600257e0e1e247d17984b03afaa67a2993b642a2e7396ee06c36043736a6e258

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

696943f16648c457c1b9c02175412027_JaffaCakes118.html
Size

58KB
MD5

696943f16648c457c1b9c02175412027
SHA1

426af4c7c03e62d11c8bfa0f1772c2d76d88fb9c
SHA256

600257e0e1e247d17984b03afaa67a2993b642a2e7396ee06c36043736a6e258
SHA512

42c11fec7fe74977b35d8eb3c004e381b0aa2703e0851b5e90698f20db602ee71dafe5e2300aefd9e2ec5827ebedb8af1638c737cc2d4cd570c519e4533b6306
SSDEEP

768:PFcT0EipBT3WRZdOOBSHOtYG0kM4JmnZvmxBkMPlB:2TupBT3SOASHSYGNMAmsSo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4268	msedge.exe
4268	msedge.exe
4532	msedge.exe
4532	msedge.exe
2024	identity_helper.exe
2024	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
5600	msedge.exe
5600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4532 wrote to memory of 5100	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5100	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 1940	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 4268	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 4268	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe
PID 4532 wrote to memory of 5068	4532	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\696943f16648c457c1b9c02175412027_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe931046f8,0x7ffe93104708,0x7ffe93104718
2⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
2⤵
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
2⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
2⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13120509561133506826,5268720673937460347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6984 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
7e4e2c1c2eb4121259d5f39720515d21

SHA1
aa85e1c96785d831fcdb2f0a35800ef8b0f9fec5

SHA256
1999d1f707730714b2130eaa3bcec7785adce463cb7b785e04d1566495780334

SHA512
92845e011fd95967e7447d2ef3470810f75161ac5878e6d02e1c7082972c7883f6de6ca692aa159023853ac52d68a32050d304204397e2f3424ad5b5e50cc17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
f20711eb1571f948b648f72803ecb05f

SHA1
6f3fb09caeac85cdc0ec2358287887f5adfc25e6

SHA256
1cb8f8308ad5e0b6367ea2c6cebc8fdd978a558823ddad8174d8a18c89e72707

SHA512
0ccc76e93b4f932c9e9a8aeae67f8e42874eef6ee01dfae9c7191a66008d633e9fc7c41dcd85df4c8c67c6aa0cfe8cdd1446365bf0053ea3e3d8d85dbc3d9805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
d5c58820c2e2823e7b5e47599729a052

SHA1
ee306f5b3f53554ba6692c7eb1ade462a0d6749e

SHA256
e7786f74752b8dbeeeb6c5f6d18b71b5bbe83fe72fe210cf2532c1b19002a28b

SHA512
5638a6bb837c3b5357a155584756e300cf009ceec728c03f6571fcbaf4314d0cc8437acc85b0c2905d69bdfab676f662799810a6fbb56ad796768179265fb7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
2e73b9d66f7217039e5794ec2e6a9eef

SHA1
1fdd37b2775dd7f034cf7e8ab128956a3b7ca38f

SHA256
27200ee79e2c9afcad5e1a71f4496e56a6c379dda7fd984d509875e75b5c6c18

SHA512
512aa810b3c99a2f5b709ffe81e15f3260df4955327691a3faa4d1d83073286bf9d9e6325400d3d2ca81f963d12099988cbe307b61b8d5fd5d763915649744e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
981f33ac0bab2849108dd259ff3489d5

SHA1
6a4479c48e22ff9e127c0706ce0c483640b574a3

SHA256
8bceb7118a639c0674862387cd6a37927c4af77c98957e279b4b704bcfd3a5e3

SHA512
f46f6a1e35ead56796465c8a84dbf562f47a1dd4424697005422ec311cb05b603d6091fbdee3a81187990adb17fbb702dff5a423d064d807ca351f28c8326dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
813ab40d130969ad6820cd4858f4240d

SHA1
50c120de0c16a96b9c669c52a1a2940c05739dc5

SHA256
257e335dab24213098461dbe0befc10be49f940d2631156b17b9f43b6565e5d6

SHA512
fa1e36484d587b46dd445e700a40615b46f799a57b8ee084a38677f9cf32be4563b1b5b27cee087b42b516db8cca9a8e40dc4f0a18e30f7aa6cf065321bacb40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
e6b93a597f9b0ff6e091b25870bb0880

SHA1
436a3830c59f3d897989b6a468f810d1937d159c

SHA256
ec44d031ab5001efdb88c648933329d278aa56af1c49692974ba57fda5b30c9a

SHA512
4065ea57a8f3d2b46f6f2af73fe6da9a684464ead29ed769a95550cc3ce9f512df9ef2e16736be5dfa353e21a495fe579fca0d0c3cbaf3a2a7bbd84de6634314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0077a02ec3ab69456ecc1f12239ad279

SHA1
a907d9eca410b5b9d8b1d84c7b22e4c070ff41b5

SHA256
d08e79bc68d04b5a1dd22563f217ad9b39d5256dbecc4775b8fd1178b31e2b6e

SHA512
341df68eebc40a6acfa417f2d8fa0a2ec39639e71dca27f3276c3c7d1ec28b288ab2a055453c2e140614b3ecb82302fdd57636b50f8707e08ac600351fcdad99

Download Submit
\??\pipe\LOCAL\crashpad_4532_CFFTQKJPOGHKTSDZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit