9fb671e1f3c226f909352049a0663595b2f978682668999ca31f951cea4cc136

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e15e9597a524cf7e2dcdb3120e2672_JaffaCakes118.html
Size

105KB
MD5

65e15e9597a524cf7e2dcdb3120e2672
SHA1

56f5fed33f8da0a202a0e7f6e1df842729365f1d
SHA256

9fb671e1f3c226f909352049a0663595b2f978682668999ca31f951cea4cc136
SHA512

e772de34dc861f3f36ff4e706dc5fd4684e57915797bb470645e6dee96f1c7eae96e5169582883f19361cae31f3c991d2ca747f00d32babce66f54189f4947d5
SSDEEP

1536:WJp49RUHlgvKaXUP0hwAuawVjsyiqAUFrAYgThPXYJtSUVjlnt:Wz40pHP8wAuphsyiObgThwJtSyt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
904	msedge.exe
904	msedge.exe
2564	msedge.exe
2564	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
344	identity_helper.exe
344	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2564 wrote to memory of 4692	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4692	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 3852	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 904	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 904	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2040	2564	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65e15e9597a524cf7e2dcdb3120e2672_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf08346f8,0x7ffaf0834708,0x7ffaf0834718
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
2⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
2⤵
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
2⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7008 /prefetch:8
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7008 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
2⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
2⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
2⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,208958927342895920,8191319876664449972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
2⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9b1adaae79ef7c2b14c4bae2f7a61f6c

SHA1
4051b590fcdeb11f2a8d3a5d7188b08941753b49

SHA256
e2dc26eea7ed94566265d30a075216501ce7097dd0501f05b29558c70f4f8dc6

SHA512
2910bef14e14dfb7c9035ac5f423a16263b2f5b95657dc226c68fb17731fc73dc3ce76731fe008bb29b5666634a82638126ee6e2c836522a49f5be45438eb5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ca4e274b44069826f581a091fbe5368b

SHA1
77fbad51c84c97ceb731fbfd31532aa244095a32

SHA256
a8029e6cd647fe1f51eaf6154b0de0434ade4d285958a798c0ed0bb1f416fde6

SHA512
ea08f590b3b00b475c3f9464ba9b800ca302f11f1bab242b8412ec2605c063febc0ec0b5c1137741ea07aa94515b1fe4e41cb5cba2a66c3a366d88db6d7c1f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
3774c60281981c02d3c4ebfb3aed1d54

SHA1
5e15a69b82fa3e99a0aee8515fa9ba1d1068c123

SHA256
df4ad79f42fc34b93cc3c2a9c4c99f2c9537a9a67ace16fe600ff66012a2e4d2

SHA512
038e10001e947408a772eed2c9c2f1b2169f5c9f6fcd9a3023c1a785069d3cafa62e15169857ba9428b3d2d26b208f1e3e0d448a4e4e8657f09291c55369a255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b06df0b3f0c35e90c7ff95083e0fda85

SHA1
cfaafafa561088b3463de0f809923976de98c159

SHA256
16e28cee0658e03e40ac2813c9a3fe8fad44b1388062d568439588c7a6abff90

SHA512
05ff6ee6c2afc40740c0bbee43e2ccc7658693633f305cb5249d23ddf24312229cd6475ac41d08e65ab8f087cc4d1fd6b35b8383c2c51dba406483fb48220ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
501e4727d6e47c9302565cb9dc3cdcd6

SHA1
39535067fc6f9c49322e5ecef79d731e0b7016e5

SHA256
9c463a538779f89c604cae705f39878c88716a91627f2269b0658f47ac326b60

SHA512
2f89408d2951fffaac2f0e50a73246fbba4727022a04859a7dfa039a5b78f7e5aca24ca81137443c97cb5fe9f29149e8092298489c1b12606739c86864b3cda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cf6dfef6dacc93da40d0b3adfd8e534

SHA1
824bc1c362b36bb5a70c8f255e9c0a04c3ddb6fe

SHA256
fcd9566eb7b1f2fd882914d027c450d176e0b75b148d27b21103b771f02a4a10

SHA512
a7387c56cb2562f404a73d9c95d32a042d885b73beeea61b77bfef21905755b8a1256f701c7fc07c5f1cd5d3a692bb964a9b00225728fc262d6dd8cf294f87c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7bb9321713469f92826bc4cc40809ceb

SHA1
f831675ca1bdf5e286457c2144b7956281d7ca95

SHA256
1ade2c5074a713de3cdf65317dba71670fff973ea82efcc0333000f4a7c9d81f

SHA512
b0d54f088ebb055377e933b6c1557ff93abde22a24d8fa4d5d8f333922b6cfc55941dea214917e38cdef39bfe21c655e1382d00ecb35c5fc52480340858f1ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
05eb9e98d1200cf088f2edc49dd6ae8c

SHA1
1819e11286a808b2b2c6879c77c3c4518562250f

SHA256
1a6f74cc81031fb7bfbf0e7c43b190a6ce553eaaa521118fe9a8674a0ea5669d

SHA512
b0a1dce8c401075ad4ebeef9689158b04d1d32afd721c9c41661f3e27cd07787348bd3b3c02ace6bc236c963940482b121cc057127337408c30170acb97e6a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
5353d8108c58ab37c3083e6dc43b0ccb

SHA1
000466ae4229f7f64704645fc940444396ad6818

SHA256
5996b49097f42b253661ad9adeac6a36025bd667cc33b4281f38ecc33eba9a0b

SHA512
de54c86760eafebcc4f750072b4e5bc706991d5f76811a52631e4c2531822218c34f595656a8f0e160e41fad6940d71deda79cd0e0787888eb87d2f26b943f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587c5f.TMP

Filesize
201B

MD5
7c4dc3482112701bc9dc0466b58ccd7b

SHA1
1c7631d4fc91ef10316b8e3ad2a8220ac670521d

SHA256
8e106caf31eb7600ed54d85f1ae4fb8730450bab696a4a1d6307d2452d71e042

SHA512
65475f03ed905d380c3b03887f80c49978167bc863c813e3c15c80dbabe5d68d881b4d1591d7e5478ff8d436a2474006b67828c51be73b2bbe700c32bd0d8f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1fd951c2d522d0b2f13b41015cb3a8ff

SHA1
d0bd51d74a1e0993dd8c2ea99026d7469ea2b2ec

SHA256
8667ee13e6a044cd2e650767ab120d010109f65c390a70f13809e6e021e23243

SHA512
7a9e23ea525fe2d2197cd21795f881c784c7fc53c47ae83d3575b1f4e39d0ed6ede97bc245e98721aa69084b2f2bf31b6ee86c295c13c25555b56f0271794aea

Download Submit
\??\pipe\LOCAL\crashpad_2564_RRYTXSRCOQMKEONC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit