81b00a6a592241ba0f4b078a1be3e00826a28bc789d4428ce6f3b45c63c2ea4d

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b583b55ac674e876ab6488f24f63e4_JaffaCakes118.html
Size

81KB
MD5

65b583b55ac674e876ab6488f24f63e4
SHA1

60c69b80addfbb9175db771426067dc8dc612d4a
SHA256

81b00a6a592241ba0f4b078a1be3e00826a28bc789d4428ce6f3b45c63c2ea4d
SHA512

ab1346a8bab4de80222acb2f315627851fcc0fddda60528c1bbb40b8d6dff6a97b30da877fc3dacbbb7cb6e7aba8af2c7f43fe7418ab7eb6a273492848b7c9e7
SSDEEP

1536:mzw2ovkZoFPeR6V3rSaQ96hoRFMjtIZbN8mySeK:mzw24eaaZFMSZmmRz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{9EA0FB02-D045-45DA-978F-EF97EE52F70E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1968	msedge.exe
1968	msedge.exe
4136	msedge.exe
4136	msedge.exe
3952	msedge.exe
3952	msedge.exe
4912	identity_helper.exe
4912	identity_helper.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

648
648
648
648
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4136 msedge.exe
4136 msedge.exe
4136 msedge.exe
4136 msedge.exe
4136 msedge.exe
4136 msedge.exe
4136 msedge.exe
4136 msedge.exe

pid	process
648
648
648
648

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4136 wrote to memory of 1820	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 1820	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3596	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 1968	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 1968	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe
PID 4136 wrote to memory of 3664	4136	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65b583b55ac674e876ab6488f24f63e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28d446f8,0x7fff28d44708,0x7fff28d44718
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5976 /prefetch:8
2⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5956 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
2⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
2⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
2⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14405822507671537865,6423410941420617909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
864B

MD5
247cf2de08687d877da30b203525b829

SHA1
23b8aa2590c58d0b20e2f3008126ede3e389511e

SHA256
8e8421fa6fd9199e9c42a499f00fb02f0d42027f71365637e0098a2ff575097e

SHA512
ad6eeecd7bf4e68266357915f7c2e8f3357836ea57b2f8a82d9693565049a419383339ba431db8b981fd6768ed206addfc3975a2f5cde3aa3c84cae2e15426eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
533B

MD5
0a5d23fea8ca166025e3f60eac1e2e52

SHA1
6c15d58f4c12353a5c152ba50500f69cdd40cd7a

SHA256
e4c0e13f3dd4e7bdd437dbd081646856f18006c493bbbd0909baf2acd42b87a5

SHA512
e31d73800be76bda01ed5b29e3082b3748eca14ff7fe2168c73401b6a8e5a8588e9282175bc57427017ff62132c6292a3eaec20d6b2d9b8b1f56878c3bc9074f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1c79d5840bf8c2ae5ba2df36e7898356

SHA1
5bbe88761f368274f3afef9bf3c2e3c5a05e9b2c

SHA256
7d404c439dfe943fca080d33962c5ff1f05030adb5286a06d88ecb68ff8fdc14

SHA512
9dfa98aa9a9da1767e9eb2521606683ef2a96319ef912cdfdaef77fb60e469e8fd43ef5d4522b978f24f5812080072fabd2c8ee09b337d86e0426dde00fd6927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bf4eef25ace9e051334d59de04a4b270

SHA1
ef368cf04de65a95ca8c9d56caf23d6d52b7aa1d

SHA256
2fc6d1a018a96e908cc5d4d407b2b2cf5688939fdceb6c5c1a48ca3084c3af66

SHA512
ad668a8489150f1bcc86151deed312e63cd263d5689761037abeeb080c79f5cf4216e001d4915312e365a4b6e1e6d368f7596346d1e3c3bd3f845f95fdbb6b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4d33ae85748348e9c115f3ce82d746a7

SHA1
168895747ce65165a6532117ef9acd8fc1dd0719

SHA256
8a582d6a7be42289567d5049792b77c0c17e6228bdebc020daa41f70ada02a33

SHA512
b7a3c6950825514cad92b8df27a914ed9f3dbfd750b9adb134f42f4093e4a95063919f0bc5c8a8a16c1cbf00c2262869ad81418ec8a877d81a54b43b502741b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
534B

MD5
7232668e7313548cfb648d992c7194ef

SHA1
910d401809180b565554f416151a5b5b6238c320

SHA256
a5b94f2c1b509ab8e9afd41a325d247c01d324c9aba18ce2594f5dd6d06de0d3

SHA512
b995318fe07354f515fcf44fcc7c278775796125c02d1edac7aa1e8dab2815e3236323f51c7a9fc3d3f687e53ffcece66c0fec23d092ef7d4ef8285cc7ac43b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583cc6.TMP
Filesize
202B

MD5
9068ee226582b09b1a60c8d66c75ca87

SHA1
9734c89fcc223ad30650423adf644ee1993f7c6e

SHA256
8b30fd27fcaaf395d593f24b049c93fda47c9eb8ba5a3ad3170c0e67334d448c

SHA512
9e228fba5bb6ef625c3926290adb060e97b4d00085c18081c2317f4d19a2aebb6fa983543632657c780c7256ce95f32feb5609a271d65d91c07218bbe9988579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
90abe79e6c6e5727b8325c18e3f2518a

SHA1
adada0bc3c9a1603f54cf4c382f66475bfa5ad17

SHA256
1b773174b6c92db6cd8d832deb9ae9a0d5ba7dc92150f5ef03883d2dae3b4b65

SHA512
268b2d1cf5b630c1bc452e83c99dadff6d0709cc12dab8c1a96ab2da41aa2f2d1e567f6e30f28bfaee6475d8e49a4a53e85b0bb70689e2903df3fdb4bbc96e1a

Download Submit
\??\pipe\LOCAL\crashpad_4136_YSLRVNMNPRDGOAJO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit