7343ca5b2941159963ab366a59bd6c49e0b5198a6cdaef4a8a642318b3675b8b

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691a4e8692d41054277d2f2a124ab74c_JaffaCakes118.html
Size

201KB
MD5

691a4e8692d41054277d2f2a124ab74c
SHA1

510bbd3f310bc0a5b02c1257e140361723c2b3f2
SHA256

7343ca5b2941159963ab366a59bd6c49e0b5198a6cdaef4a8a642318b3675b8b
SHA512

e0c62f9f2d06907a241ff0eb58e727f0dd87c1c1e51d9dabf30c4032fd3147bb67c1af652cce07aa428b35cfeb4c2567b515005516be93417d1ed0c37676fb17
SSDEEP

1536:Hwlh2r9RyG0kb2Z+BZTB00cTKZ9dz8JA/KU/42CUX/s51DeRl4KRlGeQe+eEeyeV:HvtW2E5CZ56b1hth8ZUVkmMSSq44hU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2020	msedge.exe
2020	msedge.exe
2488	msedge.exe
2488	msedge.exe
3472	identity_helper.exe
3472	identity_helper.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2488 wrote to memory of 3580	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3580	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3884	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 2020	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 2020	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 4040	2488	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\691a4e8692d41054277d2f2a124ab74c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff05446f8,0x7ffff0544708,0x7ffff0544718
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
2⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
2⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9784579153331701841,9792361784406321486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
cdffb2ff12a7a877f5dcfee089e97b91

SHA1
a7e9af1d55b1096c066610fb31fb21e198760e7b

SHA256
f8e163659cb04cc39795221dbd10896bc1cb5582e7312fd392c8e677ea82acae

SHA512
dc34271be18f50e4769cf6639afb1728a19b9c76b1daac0343c1e88355d50c5c829f212a6ff4c6e5745c7d94116dec46ad0b6d260e4b9efdba01ccdf5b922449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
80a7f4f410a72f8ca2d1f6d64175b387

SHA1
46e12b1d3fc605e2d8084ef08c3fe0da480ec63c

SHA256
d24521a213ef35bc47ca45e1e3290ed26536a1c015a6e317b136198df4f64ff2

SHA512
e127332e17e4b89b421f6060f78390c4751eee7b0563b4b880520582f957c513bf13eae4440c18e52c256ddcbdc35ba8ce99656bf7217ff6a7f8e54061ab2d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dab729377bf9764aca060c899913b342

SHA1
01c689f9a4cf20df55863a4d099de5d1201da914

SHA256
496886924f3a9f7ba59e04dad5c21a5145e182d17222ec019b5f7513b79aff12

SHA512
65af80cf567b5712d5e8d8335594fa78851a112f1d21138c3c137b27bd882d929ef7558849a2b9633f95ddccdfa6df3c44dd2aaec84dca0df1a1966e0a06a23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebca059a244fd8109c811998b04e7b4c

SHA1
a1a1c517a1a60e950ec057868fa9b2ed0a3a6c0a

SHA256
58fe060c8ddc1e4dbbc50da94e5bffc068d3cf70368cb17218611d7774d6d5e1

SHA512
31f0b3a38c03300754479643d6ee312e4a15ee8ea9918febd5a5723775786dfa4f9f3f5e1a33abe43a46b7e0ba016b8991dd845b9e73dfda985955019cd82df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d97221081e243049784f58e12c27b01

SHA1
49b84b9ab4192d62e0770b54e91dd0c52f778f9a

SHA256
19d274d181bcc5adc484e80982eeeaaec556a70a558665eac22295fb72ec2a2b

SHA512
eb47fd52b5eba42f62ac96d5c1900a61fcfb0523bdca06500993f8322720d35cef02c629c10b601822ef9cb6700915276ff61bbfbeb75b768af9ca2c4e2c1c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63094f5f4f6789d6c4c72d9ae3701f47

SHA1
928d2a84151314b0855d7a4f35a0b00e4abfd44a

SHA256
1a0cd88e3ed13e9b231a84775c24346314ce07001d7d703821c0b61cb2e48e4d

SHA512
189e49a6d0c73a57d015143c3569ddb67dab4f402a515cd124a5b68e13710bb0dcbbf7ccdb3ca2d2ee41c7db866a3828a32a7c0475c5df907195a8432df203a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
16a91870be6cb75a42b8ce1450d564e7

SHA1
aa26872b397acfff03532e5e7db902bf5e712d59

SHA256
e4cbb11c5bda9d6a48c10af8f2f58632b875715d2a258a42fcb0750098419cb0

SHA512
adc7ccc0c1973d8dafea8168c18958a20843ac76216e34877497403e794ddda3e13cab90acd7be1341149fd6ed62a93e817c90c7627327e0d5f75acfb6eed188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c2f2.TMP

Filesize
204B

MD5
0d48cb68a853de9b65955559f3774535

SHA1
550251f11c7362c61973a2d99a120b3be92da4b7

SHA256
27855e06a4903e4b67109421213c08f67d75d6399177a28a8939e70a28afee09

SHA512
b8ec9ba55f025ca0d5059ea3543d92f89ade1abc38b17be944a722fcd4fb7fbb330d26c55d6796ab44f577dcd55cdf5d0401b0131c7cae6a543caa73bfee72ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
94d1c37536350c7c746a7a0661f149f5

SHA1
9395d79f2ffc5079c920c0cef40734eb64b7f8e4

SHA256
58c344813fdfcdb940465b385f2a311136c40ae4025ae88cb886fc23b9cb1fe2

SHA512
81bdd02ac2d961db0108037f82cfdffe279d39cc53497e8af8de8ec5dc1bd5c4f03f919ee51ce09e197689e140cd03633a79a5bdeb8f4444f0fde3994e7810a8

Download Submit
\??\pipe\LOCAL\crashpad_2488_NBXNUKEQBHJYOPIR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit