47993be10138158c35fb523b63617c5ac232dc016f5788b3cd5a5e438a67e5cc

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65ba872598b08da326318095ee9ce9a3_JaffaCakes118.html
Size

91KB
MD5

65ba872598b08da326318095ee9ce9a3
SHA1

bb3d985f973e78d8a0d4c0de3bf69d684a373cf6
SHA256

47993be10138158c35fb523b63617c5ac232dc016f5788b3cd5a5e438a67e5cc
SHA512

3bd174790aad94dbec50de55c6310c614b0e37cf316f9d2125213dbb5979a38e1e895e2930343a769e00e0f62f5164158b92a223498879d14efaddaef332b166
SSDEEP

768:O2dZWAjF2hgdef160yFUHs0pzmxSAhsvjikcDMRmjVEEUgN3HAADu7Y:O2dhjkhgde8JyTpzmfk2u6hN3HAXY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4164	msedge.exe
4164	msedge.exe
3356	msedge.exe
3356	msedge.exe
2952	identity_helper.exe
2952	identity_helper.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3356 msedge.exe
3356 msedge.exe
3356 msedge.exe
3356 msedge.exe
3356 msedge.exe
3356 msedge.exe
3356 msedge.exe
3356 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3356 wrote to memory of 3008	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3008	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4496	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4164	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 4164	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe
PID 3356 wrote to memory of 3584	3356	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65ba872598b08da326318095ee9ce9a3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb042146f8,0x7ffb04214708,0x7ffb04214718
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16756140650227025006,4989208151712104649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\837d076c-b00a-4477-8c5c-d4e9a8892761.tmp

Filesize
11KB

MD5
9b842d6472f76fffb371ea33ceefd509

SHA1
d0abab37cedeaaefb1b5edb2bbbafce844b04588

SHA256
3356dfb1b9964f98ff3ff8c7f85d1894a91ffef7c4d85161571d931d64b23e06

SHA512
f015f424f4d970d4d8bb03445fca41ddc754925e4cb8911efd553177988a29c93f7bb8b29a47b160f8dd52d25b1b781fbb253cfa50957e0911925a547bc94147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0899a71f8996a62efb280770e1875154

SHA1
26b0de63acef31233830b421dafd65b4f522c7dd

SHA256
3f69b1015901b6cb3cceecf5b66a06004c121b81c4eb47274dd7c5900f7605f1

SHA512
fc9699dd0c071d9a15adf3b2b7bc18b5db325c9fab44d79e8d2d158ee58663aa5460ff487e48ffc63ad282a8a32f8b5606ef37d789c4c4cfd26ccf1435ee8397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5962579b83291fdb1e73f4850c5eb2d5

SHA1
dfa5c2f2eb81c77ed985e159f3986ed048631345

SHA256
e6c5370282a41233b738c33eb9f49dbabab281074170f4d9c7fe78e7960ce719

SHA512
36d992499a65c58056ac695b421dabffc384bd7846fa5b054ab3982df208202edef952553c125e7c2840944fa34e8066b74d7f43da7b70b24fcfd19043fba3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd282ec62f40efc95af6afbe9569893b

SHA1
3883e25cc64d0a149b7a4b6bd3d739aa5a01ee13

SHA256
83dd85a493327ea222ebd92a036d2fe1163ff0fbc4f0db3889c966ad68751797

SHA512
ea0af05bc8afe830fea0cdd9d6fb102d849f0c403001ba6e02e2fa2e127b469a799d68de3dea6bd5f740f5651209e84f8fbe1ea367bd5ab1ca56c49033cd846f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b85d84343dbf4fd0ee3a70d8072a9501

SHA1
379547cd186e1d2ea6c80494b19f874fa0d5d866

SHA256
2abb1588d09861af2eb206d5cd3089140d0e3cbebabc40b4dd3536e66730f026

SHA512
0d7078ca1d7b39423011d6759416444bf0cec5012be1b9f345498e1211a7412ac5e31700974729a10d7227cd5844efa1c67d6b2806715cf2295ceeaa7666fdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
074b45712dc4221368367e12e258508a

SHA1
87e88a8cb36ae45919d859ab409656d6ef7e5632

SHA256
fab7f1ebf890e0095bc0b5983375e4f8d12e0ad8928a6b73ee5e5b780c49d9dd

SHA512
2c3c383197c4a0b7ea32de14657b5fd4e7efca96afabcd2712e4602db1ea24525eba1f513faca977d75ec44142b644528bfed5bcb69b53be12e1856a36ae1eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd1724840c96138f8c6f9e1b664ac76d

SHA1
f08b970cafbf333d2a33cf7b19ef36c06612314f

SHA256
b4551f982a148988c7a692a1b49ac904c18efe0a634554122ce1b72d7a3d8ad1

SHA512
034651ebc062639147e6ef58fad27fb8c7cebd9239163cedec919702b8b00a77df4517011e7081435acc989575ceeb1a63ad8da33e074e4c3336f2251ffe0b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
32295e0a55a035b19e594f9b47df4c6f

SHA1
665083759c6f5e5218c4340fab98c9e1d8030d9c

SHA256
fbd2110db1b0714f16bdf5d483060e539bff59208dd0fcf2d153f1ff739cfde7

SHA512
70118ebbdddd99997d57684b45c6aaf9c01daafc51d6c9b443863bb581a50249f0bc52834d60189ac9153a71c2197187517c868820f28b67d6a0d320570b9540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b19d.TMP

Filesize
1KB

MD5
6d91cb7a6a02cac4f2a710546f86a56f

SHA1
dc83a28018cc9789acb8b8a257ed5dcd19194890

SHA256
c1935e1d634e3d1a106a16136ee93573f6012812844779908d971c7558fb3849

SHA512
80ace170ac6ab16997355c965933418dd948425942f1e113e8c809081901215481370fbfea443915d78626af6e55978e65fec47144769c8f25d818e312aca63f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_3356_PCVBLCJITUFKEHRK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit