2d10d2146265cb51bea8c6a1a06c5a1ef47b3b9b3f1d827749d45348419c2910

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c83a3c662c9a955732766252951634_JaffaCakes118.html
Size

301KB
MD5

65c83a3c662c9a955732766252951634
SHA1

7458180d282f387017be45df97f5bc63683d92b5
SHA256

2d10d2146265cb51bea8c6a1a06c5a1ef47b3b9b3f1d827749d45348419c2910
SHA512

4b99b80d2a502905d46a21b92e5505fd74a41183ea449c94b6f7190929baee9c4ec3e3924f91c2d974ecb3ebb71e2fe54bc5b09e88bec15a07791d1176bb70c5
SSDEEP

1536:RD+SbTTF1SjTo5NkltM/jVII3IbIre0E9xmD6oJYJLnvsWWMzEA3A9dE6iFisbAn:l+SbTTFT5ItCVI2nvmcDiTCH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1388	msedge.exe
1388	msedge.exe
2464	msedge.exe
2464	msedge.exe
4336	identity_helper.exe
4336	identity_helper.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2464 wrote to memory of 4724	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 4724	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1460	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1388	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1388	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3960	2464	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65c83a3c662c9a955732766252951634_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4a9b46f8,0x7ffa4a9b4708,0x7ffa4a9b4718
2⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
2⤵
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
2⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
2⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7298021756761418211,5869030156138678615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
957d7a1565ab9b01a99a8eb1a5da7c13

SHA1
2e1d38d8235480fc71f1832976981880eb758751

SHA256
15b093d929ff5b7750420ed314d70fd22f35ec32f806cd82912aa1dedcbdf0e4

SHA512
66202b85deb788b6a5baafb0cd40aa68dac218324095a71bb46656ed3b6163633e214a261e49d0b013f5bc182a11f4a857a52f950e7af5be0f965873fde47454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
38440d990ddffed0d9143a7e3021c540

SHA1
fd702c50ff83320c0df511f8b918f57abc637ecd

SHA256
7552f2eba855e48f1bb7fc31cfd31b8e11dc324e959ab1e12d39889351d1f16d

SHA512
d1f903f5b93ef293fddc23010d9f7182f74dc0640715e99dadee64ec8e08e446ed2b9cdb407742906d599397f5eb501a3983ce8c39c3b0a43c822a4c0b60d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1647bbac4e572fc2229f665587049a44

SHA1
dd0f67c91399a3412dbad1bd9e230fb55c81b201

SHA256
ce8ae1c71ca98b4456238d92d2839f18eda2eea9ef676b96203eb2cdf65e0aaf

SHA512
6d8d0066c376b70dc9c47a97540d45ae994c8c96499ab021e7ac86e2b19319976e109a8564be5505a406e6a9f8452cb102c8febf36a1fe27977910015d1981e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c1e93c608ddebf02b4fdcafa538330f

SHA1
ba5a9e94788ec98e64a19d14a31234edf3d62484

SHA256
93f205cb40c5e0a6819f00d6e2cc07117ae7e4e186a4aac6ef6d1ea49869b3cd

SHA512
65a897dd266d91791b1ce2564da408cafbf4f3ecc67248efb262635c10c6dd516b2ff333304ef5afacfc53161dd9aa962b6b1a085e6180c4a07f6c2250a4015f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af714ff27d84f5dcf7c7dc3bf67bcb09

SHA1
6f9f719446547f9f6d835eb2e1306da3fffc2dcc

SHA256
f2a5bb8cc2c8306392bc35175cb480567d74446e70010f2ab35f8ca36d1f0ad4

SHA512
7e40140db02959630c99e8262f5d4510456b7002ac970b510b18526bfd353ed0195db641bcec3dc37673ff517325b5c4b60e3897772eb8a618c3ae6bcf551b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da439f66df271bfae9df05cc43fff402

SHA1
938c5374eee676bfb7f1045e7b96f17de37540a4

SHA256
0621bb0152db0f07ece8bf524e34a6ee9408dbe6bc17dca8272528aba16ca085

SHA512
4627626ea97c1cb58461d0e32f7929c01b08d043da775c29458367d7fe449e35e11d4eb1f3a3715f93320235b0b4892ad4c8e5a5d770c90fa34b56fa40249156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
629e8e4c5d4d6091a71f95dbb9d3f9e6

SHA1
c0804dd25f7a288e6c23d0f0b43007ea1562db80

SHA256
72ba01a1a641c0d3c5623b669efb20f695edcabbfbb1113257d44831d9b5e062

SHA512
967fefad3a04d905eda16644a8b31d67867dc0e8237adc40d906d635377540d3b651ce256e9b0e5752edd51eed8f94fe75455a421c67c39ab62853b1e4ecd81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
4cbea42ffbd9533001201544a7112b70

SHA1
5c480a2f2f60de4a49e650f62ec1025c2164eb0e

SHA256
12434dccbcc48249171cd00b1c6fa7238dc16ce5aa821df33494630e53e72db7

SHA512
28c92990e489b2c483f80b559cbb11982a4396175c4ef9f8e20b5fa812de1471a8e193878ae972bcdf058c72d9ed66e40e925f5aea3632d9f7a58293be90ce39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c062.TMP

Filesize
203B

MD5
bfb34c680073c0f1040443861bc2be5f

SHA1
00bae5a3b14ad65bcfd8cee77f016de2ee171373

SHA256
9fb814be6d76f913370289f5976352118069346d8247c7512564133e4e0ec435

SHA512
9ff2e7ad68a5ba04d2d0dd8483caf950f66cd5a51c65a1ac9a7dae769f5fa5d7e28eeef2e91f9f34a35a4e487b432b81beb92af5916151e89070fdad63ee3082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f21e8d91f4e1fbf860744fc462e262e6

SHA1
1b3ae59cae17e81feca77e716e4292157dd7dcc2

SHA256
09d0eec6c4af2a334a6abce469483593595ade0b93c9751013c380e2d613e5b1

SHA512
9b4a24f661dc27ec4992448152cd76ca288210bda5b276d9dc46c6be9c158e46d2a9553c6ffb99df86cb0544a1fdb8e82d67817652c54c0b0e8abadd90a4fa68

Download Submit
\??\pipe\LOCAL\crashpad_2464_LDRKWXZZIBAHQUBM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit