deb54e7801dbad23ebe43404ad8a531d770ee6066a4eb80f6e5da9500bb515fe

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d536614f46b955a32b71c880cece57_JaffaCakes118.html
Size

76KB
MD5

65d536614f46b955a32b71c880cece57
SHA1

d2a9b5db152736cc6f47e7754f5987ee0c691d90
SHA256

deb54e7801dbad23ebe43404ad8a531d770ee6066a4eb80f6e5da9500bb515fe
SHA512

e84dd090c9788596be0173e3eedaf1a1ae5a560cf5ec69d3ce57e156dd1ca1d43b8f86b9b7d4b623270ca2797b5f0fc4bb6c86685b9d12d773133ba2bc3f1ed2
SSDEEP

1536:5Z+HDDlzsVpmRySTptEx5SZWMVaoNmDMB6CA2ncZh:L+H3ZAmKx5SZWMVa5DMB6CA2ncZh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1284	msedge.exe
1284	msedge.exe
3200	msedge.exe
3200	msedge.exe
3808	identity_helper.exe
3808	identity_helper.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3200 wrote to memory of 4684	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 4684	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1400	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1284	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 1284	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe
PID 3200 wrote to memory of 704	3200	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d536614f46b955a32b71c880cece57_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8797646f8,0x7ff879764708,0x7ff879764718
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
2⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
2⤵
PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
2⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
2⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
2⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
2⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,12392067787326079410,15871469623008814213,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6500 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
022433e92121e6ad5881489c989ec63f

SHA1
e7c1a97828604fc2f37de691535acf4eefdaf444

SHA256
9e31b928c39217d685e4f381235f80e06379af99e860a0ffffb7d0a1a0835a08

SHA512
cc0351cd650e415a9ec74981ee8cd38d1485ac9832fe924693c64417422f3287eb784e5d74b58c31cd0326f1a1ebdbb520f4753e7867d222f373eb36905c69b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
126ff465c696a0e6300401c78ea830f0

SHA1
1c21fc402dbb463dd236bfa53c7e513174f26cbb

SHA256
42521510220a3f0e15256f2ce7efce31694f302d6543b8ea80701c431e4d3f2f

SHA512
56b50d5495bb2f56b40377a06f7102cc5509965c661100712d4ef31828e311cc5d40a266f4baac1ddfa7a1c8c25f7eed90d2037eb213cf7d423e1ac593a3f63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
178083b8a0b7e6c2206ee018e1abb1c9

SHA1
14dba465e68fed8d91d8c8bdd5974ac562e9e759

SHA256
e4e45cecda8317d086286b9252772eacdfea2f7d29b588b8617556b3e66ba0bf

SHA512
5276d83d1f6daf6d1a5ff50f27e8033e46e2207ee47a7aeea9f8ee6e0c52447dac9036e39ec4d9627d80903e54f65bd09867ad2bbec239704f5d12be33f5b7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
685a243f6bf8501585774793bab0e9eb

SHA1
026cdaf7652aefc73960bb1c5adaa0450a53ef90

SHA256
a00b6f0e3378da4aabf459ab9b21e086d24eb5eeed445a8075a0e975c0151e14

SHA512
3b2ced74381c69adfe6e9a0c327cdab0ea64fd168ea7bde7779097b4fd1e92d27435010354b111c5e0b72a48199cc32f0329da1a7ca791b86bcff19101a317b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
738b1ac88b1a6ea7cf96e3b97b27a78c

SHA1
f147d789085477b0e9159cb8584c1f301fd3beb2

SHA256
20a017876aa5cd9585f7bf4efa724ea16d2dae7ef5ea8a9390baf60dae80a3c7

SHA512
ec0667ea38ea4db10542142138d12938f36c58b3b6c96e1b039a47de2fcbd6acdc598096631b26b1833ce8d7eb4462d0df5103e895bed5d9be57400b498f2835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c485fd909db2c01df96ab4eab3b213a

SHA1
d3fe2495c11c729e8b55a04dbd33b111ff65889e

SHA256
d0201a3a019d355faffd4aa1d92b7d4ad467a352e10b05a2523b9d883016250a

SHA512
e674b34e51cd314a169e173babccf288ee5e45599a168748ed3ad88ea9e943d1c7624d46a2fcbd71e0b3bee31c2c0492514296154c0aabe057284366022627dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ca32bf5a4c98890e210bf46b7b1aa52

SHA1
0af36f9462ad82ba4212cf52befa1a7007f703b9

SHA256
bf21c2c9d058709aa3fe554df61266a4191398b858d8654a5cfa70ea74b5c036

SHA512
9f0bb2851eb403251f2745294538b5c0d0562b4943b4a0df54f44ebda45ee6caa973052de912b09e0e559ed339e0fb01bd3dfac709f906aac5ef205e5a0d7102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3dbdfbd4afdcf196d8546ec9c25ac11d

SHA1
acdeca88ab72ad18688e85dbe5e2361246ec9037

SHA256
b636c94f1a5139094f529fd19f1b5a559a419f523297547362bdd3ddb3831ea0

SHA512
357467f7425da34c587cec3132953c74bf5f17669b7484f6681d2b527e4a4664a6e7ad8e44d76ba9b4d916155f89969b8c288b9c933f16636470cafb743078b8

Download Submit
\??\pipe\LOCAL\crashpad_3200_ZBBIHLNYPGOKEELK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit