c680760ba85ba54a9e1fa78d50c3014e5bf6f9eb451a85045464c0c6a0c0161c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72dde562d7d3a435a61df97b4ebcf636_JaffaCakes118.html
Size

104KB
MD5

72dde562d7d3a435a61df97b4ebcf636
SHA1

9cb2f2f15f906b879ade658e462d4a8bb5ce46f5
SHA256

c680760ba85ba54a9e1fa78d50c3014e5bf6f9eb451a85045464c0c6a0c0161c
SHA512

0391dc95ef74a22295ed75374a5f0dc6b6e303b9bb1c85a6d84a739117ce0fd4ac5e0f185b3390364f332f344441e23e2017e3782f730df2efe5134090cd5e8b
SSDEEP

3072:/+Kdm8szkUNsimUsrNLJodUhhsEuPthBQ2EHL:r

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

122 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

flow	ioc
122	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1820	msedge.exe
1820	msedge.exe
376	msedge.exe
376	msedge.exe
4960	identity_helper.exe
4960	identity_helper.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

376 msedge.exe
376 msedge.exe
376 msedge.exe
376 msedge.exe
376 msedge.exe
376 msedge.exe
376 msedge.exe
376 msedge.exe
376 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 376 wrote to memory of 2740	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 2740	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1544	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1820	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1820	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe
PID 376 wrote to memory of 1516	376	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\72dde562d7d3a435a61df97b4ebcf636_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912ed46f8,0x7ff912ed4708,0x7ff912ed4718
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1660 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3857876671697851976,6944393973273419786,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
288B

MD5
759b16d202f04fddf46231b566b7af01

SHA1
b3315b2a3f08235768bf52ea68ce19a8006ce12f

SHA256
d2c940c8e643e329afde6bce7deeeea1ef95068960853da93cf9082df3094ed1

SHA512
bfa560226d5c79896c622a328258863fceb54bf98a486d513282eb134a8af8b9fe45cc4dc40c8e9d1ee509b7e07d188ce2e66f87cd8374c6cdbe5bd6481b36a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
64f2c89c7747440f684c41dcd84dab48

SHA1
ea2da70d10a037c0ace381158823ba70acbcfd1e

SHA256
7b7646e22ae66feb5eaca1181af08c01dbd5f11f9ccbe9fad0758c29ea5cf4ed

SHA512
a72b02f986d7111fb4580cbd2446e9d7a531bc5e239af50f15ed93fb44ab59e7f7f70f01fff9b7023010fd2ccd968f13c17ce8dde92770bd29df53361ad3064d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d39b9cd7117fcd180694cea1773273a2

SHA1
bea3dc6b4a6e51f5d2b7ebb5a9d29ec5d2218d5c

SHA256
4cae314ab4430e70a5b162e4285b5eb4596b5f983c758e427ba0d6b33b8966b2

SHA512
fa07cbc9e0856ac26a32652f8b3c9c50c5ffed799a3f8e6c85859a59d45a4b9923e57a9dfb3873c2123dbe42270c5536e73ac263bb267ceeaf45ea0e544373fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
01d5cc175888a14a8f403b336f0ca94b

SHA1
858804b3c709462b560e54625f1d5354b0eae05c

SHA256
a1498df67568c8a55a1502dcccc2eec1bcbfbc3e10d293cb64700c9cc3e5961a

SHA512
94b0bcb650745e753505aac45d6e41a6acf8bd935a0d38e0b124d2f1cfdc0376567585d4dc53b8bc56073ebc5ee1014ab7d113302baf76bf93b99541679c6533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e3430b97e6936e716645441b9ac8ac8

SHA1
563f95cf8c9fa60bb3dce19aacbead8a3505fede

SHA256
fb52e8f7f71c9b1c31e9be63e31aac5fc950d3c3512e35fc42657aa30a76a9a9

SHA512
a216cf48afcbbb4552c8c8d69de6991ab75042c5dd18f5ce45ce61d51c306ec3b41f4b3e01244f07e1dfcbddb5573c607bc4eb67c54500b870242b347439431a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9b3037ef771543373fd2b84a92e01a77

SHA1
f87a3535cdc1925623d1c300334706e776864693

SHA256
6b746c897e0f722295cdc531c84ab67a5cadc3c4a0ef7b63e8fe93444a8664c2

SHA512
b5cf5bb4e727e4b82b1159067bea5931f92be06007e57ff6bf3c97c884ed91a7343a4d656337e69b74cde01833a06384522c1d87607297b0e2b408d600fcdaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2fb836f52c24a117c1621783306321dc

SHA1
879f3ce121ad28e3283a48523f32bdfa13345406

SHA256
f4cfe00ba9b458994dbdba5b506108696feff76c145c2a8a84f66f44e8740802

SHA512
0bf7ee7bb0288d44f473804afe96655bbdf8310b79a86be482cabfc21bfbe94637818aef48500985abdf1af69918496a5082987b89a65c0caa888b81a27e8d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
04bd6fd6bcc653c58c9a164d39f12573

SHA1
1e0ba1d64a42cec69da2d1afcbb6aeceed777934

SHA256
45c805734e58dbaeb6b5e3d84413534b0b2f13f68f1f7c7116e99e2a7e5f0e5f

SHA512
b36a873d42124724e50112ae54234cea3279a01151ecc887cf1d271fa72a9b0804b430ca341d437e511d957f68641c8a3cee8c6155d1e0dfc5c029f1051d2f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
722deaa633f37734862a39e5304c2469

SHA1
07aa7856be9195265170bfff0ba40b5cb73d6e57

SHA256
70a4c00e476d40daa50838ab2866a1ff1f8759a93aa7ed566d274cca284b854e

SHA512
44d2bec0cad1b87617bac7c36e75a5b5fee8034a178e4b464167337182f3e91c695810c344b7007d33dc930982811bf611d423086bac7189e793df0f7258564e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
37105bda1987ab86bb027e9eaeb7bd5a

SHA1
36757357dd6badc7a901dab7e996c1f9af337235

SHA256
225697874aedd5d7afd0dc829b61f3b6d88aa1c2eabfd1f6db98de6fdf8764df

SHA512
aaa9ca495f84bb79d873890a1fd59a39efd621e3f3eeb03c3ccf78408e648c3e90a51b4b6763960ebd0e943b1142b4ac6e997d0b050d876308d8bb237d93b3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d57b.TMP

Filesize
1KB

MD5
6b6d8b14b31ff2222f0040c94efc04a8

SHA1
16d30d1fede242c39db388b3508d5e3e49567603

SHA256
fd83a0bc2a0b564c92b462bb865db6708f7e2dd287cfe230ea6979924339273c

SHA512
dc58eca717ed6a83bbdcd4b21e5808a3f58320e19d2c800ec644fbdfb6c206f89c8066a1821908b0dd336bbc27e838f0c985c71cc609cd848bd97d523d8c3348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
331686a65fddca995771a88f92eddc48

SHA1
46f63d7de7f52f4629ca736bff8fff99e3d2a8f7

SHA256
66150fc08493f5ae6beecd36a35d367af196e1afc02f53f69c6e059d1e84e27f

SHA512
efe926b955bba2e8f02982f19453538e316435908cd97a39c6e18257403cf036c008d8479695d4431ee8d3cfb4ad7997af8661a10e871ac454cf27b48188ada1

Download Submit
\??\pipe\LOCAL\crashpad_376_NIKKERIDAEFWLNFJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit