ecb1304ca2f14f2bb9b163cea6631ef6adbf646d190b5f57e4f30a352106dd154f4de6236

Download Submit
\??\pipe\LOCAL\crashpad_3888_XFXOSFCEZXVLKSFP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit