8c76ee4c91b67eb9c1dd3da7277b240f5f18e0531792f9a6a056513322044e84

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d2c9100287d4e1365abba94e406c98_JaffaCakes118.html
Size

147KB
MD5

65d2c9100287d4e1365abba94e406c98
SHA1

9ee4563c5bb2c60a5cd13fcdbed908b0596ff4a8
SHA256

8c76ee4c91b67eb9c1dd3da7277b240f5f18e0531792f9a6a056513322044e84
SHA512

37e17318dbd4094b26f0c77a1f4ec9bb5c66e447d3bcf6bf437fe9e5450560e0c03c84f427d0549185642bde653375aa969f03758d3711a2c8da27b9dae479f2
SSDEEP

3072:pmweSC3o2UP13G4k5QhLpOatVSqTlP2aEkmz/fNbYaaLStR6xWUu/v66sbsGon42:Jvr3G4k5QhL8atVXmzfNbYaaLStR6xWn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4796	msedge.exe
4796	msedge.exe
264	msedge.exe
264	msedge.exe
2580	identity_helper.exe
2580	identity_helper.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

264 msedge.exe
264 msedge.exe
264 msedge.exe
264 msedge.exe
264 msedge.exe
264 msedge.exe
264 msedge.exe
264 msedge.exe
264 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 264 wrote to memory of 208	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 208	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 3180	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 4796	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 4796	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe
PID 264 wrote to memory of 1556	264	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d2c9100287d4e1365abba94e406c98_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8107b46f8,0x7ff8107b4708,0x7ff8107b4718
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
2⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
2⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
2⤵
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
2⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14437689667360946083,10158461886927957376,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
0e6bcd220bd1cad2477ec045c576f33f

SHA1
1f9d4f21c10484dd4acbb0402578416e6b41399f

SHA256
89b81bfa12abf4fe0044ac882083391fd6b2b58b005e450446dd55e651c75292

SHA512
e8c9c16145d03d091c57dc23e53c9e7377bbb75659e070cbff2f8d0978f01ed19795bf3d48099022656daf4406d3aff6e4344d728abe672960a170655d3c1958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
cf1b647d81d71988763a17754e789ba9

SHA1
a540c076b0de882f7c926a533014284c293d2c1f

SHA256
209922f7e00820c8bcacb5547c61baf66b0f2b210343f80ed4ea3677e9eacf2c

SHA512
a82da933e6dbc99e3fb1c2fdabaf34f9a74c410351f6e6b75421c013c58819a951485030d2c8d447000f341910d9bd03cc927e70e911dde69570834c8f2cd5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
ff0568b5e599bb838cf7fa82a7fd3800

SHA1
696040ea04c0cf5a7f14776aa3e9fc4d1fb90f82

SHA256
385d6e4f378a487e1204dda346f26fa6ca709437e7bf6e5bafc177505a2c91f6

SHA512
df3c43ef7fb8a845e11f044b21a2f09c9a25f8fb676a662aef2d0aa202b27b9311d06c0bcb4b811cbaf0354f6398e000aeca4bf53292cec3b1c56a2b26400926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
e03e4e449c51958119891d886d652a85

SHA1
d7091da39da74982721001e7fba61e0c8cc1496b

SHA256
b344c05927501ecbbc63206e759c1cc17c08a05321e500ef167c1e02c3289ce2

SHA512
edb0338289b518e905c74dd6ca7007df1b1351665c456c3fbfb8c20e396ce95b987445dc06b184f28679c56fe9908777ac6e69a1a2f724c5a785fd67e8532883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b7efd105068c898ce0e4c851624b11ff

SHA1
6c38482dce7d3aa9fc6842548d7cadc3802a43fa

SHA256
e23ff19ddcc21f43f87066e09d2d96bd50bb3070db14a5050ef9d42498c41279

SHA512
f231aab277291f9d7e0798d47fb12a1ba7bbd1afe0b0a8fee12b161165f42abe8e57fc664f6c511e94ed4662edf980a0bee8385a92bac7b7cdfc54257871c068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4a635728d960cb8e86df2961f0ff7f85

SHA1
87f9702dd65d21aaf0ab86cc241fdf49631667e7

SHA256
19d47f1b6f29c35334d5c1345a82a9617a0fd926b9a977996c149f4b1bbb35f0

SHA512
8d054f10ecf68316c91506310336ccb6acc55811d2497f2a481ee3e5188f87323df9a5308c19fa641a31f86b366408e8cc2883f444db85630560bab56167b69e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
fe3d4c7c72799b593696308d122a355d

SHA1
619e965bbbaa87671b1058cc3b33496deac52229

SHA256
873ed5d2a98df13c95c7da858f833e1ac5bf3c81256210fe9b17c4e5aa9aa63f

SHA512
f93e6e3dc689184557230f632592c5d6dd5a8d5b004ddc6dcbc5837b1658eeff1e022f326bbb160bcbbe963984f864a33ee1da345e87d09b170fd9b36f6a957b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
97eeea3d0c8c5ded2ff36f9b629f43d3

SHA1
185b7c930454bf6acce16308d6298576687ded4b

SHA256
b79516a0b6fd97e0c18c473df13cc5f303455bfb7e348ebb11af4c46e1f328a6

SHA512
3681283b562a7001293e67cb2c504e41432f130830bea38f4e83611c494577daefa20a13bd8f9957e154d2ae0d2f06f5f189cd6d4e4fa676d1038e7fd44c72d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
8484eb7f16f48af63456b8f709404388

SHA1
cf453cb6e66fbc95ad374ea758223782cd0d289b

SHA256
5f85834d37ac36393179609236f18ec9aaefb4d09870c75cd79f6515cff9e122

SHA512
838e2c82ba615952e505b519df3128199108fe28002e0a5efe4a27b3c22f905be67fbcc67f6253b98daffc403887cda0141c8cbb06217d80ef571518f6eb2d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580710.TMP
Filesize
203B

MD5
c8cf440a75227ce16664d715c8e52f74

SHA1
cbcd7e70a14d4a3b2dfd9a0cd37a1cd0a8d87941

SHA256
80746417c2b68b67fa921bf7caa18ab11d5fcb6ae2d37ef1c90c8bb59ee03d51

SHA512
203804a5ba0e01012afcd0898493eeec459bca8fc16f8f2b65d8f13c6fb588844a6e1edb32f64e430b5ddc78e3d3a9e3bcc5730e796f757eba8078a8017f0b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2f658febbfb466de3fadd46fc038d197

SHA1
e133b2c67d422ae1517b22c0ff3147bdbd171a4a

SHA256
d4384d493e4862384cb5b7293ffd1441de186f58e098bd6b056cda694743b960

SHA512
0f861b4976303e7681169294bf57eec170264ae76bc6edf55eb2985afe3230e4e1754bd98082b3f1a1ed1b7c729efd4dc9b02daedbf6cc47739ea896c20f58a4

Download Submit
\??\pipe\LOCAL\crashpad_264_VMNWZNRGETRWFXGQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit