56443529aeeb98f7a0d446645c9da093a735b3f942347e8c90170397117052cf

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658706d7b4f7cf2f2227a3825f683e45_JaffaCakes118.html
Size

51KB
MD5

658706d7b4f7cf2f2227a3825f683e45
SHA1

1440035787bca31177998115ee19f5a9e7149641
SHA256

56443529aeeb98f7a0d446645c9da093a735b3f942347e8c90170397117052cf
SHA512

fe37c47cf32fd96917f0b54c095ebf47088c081809954b93f7ba16b898804455181b0db773841e8a8a21f958d12c7c7aca5e4c28403b4644d7c8e03ecd5deed7
SSDEEP

768:2QOrKWN2aOo+jb9ybkuIvNOtj1/e9rCX7CesIQSsWrzQXJ+Gt23BteZjb29SmVh7:JPjIkfNOrG9rCX7CesIZs1tytMjw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4788	msedge.exe
4788	msedge.exe
3588	msedge.exe
3588	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3588 wrote to memory of 3080	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3080	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 3480	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4788	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4788	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe
PID 3588 wrote to memory of 4268	3588	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\658706d7b4f7cf2f2227a3825f683e45_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4ec546f8,0x7ffc4ec54708,0x7ffc4ec54718
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
2⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
2⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:8
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
2⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
2⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
2⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10914908043608854757,7433934057173655122,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
192B

MD5
07ae38341982e1baf1c84cad168a6d8d

SHA1
27314148d0c5f1312ad523ef4c52cac8d3a181dd

SHA256
468a3c0c16c498f77452b58696abdf07432c5a3d1113bcb5ccad9a272194f624

SHA512
77ad1afc77c2301f453446fbaa373094c74cc6f0001d678d5872229a85a7186f8a91e6f5c1c95939649eccc289a303993b7f12fb94442bf4a6dd28ea4d843ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
d3d8a08b6d9a872b9c5c6ac6865a9b5d

SHA1
55e9c93824c9aa89f20d2cf37af95653633fdedd

SHA256
1a9f44242d2cb863b38e5d7db76a195f56bdb45b139a92712704ac46a476b1c3

SHA512
0fe00a409814e3d73f65cf685362b4287d92f8f81b477dd8afda41ec040ff53c76a0435724157893b36cbfc1ec6f8e6c2945b7eaa97163cb30fcebee124719e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
34713ed2f80f294fe00fbe1e9fbd81ef

SHA1
d716bedd2cb4b200875d3e0e099acb929c0b484d

SHA256
ae403d1851a95da87f0a31661df55e2889a25f6ce7db664468462791f49edd39

SHA512
875f982422b5510b73ffbe46a8e2c5e382e3e45daa89b288bde3b7c83f366d1b0c90a4d357425aae718f9265b65374fe6f58518cab79eed992ac8c9d609e5786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d0dde0120a6f2c15e605aec63355143f

SHA1
a85cac0b6f8b4634fad61af31677f42d6e8c46e8

SHA256
3d4c11e6d732768cf06f68ffe31759ee64902a85d0d5c6a7b424e763a4fb3700

SHA512
2e0af8a1ad256ea7c6283341322e45b5ca8cc2cb8f29e9ae906cc61b2b82aa6ae2daaf97d59e912ba4842612167d24dd3ac6fb79e220ef5ff5fe9068806ae7be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f21f93a29289025625f4d3926baef746

SHA1
54246acd3b7b17d93b58bdae7d8110b2a834545e

SHA256
2bf800574feed6ed7aa0a20d31966e516d6de9373e6925cfdc68bea9601078d5

SHA512
020e4c92d3d1594e92b841fbb1df469ec2b7a5c059f03f382e4356661a2375d6ce10091d613f840f4ea8177256227dabd57621a1eef4fb3097292ef5fb6d3e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4e3441f6700d6035ddfdbee21df949b6

SHA1
78f87496cd1ffc94ac82a37c889996591895ee2b

SHA256
5989a53a47487466881bfe60032620b9d74a5ffde38c491b24d163e2941a8b26

SHA512
28cb4e6b7a541b9d414947f34e781074dcd16dde978148d63d99c4cd8046429ba442247080d737ac780bd3631b4da713453ec11892e5e7763a7f32152a9ee6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b8b4087996fbcce2f06b509ca785d42a

SHA1
eee09dc60f31dcf141b802fed9797127fbc210a3

SHA256
a42517ed67360102b46b00dcd6edec8808de58260df99e93a64d03184c4aed71

SHA512
080a5213b69df948fba3fa8a1f07f99361a92263cbb0bb5e83dde8302c55d6e78732fe0a273c017b40a952c466687dd1a20515fd3e6c93d7bd7717e2cfe29b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c702e1374c9dc1d6d1273f4e22b36565

SHA1
708d172bfc5744a743e02b7f3d9f46ebcabac673

SHA256
f6308b38fe6e5a4334f06b2754b6eafd1eba7d1798d1b7a8d14f2de4ffca4dd8

SHA512
9ef89eb804d1968aa657ca0a92347c430dbf880ff3b27e9bf2eb0b3d395ef7a2f6c67e47fe6932c48164ab3d80f205b52f627670f527b5654487b72680e01517

Download Submit
\??\pipe\LOCAL\crashpad_3588_DXSBGMTRASTOZDDW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit