8b7e2405f50711c24c9669dac39dfb1dd207adab6dbaf193269249c7ef915d8e

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688f07809a16a8fe1b7e31c2e3cd7ae1_JaffaCakes118.html
Size

71KB
MD5

688f07809a16a8fe1b7e31c2e3cd7ae1
SHA1

bd2b1a7d4f037eef677847d7fb4973bfefae3b38
SHA256

8b7e2405f50711c24c9669dac39dfb1dd207adab6dbaf193269249c7ef915d8e
SHA512

009949648b49ac6081b9613600b493bc7013ec1f6d5ca1626edce5f57cf7a835f36892dc66dc441edd07edaacf2b4cb513da489cece835e8c5d7b4df1f4f6c82
SSDEEP

1536:J9UxX42hQK85xal/71a3pTXPSmUv1eOhahbH3GRXueW/EQvcYleSledJeVKelezY:WNhQK85xaN71a3pTXqZhG/tCyL+4ri9U

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4628	msedge.exe
4628	msedge.exe
1124	msedge.exe
1124	msedge.exe
5788	identity_helper.exe
5788	identity_helper.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1124 wrote to memory of 4140	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 4140	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1568	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 4628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 4628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 6040	1124	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\688f07809a16a8fe1b7e31c2e3cd7ae1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
2⤵
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
2⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
2⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
2⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
2⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
2⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4521846274599365184,17402054230841544641,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
78f286b7d4ec4b1d5d7af6545fcdb693

SHA1
70d340a40d2ffb98fdb428a6e4dc9a604cc34b38

SHA256
84d239f93bd1d2a903eb77b877ff9467644f9e6b653c4dbf26146ad315ff9014

SHA512
f8423e7a078c2647adc56fe8139e2e3b501a00e533fddbcfcfe08981e6e3abc6153e3fd059583a67bd71a1dcec71397bde831ba6ece9c0ff11dbdd211714fed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
65f753118f6549778ed097f86d44e0d6

SHA1
3dc1173e9d040cdbae655f9928cf6c673f52045c

SHA256
ec5267d6a9db76f2621060bbc382f0460d4608f7b0621f93b265751782e5d33a

SHA512
59c4da825605d1ce1b370aa3853943f3805dbeafa4d21647fd8facb3afb7d5e71f61692142b81d75ab18cdb464b27e1dcaccde33c12c1712bbe597fa8c517532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
262B

MD5
8c5bd48250406a0ca7eb2b3c75adb820

SHA1
ffeacf3a1eb1e0549219b6428ec4af8c5054e060

SHA256
a13323db9208c5d8edff0eab641bc5b9ef44044a8b4773b7e026661388089e1b

SHA512
b58eebc062b32b6c526160393b9f8758024d09a9b14c0583f2252effb82bff52b83b48efdd10ff814c04bb417e93eedf5bb27d14c224681084ec64b27ae40f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
753fac9cd94759b747415c4eb4d0bdeb

SHA1
6b72942bf0c1ec0d160ca19dbeb7b9dd449a9466

SHA256
0f8960fa33e41f157b8b023d19a227f05da77d01765abe96dc4e124711316bbc

SHA512
a21aa055e0e1e378c67f051a076f8379b71836fa2b3b09bf0f0adef72038f21fbdc827913572ef6935c047babc8a42f36f5175215d119e2057959b2a29fccc09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
c07ec0c16df495a40d65b8fb66232ef6

SHA1
dcc4a3638e74de7774e71aee71cc4a5059cf00cb

SHA256
3d0a1d10f802030c0ebbff13c19d7bdb966dca9471cc6cd15f67394ccde2f6a5

SHA512
ed8f37eddfc9f4d86c0fe0087f9444177651ed349c141c0a862d145beb9de3a06aafa6168ba8b7bc4765863757abf90bde4be788fecca6008012a6feac49894f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
773e5b5f9688daa599135d4028ef63f6

SHA1
4a248c66dca9f25883310ac3354cb6b4d54bbc20

SHA256
28bd9e4e280aa3e132004e5c3e1d7c477a85305e2c2c1c3da5866b93dc7d5379

SHA512
554793f2caa81f7883b90bfa1521b0dc4729bf11fb336b0cfeabed32b5bddb6de5b178f564e34bbc19f7ae3f6098fb801f7277f323ed873c25bf8fa6c89050ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
637238a4615e3cd96e27530eaf663433

SHA1
2373c46b22cbc61851aafbf5ef9e686467104690

SHA256
4f9a241e68453bc0f0719a1e274d2c89c04328caf10cc20a21cea1c62e29fa98

SHA512
270c3c70420a72d6ded714a508121d026dbd59b24d6337564b15e0b4b9e8d1b90e012869aa1322bba20a97240e10919deac158e549193434f9d77d7c1198330f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
706B

MD5
dde9e8d5a6e7afc2897b93bfb24c0991

SHA1
be130fdf85be21e55f0c9707791c390d1eeb65a5

SHA256
a62594681bf9f23449eefd4103522f794abde1885141ddbe6912d973fdab2baa

SHA512
bafd09f9fa2f9ab78f7b150532ede885edc53626c9a992a7147956efdc577c9dad2903386d8b8727c48c623245119ffa3ccc8e73ebb62c87a888c61ca5e04a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
5bdf4d623eb34bc910eb78d28e3c6a79

SHA1
9f1004122f233938951780b06ae8858c8dd0ad00

SHA256
cd8c75e672289a96e83eee170159134c1ec9267b01df97a8a96a55366458928b

SHA512
bf224f785961482fa39bf930c3eb41448cf5bedc7e61e86d87c084a1784828f4bb9d626c2e9af7bca7ff79a9def0d89ef7a41355bdce1e40db8a7dcadec15c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584f92.TMP
Filesize
203B

MD5
5279823b7c14a19f9d01c40792a66f1a

SHA1
e5249e4a3e9bc3bd7da8b155c0539cf4e39a7300

SHA256
eb013bd1c9bb8b55748430f1ba1bcc3cecb86457ef4346c7b77bbc7d07a4e873

SHA512
a2d9320fcaeb6822c32a24c60475c34497f7dc9ed799847f6e3d57d783be315b920083fbd6e424abf89480cb7a94be78a6e007f71d6e73d7399d99877631ed1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
04bc0013637003b4d9ed89b277555a75

SHA1
59969ec09e40bb9b07610368df5935fa4d6c66ec

SHA256
3dcb8e3ee4077a47c3f7382825815decefea96e3a1d1974f5462f40531cc7eb9

SHA512
b9a267bd62d42cc5c0135a89ed78687690a72515db861262e27ec0b4eea92c097f8aeb2e83ae2944752cc60acc1e662ef2a7726db2df39e6f01f6812b5bc1632

Download Submit
\??\pipe\LOCAL\crashpad_1124_QIRQUXFOQRTHFFLU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit