657f0fff00b43017751cd9cb52ee898ffdf297797778c2b02b27997ea50cedb7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65be863d9acd11c05792c13e52beb8c7_JaffaCakes118.html
Size

93KB
MD5

65be863d9acd11c05792c13e52beb8c7
SHA1

76d2ded21720651821ad277feb81d667106de7eb
SHA256

657f0fff00b43017751cd9cb52ee898ffdf297797778c2b02b27997ea50cedb7
SHA512

2500beda13b4136e7211dc3bb0e42d84f10d3aaf6d09b256398591973fe8b72facbc462e51e03a167e2e4b46a61fcd69ae706eec9f58d13042dfeff80c7ddb53
SSDEEP

1536:3sKVMLvdK0SJkXg6UdreYbXNtVYisizZbBOiqdxpf9jEvNEFSMJZZLg+9j:PqLvw6UfbdgipZed1juMJZZB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2860	msedge.exe
2860	msedge.exe
5016	msedge.exe
5016	msedge.exe
3772	identity_helper.exe
3772	identity_helper.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5016 wrote to memory of 4116	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4116	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4428	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 2860	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 2860	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1408	5016	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65be863d9acd11c05792c13e52beb8c7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c4718
2⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
2⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
2⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
2⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
2⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
2⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
2⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12712242913718439036,2518077250462236557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
55364ee6058b96b558efacb002f76e59

SHA1
577810ac850266969c52f8def7f2653a047f4640

SHA256
b6b3345f031cdb773a660643d9a4e5a4982eb3b4e2222e63dfc73617a0123c13

SHA512
de802a82398aea611371f3a8722c735c2e899f3c5521fc7485f23d18555e038d4f7b6beddd75d7037cbd001f95afc3dcddcf565f7ce80b202e423f71111633f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
dbb1b960e2a576e9b6b999c06fcca021

SHA1
f53dd18a446e5a5f155a51371d3326bb79bdc1c1

SHA256
446c57b1bb9704fd01d8fda735d08af5cdbece00597df95926d70004859bddf6

SHA512
18a7ec9b6b63f754d47e924c9c7ea22b0fb53f3ec0fa7b3d221c2380c38f2c989b87f67a52c928d46709efa53790cf4e2e63e0260eefe551acd5d9b7fd524631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6c25887c60ed931035bbee4c0c77679f

SHA1
7d4ff37c3ba53c91f14930c2d3b5a9a8fc6fec6c

SHA256
a7ced15079bc235e7e6d596e5a58f2cdf8c22869f481c3a7be3dd6369d8d55eb

SHA512
c5ba14d422b6442ca346c7fd6148a398479bd2df43f4af55609c8f3c3069d1eabd51993b14cc71f61c7c5c76678062b719032aafd3da0d0325282ca8e7b81aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc55dd0dbdfb6b04649e5a831315a700

SHA1
024a1a7180f367f43bfe20caa142f8e9c10e11bc

SHA256
f9aeb4f89848daa037c9406ff16e7f77ebfd9cf4ed6a3fdd86a7894c69d71680

SHA512
7bdd64009fc267167221b886669ed1748780a7f98deb990f816f3cf5f9b4e81b9af3406d740f776c66a7d1add84bf54d452f6ecdb482e23a663e0f9a6d31abed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
89c4bfbfebe0ea766919157103b79f8a

SHA1
b96d19dd4ffbf93afef8e12ea0b5891494748976

SHA256
b592b2a58f3f1951e9426a1e0bd11691188eeb67f1a065afa6eec2f2506e9d23

SHA512
2662f6ae15041ca5d9ab02d6959e78b906e355ad247e84372dfa64545338dc8f2837bd879ac71de0aa963bac4d42adea8372f77442dd591b04b6c94e539a9e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5468e9abafafeea107140b4491cd4077

SHA1
4de33128c079e5664d9bb76858c5f53f5e3a3242

SHA256
005d65286f8abf552bbf4529ee79278c81284326dc113511ebc59edb71d70e81

SHA512
be2810609ac1eff6a9333107ead5e169f6ff264c11befab246dc4122571805143b9b63d37e79360c5dcc7aa8228b6d404dee53172a0d764eef86851b22edd3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84677941e8cd405503285c736d124bb9

SHA1
2ae5b53cf5b95eb0b25eaf4d79904823cfe70269

SHA256
1ed7bcae7ccbaeb07076fcdb25cbdfd2f0d95d348c2a013f4cef6990bcf7d4b0

SHA512
e8d8735232190973afa23297aea88c66f308ba62cafd026a6acd20ed43ca2a970402e08d670399f33c50a2583e98058aed4e79db5d15efd6f21d966ba08b74f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
084019bde5bbe9337d0b31dea42c936a

SHA1
1d75dd7a266b153951ca2e648a264fbda96c64aa

SHA256
993b94172d1321db04797d3fb10cdc228f39ac2310ee77781dbd6800164f7303

SHA512
ad4fa176dcf159dca3014950512eb90dbd8865a0eb40c5acd7accc7d99ec80a5f78650ad1edaca22db4cfc9e237fd5f9e75a9a9310919d48dd0c7ce93e7b013d

Download Submit
\??\pipe\LOCAL\crashpad_5016_KAJLXJRDVLLANVVR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit