ad2feefe1c838e30a513b3a6a1245ebc6514e0e80f5930ff21b77064a9c58487

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb8172152fca55f18bdc2b56c3fdf13_JaffaCakes118.html
Size

173KB
MD5

8eb8172152fca55f18bdc2b56c3fdf13
SHA1

6a7e94824eb228761972ec1a510544059165fca3
SHA256

ad2feefe1c838e30a513b3a6a1245ebc6514e0e80f5930ff21b77064a9c58487
SHA512

4ae6992556fe105ea49dc7fd5e9e710c745af7327b0af29755080a80a2c4d53d6cbd9b20da1b634267c8fab0019068d9398dc479f7f7bb6c5b4e1ba063fbb40e
SSDEEP

3072:VZdeCzeMIKC41BjXd7Cd63uj8E28JB+fHCDQnzX7dmN6od4tKYNMqIFs8+HB:VZdeCzeMIKa6Eq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2840	identity_helper.exe
2840	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2864	2004	msedge.exe	83
PID 2004 wrote to memory of 2864	2004	msedge.exe	83
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 2116	2004	msedge.exe	84
PID 2004 wrote to memory of 4320	2004	msedge.exe	85
PID 2004 wrote to memory of 4320	2004	msedge.exe	85
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86
PID 2004 wrote to memory of 2588	2004	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8eb8172152fca55f18bdc2b56c3fdf13_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,11637258934200808796,11286881932608214797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
de80c6926f47c205d6c8faeb1ac06ad5

SHA1
3d092256766e223f9772f25dc750ca988381a345

SHA256
acfd16ec6133d9c3d4705f7ecd887c0b55a257517ae27a680ade9d50a0933cf3

SHA512
e82e83c0a28d048f9eeaba645620c3ff0c2b2d3387fb7fe115967c878a162e24cf38e46a87017f4e84ad58beec5a94287e2c2a0c90ed498ba65ed0fa80979ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
034b83814f0cd4bf1831fd49aae6ec9c

SHA1
b4ad4d94031382458a0eef56b240fbe9a44b6605

SHA256
6d43558f9a3eb948ec0f922dae1c0ff16fa249beb7e4f6193a0c463422ea9948

SHA512
70ee2d22ed12a9fa208e6e6cb50b18678e5ca5e5303947ed349a562d172c8daa9786536bf42ef101a08b96e7a6923093bc64a4854c50ace0d53b0cd6fb4e97f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0e9f12467d2fd204c38c3962f7bc82bb

SHA1
32292b615ebaf80b9e1692493239a1cc60b998ab

SHA256
57630812bc5d597ce14ae8f77ada03e782e2b8889c86103e3582948559054daa

SHA512
31699690a8380e665e7f47b9ab015177d403bfd9c7a4dfbc3143f7c06b4d611344dd5067378b96a56a931bb25db7929c27d3e53669fd3f14ba39ae1b88767052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7edc86d3977cc2b81a1d61076fab5f80

SHA1
8643cb9b1c6be116f4e4d9ced59426f418b73c54

SHA256
7d287ce8365a064c8a2793d06b73168bc70560cdd4a5c5a1d3ec19e103c640b4

SHA512
02534664b3456759402bf16ba1a74c6b24edcd751fe85981b40aef6467a5048b5898134ab7c3b1e01a297f04b2f2e271a126ec286787b14d9002d9100e921a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5b310760ba450752236c01d9de4b3ef

SHA1
70b3f48ab4ff95ec84f76694a721d1c349d757fe

SHA256
f2a5d57bfa2ec19a8227c9662d9ec85a712136a327cd9f9664618ea1ec231381

SHA512
6e6d5e613cca6d045d08e5c6b6b3994388e8834f33d16799be387164e771d11e417d21e72feea912a4aff6ff4d3b649a689bd6ae599dd874a05988d91e47f786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
487e9ffce10c868e4fcb8dd047b38d17

SHA1
1d33467bdf57f021cd2dec31ca3ea4eecfc54186

SHA256
4e74cd8d480615abc2ad514dc8215027eb0a86978c97ad7f51d8998c1f9e2a8a

SHA512
01977e50151f81a99ac88f2fdda07b6fa7c8fd45945a27b73f7d196cea3a0a3e3613e3fff4298c83f55f775c7c9b96ae50252ea46d1ae891f73cc89f8ab62ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c37fbd15b75d20092042772e0b46282f

SHA1
e2b2de89136f750b0fa04ad02cb3f89c1341bc0e

SHA256
10438d2f800cd93031829179c987cf49d91bd6e01e6a33962bcb299f1a180980

SHA512
a35a527c1aaad9d7f1338135f94922adae554b252e78b66e17d7fcd5b843bd40e25f8641681ed7722540c7f322d61296bac3b0fa7d9e49d5691067b1e783d71c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e031257807fc520dc0cdf7d1a7f5d583

SHA1
26635c7d50403df5670b0fbad81a7fab58641c18

SHA256
22ff81bd8400ced61be33d7099cb7e5f72e2604e7cce860f26ac82a0a626d7d7

SHA512
a5bc3d32d5666e4d12434453015ea08bca912e6c36541bc9b50cbaf83558b1eb9a0d432561ff4f1d473d963425f0856cfec956d5a3e8b390bb00c8c1760fd0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb79.TMP

Filesize
371B

MD5
5e27adeb13ab4db85c265da3a13da8cf

SHA1
156b513859a71fd6aacea6bd9d609f23e377cdfe

SHA256
e60cc86be2cd11f5f631f8973c8bad4d0ec98db63be88324471d1ff118af7790

SHA512
732342d2a372dd46e8edb070b9772f4fea7e5bcc0575f67d2b6114d01a675b17e973ffbfbe7f08cb3abbd140acd420b1154dbeb3ca3c0e35069071536cc0d700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b52b0c939c73d895c6ff6241a190101

SHA1
d6d72c937e6799201aa5ed678a140d4f1d7a6a7e

SHA256
bce96c688f6d9eded4245a8eb35b4c73415fae2c118c35c433720739e0fb28ca

SHA512
6482a9ae1bd08d493d987bc90b875dc0b4137e33bbbeee6ab85f3254e0c7d1bd32bbc09f0d86595cde54551f842fee39f77edf45bc2d86eb7396296a8c90e582

Download Submit
\??\pipe\LOCAL\crashpad_2004_UNSILBQXBDDSJDRO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit