35356104ea677d75c93e1065f11e58ee62261fa2ed58020cb0b98a8c6cf82503

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6918e25522541c53508deee3f6022655_JaffaCakes118.html
Size

295KB
MD5

6918e25522541c53508deee3f6022655
SHA1

6d044f9375a66a9122e056e0730e32b9da66844e
SHA256

35356104ea677d75c93e1065f11e58ee62261fa2ed58020cb0b98a8c6cf82503
SHA512

0ed1514a4ab2a2925bf726a929b790358e488774a56e0e9da89ff20301629de3ec3857bb25ba4e6e9fb2b2b4d8dd6a21859b8e8e215d4390559b19f9b3927e06
SSDEEP

1536:rD+SbTTF1SjTERNkltM/jVII3IbIre0aj2ml6oO2BJLnvKKK81wA3g9dE6WdqS5D:f+SbTTFDRItCVI2+I2bckiTCH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
388	msedge.exe
388	msedge.exe
1380	msedge.exe
1380	msedge.exe
4108	identity_helper.exe
4108	identity_helper.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1380 msedge.exe
1380 msedge.exe
1380 msedge.exe
1380 msedge.exe
1380 msedge.exe
1380 msedge.exe
1380 msedge.exe
1380 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1380 wrote to memory of 4764	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 4764	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2164	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 388	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 388	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe
PID 1380 wrote to memory of 2692	1380	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6918e25522541c53508deee3f6022655_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
2⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1548 /prefetch:8
2⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
2⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
2⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
2⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10932791245976516710,7237810034545343607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
b508e8f8eb9e584721d76f3d5ce8143d

SHA1
a7c2e39a4e4e54a6dc469631d94ab59f8305d23b

SHA256
4c577a7679ed39958b4b337737906f3cbad4e52ab8fd3a643b668fdaa46aade7

SHA512
19c35637ee5a7b147194c43755f84bc3b9a317099ab8d89b0810c5e99fb8b46bcde85ee7575ad03e3b7fe1d554d426facdb53f5e1bd95c358275b15440ff7c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
00866c9e8e5509f522a1945b99412494

SHA1
ad782b6fe6f7cc0f14f3e53aede97b4429a78d21

SHA256
95a2e3cd20542e0c417dfda11f7721729eccf9dc2b522e09df6916d0ecd5abdc

SHA512
3b8ebd4bcd9133c5c22f03fd2a163d71033e82ebb8c070cd753519d9451802f70e596dcf005a27a5f493783690e7e694fbc743600dee63570d3c56f0d26659a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4b15100e80a032b560cff43a6dd79f57

SHA1
90ab1f4a665147eab035303c33441c7573cf4dc4

SHA256
a8335ceec4dff70c80659b5cb89db1b0f95e8c8c719cd7973bbe3729016b1ca7

SHA512
a2459b54f396a03f17d23eca58fa9320bd82b9324e697ad60da7f6124e7eb576207ee3680835a76c13b7d9e42f1b21458c509ef22cd41871436640c8ca2acdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e91bcae275aad2d25facf16ba7f124a3

SHA1
5475ab80144b32bced6a2c6b7afc23b98d319fe4

SHA256
ed20aa789b0ff1e962589e0d9f201953932499a2409fbdbcbd8487862821f178

SHA512
21dc93e0b243e67ed15c30278ba2335074d82fe9d918f65756052af229e4e7e6e0dc31f818ad5ecb437bdcfb0b5294f090fd0f335f00f0ddb09f1053abf0976c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
583d9dbd4cc320452450eeb0e5f49df7

SHA1
f701001873abee27090224b400c72121aeff1b50

SHA256
3730600e53b8ebb551723eb0b5ea6cc252bf44469c510709393953a639cf3483

SHA512
acdbe310fe6400fd6ebbedb81e5c49685dea6a7795d844b5dd4ae7c70b1d6094ef244b669ad08d7d93450247f8337d4309ad33fe31dc30b25bb5a49befadb9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
73905755752b0e894d99eee667721c90

SHA1
bec4361430a0474fc8cf1657d3e82e2e2f0c560d

SHA256
643709f694beee269317efedb70925fffa0ba533369b9b2c37161598cf1f72bb

SHA512
7fdadd57fab40cade1dda6facd9e450c7d0006d48e9cf0bd6050a950aac3164e58ee1f8ddde8af981ff3bc1f6d0cbf0b4d2a881fb790cb60cb8738173342f6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bbebe596c7a30467b29d81d636a78eed

SHA1
aa8129d5185721de17bdc43febd2fadd0bd023fd

SHA256
b5035701879989ede29aa6ab3ad5875ed7ff307e0e61bbc8edda560e88bbbc3b

SHA512
64f357cbd52c9ada7cb55466a07e78b9e1ad1d10169de1866652c73fa5d497ad27889d4a8dce324d43af9c006125ad77cf39c616860e0f265afb29fe7cc3e6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
704B

MD5
f79c3bb85428689a09148992e0a647d7

SHA1
d892044683720bc3c0ee2b519e48925024dd878d

SHA256
7ff1ebb504da82d1334b1a778e8b057c81b0442301c4e8b93335539dbe7bb822

SHA512
6e0c54f98f993aa18ecad81a084d1839dbe38d987d7176d8144768d96fb454a74bf1932d6b4fde3af3874857c99e12b07d85e99c001bc41f028adc13a5fc75df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e753.TMP
Filesize
203B

MD5
aa98aa397dfcf58669bd4572aadc7023

SHA1
ae164cd210c02a8875c12d6976369ce2f862d15b

SHA256
06ccee54604bb24d01ccce6f38bc067a7ef9d5fddd4faa3e5e20022d49647e05

SHA512
49046e74db32d1e33726a5d35212edd746c1bc74c3f59fc37bda7f4f4e3da87d35724dead4ceb4eb7ad21b5556c4d552f698bc01ecce2e63b2d5b003b56df764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d9c4470e2ad79670125ff3573c7ce585

SHA1
d909595603a2310bedefd81a0ce6cc28b2923830

SHA256
20425985f30bfdb66c7f43a767473d7d36beab1f2d6a61ae02501e27909dc972

SHA512
a9bcf7989778b47d8365fb6074bcbb2340eb1e56fcf369854856d8f2016e3de0d5dcb5508e2b14d35d568fb09ba70831aaa4d75c84d978008838f554c74d55e9

Download Submit
\??\pipe\LOCAL\crashpad_1380_MIYCQAUGGIBBCOGI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit