068e0756efb10f6b5f09cbab02fc9063402eb19f32a9c5e771fcebbdd942c05a

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692e19bc4d8934c7dbf2c81a1dfff1c6_JaffaCakes118.html
Size

27KB
MD5

692e19bc4d8934c7dbf2c81a1dfff1c6
SHA1

234ffc275e59e88b95fb4782970c1eea7ac346b2
SHA256

068e0756efb10f6b5f09cbab02fc9063402eb19f32a9c5e771fcebbdd942c05a
SHA512

fbf280bc27ad84340a9262aa24b4a0f9f99f6b79f7fc920373faa0088f98660ee7ef6da383167319b1ea32da8d2b0e3ccfb327eb5002c5430155cc87c7237cf2
SSDEEP

384:aZOQpsgEuyoHy0OKqXrvUvkM69x+zBFyqSClXVb4:MOQpsgEIHwKqXLU8MKMzjUkc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3952	msedge.exe
3952	msedge.exe
3108	msedge.exe
3108	msedge.exe
3012	identity_helper.exe
3012	identity_helper.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3108 wrote to memory of 1088	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 1088	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4316	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3952	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3952	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 664	3108	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\692e19bc4d8934c7dbf2c81a1dfff1c6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a64718
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
2⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
2⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
2⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
2⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
2⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1123822078670684954,3853783671468279320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11428f47-843d-4b35-a5ea-4dafc3a16f3d.tmp

Filesize
7KB

MD5
2eaf4076972900587ec1b154c9cbaa05

SHA1
94d11d8b5b018b4f90b578be1ab377de2c9ce516

SHA256
b7c6d318cb4652cdd441b63ab465344abfe957b60785d29bf034cb77c6212b47

SHA512
32eba5fe6b7c6165ca8a85b498d56a3c3755bdc89750ce46ee841cd8824def3a4b510e24248d9b1a3f21dbbbc5471d7b282dda5b46ee7e77e8ac626e5ff1588c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ddda04a021cead6d92aa33396dcc08b6

SHA1
fbe97b9717318d192aa23e4597628a249ecd3504

SHA256
8678e624a58ebe7c1152bbad58b8b58b01f4cf8e64a1ce8f4a4d9a8761f00d4a

SHA512
d7f15a0ba1d8b6512d389258bbfc469852454390aad40ba5994105d5d3425e1b7091fa4a691abbd101f9066e02532c1225093701a40f3920fbf58da2a97ae7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3251b7d6c33ca99b0855f3e0abc3443c

SHA1
763eb78858ff9826903ece2d41850e1fcd6f5393

SHA256
c21f53e3e7b51ee746a7bf94df6ca9e93028f5fd9181b56b311d17fa6e9ec810

SHA512
cf17a716f2bd56dea699479c76334a9904aa5773c8fb9eaf763ff7fa2c8076cc5bdb464bcd4b1b614f747cce7b71af49eaf5d81f8a6c44e2baa0a114973ba2fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3a9eb0d5ffad3cc7f416bfba408dca3f

SHA1
96461f3bd5381e1735b973b80c4a21dc79169b2f

SHA256
551a414d4b49ec76f81ffc5e41e64086523959edd74dccac8634f93e44d0504b

SHA512
1a9735b01b8587f01d3f44bb0470ae3d304fbb6ed53a1b7dc951ccf13749c86e89ad73b9b8df8c0a6cdc8923fff34402fffbe35360fe82e01b1cbbe7e050e6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
805dd01c78b25e9af924d2f0aa35a1d8

SHA1
f32a78c76b50b51ab15e40002ed556fbcd33c081

SHA256
80cb4035d74afce4397afbf3196a86a5addb6c7789a75786c74e82bf4684863f

SHA512
7b634aa9ddf97bad0b12dc3d65255242adb4464e0fef1ff0a492dcdfa17ac6ba7f586a7e0a42badc6483e056ffe1ba8b3cb87cc0205ecb421a9dff5f2299d0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
38a0e9519647ba5c22ce7d3ea1c68a6a

SHA1
1962ff569f0741fbf2478c4c5ee6b21ad4c3f92a

SHA256
4113219997470782314e7c6cc86f274a0bf4c27909b19adce366ce69d9012262

SHA512
4ad84b7ad63a82d4378c51b06c65ad77757e59746539befbe6ac26c04b8d23dd1e6698ba2588f482a61ca2d1d057d3bb58dfba24e3887cab036a5f9c030c2506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9975d3e82455d380eb2c6e14fd83f155

SHA1
4af7174cd1d2397104eaedec325ad62cf7ab5b4a

SHA256
34f86f1b373386ce06565e0362b7d3587f1bed71f3a7d7dbc34bca36d03e2212

SHA512
11dc02652d3f41025603f1951a49987b32b6d15866e15d6f7551ab7468e7e84dd6e30fe741e8b1f851bbdd12fffb1400727c6b9aaecca9af39d3fc4c23479004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
ecc6dc6dae3f791fee1fe00d23d0aa4f

SHA1
6f39bc00873a4f2cf2d52d2957b36b306ac6e766

SHA256
1cf628b16df00449cf63b44ebaabc857254485f6d2e47bed7f679918e7a98f45

SHA512
2a5a6a7b8bbc0911754659410da80395305b2f1b07632d9837692dcfbec0d0a1f63e637fd66bda8b2f30d51463cd052209caeba48802290713ee1629abb0db89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c0c0.TMP

Filesize
203B

MD5
2abcb229931e3bcb7dd911f8208c53e9

SHA1
70d3892a56de8bfd40b2ce84b74cedacc45b9ec5

SHA256
7811bed4264fc9323c48907b01435cec3447170cff6227f17ededb485955b879

SHA512
1cf2687acac8f525305b7ee99337e187d33bd3c23290ff7978736f4da9c6013047705a265a426458353b4052f49c62203e37d51b9f3a06849f037eb31e7f5be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc67b0c549b52f9e8172a96ecd8db24f

SHA1
fafb6654c5d8e5233ea37cfbda6d0e09e3c3e3ff

SHA256
d519dc7e706ee7301661cab71c3b6b0cc22f1ebf011d652dfbbae85dcab2bc4b

SHA512
c3f87fe80d0130abfc9af2d443587196d2a5d022200d2ac3f4fd5a93634c3b2295b7de4e96c453b0c68ae7b5720521c14feda703ea191f20a9e200974f770d3c

Download Submit
\??\pipe\LOCAL\crashpad_3108_TNZJPELIEFVYUYHT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit