a0de8501dae19c8c22ff11c5c096286685fde78314365cfb2bbf4624d31e7d81

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65a8d15639f9b709610a14eff87ecd9d_JaffaCakes118.html
Size

41KB
MD5

65a8d15639f9b709610a14eff87ecd9d
SHA1

dcb63d933a415a83aa2520177663f85788280ad5
SHA256

a0de8501dae19c8c22ff11c5c096286685fde78314365cfb2bbf4624d31e7d81
SHA512

4c57ed04c998681957317865c6100b342668611b36fbd91fc89f7e7050079b0b970864252d86c9d4d6483b8b36397c613239d607edebd0037a52229ade6a627c
SSDEEP

768:sjbiv/EF83JhcJzyStHPNKei8j4xgK2f/Bl:sj4JcJzysHPdWxgK2f/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
3016	msedge.exe
3016	msedge.exe
3796	identity_helper.exe
3796	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3016 msedge.exe
3016 msedge.exe
3016 msedge.exe
3016 msedge.exe
3016 msedge.exe
3016 msedge.exe
3016 msedge.exe
3016 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3016 wrote to memory of 1576	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1576	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1052	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1400	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 1400	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe
PID 3016 wrote to memory of 4920	3016	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65a8d15639f9b709610a14eff87ecd9d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7c1346f8,0x7ffa7c134708,0x7ffa7c134718
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
2⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
2⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
2⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8100884529776353143,12357658060141839328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5196 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d40dab1a9a3be2aac4ccd3121d797872

SHA1
b588e1586b280e4eefa68ef26edd775c9b765ea7

SHA256
e6fa1fffd372236c45f6a75915de84de09b21ec4d060f45e3d84bf85711350f1

SHA512
56b34e270eec82fac15c034f3d495e13ea52d601dfc18f0e88c6221cfc91f730ec514e105b01f7a7700e8bea590639f37831163bd6de41a27d2d769d4d837655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f32bff61830180105697aeab1cc0605e

SHA1
ea01666e1e83915a5ab06df0f7d6dc057dac3b4a

SHA256
4c47a85279fdf9d5ff53fe34baa5c534551b2b9f350c571699b5c7beab1fff4d

SHA512
7e6d60714769446381246484280887b52558c4e635e48cb2aced930447efb79f55c2a362fd2924407fc081ffe7d2a95de414cb9c308cac844337a89486767b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2775c430d90919f816a1a42510223e44

SHA1
bd149d14ed881e13f87147ef38257e44b2366fab

SHA256
afe07b3efb671f8b49656b2d2cc91df997a6d662f940555497a4b2a0fe783a9b

SHA512
cd034cfc7b7cceec8ebf4275b99f6790a89186521e15efb7dc131526fad48fc647de826f08dc8fdf000625c5797549f06d7ec424d4c333fcab4d6f69713beae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
488d1c4b4f2acad003438d75ff00f300

SHA1
4b3f87341f4c4d39acd2690ca72d7fc857c459dc

SHA256
96d55ec33650de7a0f299c99c7de9c1e7efdc53402aeb946136337b50116f697

SHA512
5d011cfe3fd6da24877acd2e2effba1976b6b9b97deeb9b1001adaa114ef0fddbb602d5e6a0718b940f76d7f54ea936c17d6f81819c2d53729781a39a78cb2f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ed5070431bcaec0dbc7acdd7840c3b9

SHA1
ab4a6f7a9210571f6c6bd6c5001f1652da61b86e

SHA256
3645bb022cfcd0e12ca27c4b46a2d31afe77865e333e7281671ced2a18dafebf

SHA512
51aee8c9203402c14c78b82abeb7a6ddd4780f84a82b37bc78c0526b17b39c75ef50b75c622b731ba6fbce7581fe41b531310049150003b5fdd21a944881c19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7198847d67f9a0e32aabda8f3ba9f9e1

SHA1
ad2508e47e5b43e2a00c62af6488ba46f6a22af6

SHA256
355c5b866dacce482861754fedca897ff4b4d99620687a7ff40c2fba218c2562

SHA512
06aa775bf261c707ee24d736efdf0200a4b0d5fe330efe8a26ece2996c6d50efd168d38612332a3e30d41b54f19fdeb3a0b07566c81aeff6c96e37d73c6d0620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d11bb61f4dac6c5d74339ad2391efb6

SHA1
5d9eec64a2fb02d1023c8d31ca1c7b4194c48234

SHA256
76cf4d39fc7e793b9c2c3056ddaae3f385a455e399fb42dbd1ce8e8464b2fea5

SHA512
12e8431bc83779e336c821a0e1fcd175be7b6467a5b7ba6fb61fb7d880fe7fc16799109089051947ba5257694b0caa56b5137ffc32117ebac75e6c10b855b2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
6f4b3cd9db7f66a17d3793fc05f16fac

SHA1
c094b925bfc9b550a5f871314a3b9f6666ce7c60

SHA256
0ad6e90fc8d653468a48f311b4596760519246606b7429a1f0f5e3e7facf7ee1

SHA512
817b76921e217ddfb8619efce1e490e8744e2bef1ce46228d3194dfb820fd11781370a687be1ab2c0022152d4574df83bfb9d583bab3a86e29fce380923e9d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581d86.TMP

Filesize
873B

MD5
b3baa9a0563883f8666d36b74e0755da

SHA1
587f3d71453abbb226d049e4ac15e2ed7b25b4f6

SHA256
eca1534c114187b7177e6c72481b2098f59391d0b0ba690cb3d625067bbc0e28

SHA512
278a453faeddcd40d44e078996fe33cbc79ef6bdb07a014abd8ebd4ca9e355260c5c55579c9d024797583e970944b5d22a911b2bfd81e483bf8e9b9d5b5e6377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a7d149ab2e69cdb02cd7bdbc09b3b9b0

SHA1
179efc540abebc30c71f1266565179fb39a3b769

SHA256
9a1a238585909a51e42c7a9f4b20134655dc50f2d53426fc2342e425d0ca557e

SHA512
0999d15220f6bef22ee3800088fbfb11ca8bdcfe14756294ce009c45c684238ef6e8de6966c3736abcd778941086c07d5c7fabb4af54ffd7692978cb04e4097f

Download Submit
\??\pipe\LOCAL\crashpad_3016_KQVAOCAFGLBCXOLZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit