b631393170cba83392f24a7a673059733556792675ea80778853cb7d7087d633

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

689a683539ede241b64d810a8898b3b6_JaffaCakes118.html
Size

213KB
MD5

689a683539ede241b64d810a8898b3b6
SHA1

2741889003a38c0859ac76ffc5eff3ba7c016703
SHA256

b631393170cba83392f24a7a673059733556792675ea80778853cb7d7087d633
SHA512

864c5aae63efcfd2e693711bc6fa6079a5f6802a71fbda9ee55c2e4fc1203b2bc0569926ff074162137d25b29267324e288455b2b7a4ef751ec85d53c6784896
SSDEEP

3072:KZsWcEu2ve9OZFk+mG119rCX7CeasnKI7QS8ye8ndGKZ/:v2vFf5I7ck

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

824 msedge.exe
824 msedge.exe
2936 msedge.exe
2936 msedge.exe
1840 msedge.exe
1840 msedge.exe
1840 msedge.exe
1840 msedge.exe

pid	process
824	msedge.exe
824	msedge.exe
2936	msedge.exe
2936	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2936 wrote to memory of 3880	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 3880	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 2280	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 824	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 824	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe
PID 2936 wrote to memory of 368	2936	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\689a683539ede241b64d810a8898b3b6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd17b046f8,0x7ffd17b04708,0x7ffd17b04718
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,922402045978978481,793303964395414208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2ebe64eb0da716d1a15db8338e61f5f4

SHA1
0e3b48d1e6997935a7c3e7e4b675f53654076abf

SHA256
fa2f15d32a8b683d2f30b167f7b3d1d084f0ded46ccd15ee023493b7d5c3417d

SHA512
462c8fd726c17ed9ffe7d4deab96cdf313612a4e02eb88fbb1609aff133d320aafd84336ee50c84ce143c04f1745b94ee6057e892427f6b97bb0e51fcb7360ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
48a03042e0194c35e7f8fa02c2a48e3e

SHA1
26ac346c22f11c4caeffeaf8899c6e450943fac7

SHA256
925aa9c7007ac6df1117794b266c5d7ebacb5a58551ed74d69772e55172dbea0

SHA512
55cbb895e0608825ba8d015f0ef213c1cbb034bf0c38966297cb69643b9f3d6199394362c520168b491e320e38ec3b8f711096491e3d86bdefc81ed6e6daec17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de5bb6e8d3deb65a5ae5f3d9c9c408c7

SHA1
0541afec3974fb4c7487561a248b2417c156095b

SHA256
51ba8966ef7881aef94267a27b3944071e6b6ee04adb3c53b84b8fc09269b7c4

SHA512
ac7760e27df3430db0f2f40edad75b96abd645b13e7f914be5751ac9e60db006d02c283c89a627a00fceb711b89eaeb3c92a5e9b057347cb640ccc6ae44f90dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9818a4e809e476e69f3ae1b89ef5ef6d

SHA1
09304ba4c956d683b6844f759e80069b20ae2c17

SHA256
db260592fc5c432e3f4c07d779773bea0e86f825687f86512c76291a39f70728

SHA512
a009561ee40dc73d67c317391e21e28f962fb55c0c1444c82fb86fc29c6523056759a3cd8a4021abe424441400ed3eba11ffbb7a1de745727fb80912956908c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
78e34e60a0d9006ba35635cbbf57052b

SHA1
e2150274a930a63f488eb9c7ce081b04aa81d1b8

SHA256
baf8c7fd4bae1db58011b5086f51196f897bfbb18bef5c85578e44f0f7fe3df8

SHA512
7eae50f9ac86fd2aea998958c6adb619f40882d07ca023d3d06809f785cdfc00f7f1d0dcd2b42a6f8b8122f45337073b8d32dd1e851f6a404e7e198a7b701f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b4f3.TMP

Filesize
705B

MD5
bb88a10c9cef0a987b0be9127d5f7466

SHA1
630c8d5c65fbd5e3235ff40f9f880a477c638f48

SHA256
aaa98edd811464af19aaf36e96fd479132307464b1ed47bc4a2c86a0b67d367a

SHA512
996aa8b66bec7d7b190b64734a1d20300d37251ad24e1f78da30f6e16e1061febcefcd15fad1128b83f2ce740df5c7215f71407167839bf8acca4f55315bb552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12bd5ca65f8c05fe99d94667b5866100

SHA1
2c6a85c65700de26fb693a1f651a4b1be29e8145

SHA256
743c9e6a982995e7bec96982b686bf08c17979b76f9ebd570ee54f9fa721a788

SHA512
aa305393c249dbf98eeef0c5eaaf30ad109ba11a9bf300cbe119df8877873e7af60022f0c306da974ad2d9d7481ac601eb846757d84ad8702c305b1464c30bf5

Download Submit
\??\pipe\LOCAL\crashpad_2936_BZNVMHFWXRIQUHIV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit