dac9ea6577e541aebb7f7c2353973997d8d8c4db5f41fe9955548e6f9fad6270

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690a00c4796fe76fcd38fd7b53a7a15d_JaffaCakes118.html
Size

155KB
MD5

690a00c4796fe76fcd38fd7b53a7a15d
SHA1

bd0ff666b214d1fc225855466ae298915faf1a5b
SHA256

dac9ea6577e541aebb7f7c2353973997d8d8c4db5f41fe9955548e6f9fad6270
SHA512

ea6320755891a84d2d85c6c3a70833194ef84d3ded08db7da3fd18746a815f5119f90e28d14b67f2c3375a9a9c83e25a9ac4c25a42a62a7c82f9ac353be203eb
SSDEEP

3072:SJATCh6bnckaYJNQMcZfgrhSOFYai05BFNajiSZOFE6AUHUopiLFq8xgYXro7mhk:wxhpCFDByFsM9AiNgPn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
4072	msedge.exe
4072	msedge.exe
3892	identity_helper.exe
3892	identity_helper.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4072 wrote to memory of 2408	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 2408	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1184	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4836	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4836	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4672	4072	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\690a00c4796fe76fcd38fd7b53a7a15d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8426246f8,0x7ff842624708,0x7ff842624718
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
2⤵
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
2⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
2⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
2⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
2⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
2⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12751638980813968912,3445178380059622950,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6216 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
836863409f6361daaf3e5f63e405c396

SHA1
db0c64954fd1b18854ef544f9c641ec834a601a4

SHA256
e779111a341e308411ce9b1f79f49f9bb6da14d1de5d707a0a77d415805ff4f1

SHA512
b1d286b280b07337b8b51d9655fa1ab39651dc951e1db1f4ef1964764fd228348b6fe8d21d80e353c2a30ea159f15ffa94f87aebedf6a6a3df87c12cf07d5a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
976358a941e225fb8c8cb7a82a58f9d3

SHA1
f004f61bf7bc0779fa0847d8739afd21133bc552

SHA256
2d55351e4314335379d811b0b10155eb5a5c86e2e0851d33ad9f7f25c68002fa

SHA512
a1a76437523497b80a93f302dfaa095339d130e1e8f9898620b7b5c1e3e64287a5cb1e945206dd5a7694272aaafda04213da767365af94c190b6406373fa1c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1a652c13550ba4826249f04895e6d1bb

SHA1
f38eb0c373ba6ad348e73ebcb02fe8d89c80b9c1

SHA256
5ae18e6b72a82cc203a4bc7f1cc9c11d964dd2a86ef0d6232523437d2a51d0b0

SHA512
e4e363558bdf0a82fc06b8d7644b60300c4580489a03c4f0bae3a06b7b5aa973a2e55e0f0b32e0bfaa34076c4434e8ac33442431840eb18f785e60b9d52dfad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4aaa9858f89eae4828c32b6eb6b19ef3

SHA1
f714ce58a770d02adab86fed3b05cfff3f568cd1

SHA256
136ce9de50487dac27bb8da623324b3120414259d91cf889cd42b710a881323a

SHA512
fc58f0095f64d6da907b1a4858573151db5f868a6d1920e1354857d7aae95bf41b7430def98ae2612767c1283825bce7d354413db8ea636b49149e308a3fc1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65228ff0e815e89292c1343d334035b7

SHA1
c2a8313879ae9775931e341eed2e126b5336f182

SHA256
d63526c921047ac96545867b651a21307868dcf472dc30b3cdd00f8a83d39a43

SHA512
a6f46259863d6e309b43f51c4f8231015ab31745db62dcd0c0732c996aa77680447c9ce101b30e9b4bd31123b0d285109b72d3bfbbe44cbdb16305f96b1bbfeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d44e4e57007afb9784385b6c79b8af46

SHA1
1761b51712044f066c6b5f8074ff7d3395260a16

SHA256
4fa08af193c18ee3bd39a3689a4ea95b4dff6802ef6336ede15a0bd6de70aef8

SHA512
825729069fbbb4fcbeeb42d4f6409f44ba9dd0017d6b27da415beacc0e27f57c53450d0a0106c199452d699dd15e9ba4118432191fdd9551573f1a2f05db6db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e474077216bd19936b192360d3991024

SHA1
7aad9f09b9a9beffad2806a826c503d2900b67ee

SHA256
c5c9db6f70f932fbc7365fca89fc3ee699ee81edb0d5d4cffb82af7735fb66d1

SHA512
c3261407b64b7521032eddd23300f80d7155f627a87bcfc186daa1d6b60f9729153631c9c1cc642526294f156f7a4bcef989bb3e564340e9844fdeac90860b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ad3d51062c25171663d884131087619

SHA1
37a40545e24def3d4f20390b0be1c4c22c91d066

SHA256
f4796f0a62d4e44e9c31f0e434936c3defaec3d8f0ddbde884fe877986fbcb54

SHA512
851c204761fb306ec3a43f3d86f028fac271fe75087747e513047e0787ae081f6edb83738b7fffd21e89c6f3d20568f38ab0ff864c0596b0f665daee243c0a31

Download Submit
\??\pipe\LOCAL\crashpad_4072_IEXJKZRMOKWSGGXK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit