2a8b21b5d2a6627c9b12e8ba348fe343eb1afbc27df128f4108051cca7132445

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f26a812509da29964cf031ce92a6c69_JaffaCakes118.html
Size

39KB
MD5

9f26a812509da29964cf031ce92a6c69
SHA1

deb832bc06c42265008fcbac4471eae208cd8b8e
SHA256

2a8b21b5d2a6627c9b12e8ba348fe343eb1afbc27df128f4108051cca7132445
SHA512

e3d0c132e50dae965c66ae51ef5eadc1b3b0cf229ab76b25c866944bd23b82cc6d1f53641533dbd9e20ec78d61a1358af4757db7500a2deb2fb273b82a10ce06
SSDEEP

384:aVeTiqQgtdlmdL4nExwKMWl6kguCAtZUdteL3WdK8R3i1Q6k7NEuj:gSnqVMWl6khC8qtQWd7R3iC6k7NEU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

2336 msedge.exe
2336 msedge.exe
4840 msedge.exe
4840 msedge.exe
2632 identity_helper.exe
2632 identity_helper.exe

pid	process
2336	msedge.exe
2336	msedge.exe
4840	msedge.exe
4840	msedge.exe
2632	identity_helper.exe
2632	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4840 wrote to memory of 3164	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3164	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3776	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2336	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2336	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 384	4840	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9f26a812509da29964cf031ce92a6c69_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe730346f8,0x7ffe73034708,0x7ffe73034718
2⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
2⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
2⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
2⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15266140368088207204,3792393357007596624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:2
2⤵
PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
552B

MD5
95bf85829afec77526d3611f05c7b94c

SHA1
a6416825a10d2104dd8aaf1beb9055d3d2dccb86

SHA256
492e1210edafc99953ec8ff29f4c4062f8dc90924511394c45be0fbaf9b84dc5

SHA512
bb92fced92248bc188b68a6db8b48f0d3a4e0cfbddefacbc9dcf7cec32201b0d836509cddb20886f973e89188a3a50d0150aca394f41b98a2843c74d1ed589a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
114d938bce06036a45340b5b2d13dcdc

SHA1
dbdf8cc41225c8c4dda690d0ed0b0cc80d8d01ad

SHA256
5f094f5d5e0be4b13e1732d66405a3dd1823c324188985f573fbaa7a59629daf

SHA512
0c0432b5a6d00d9d784316a819ba0065675f33b32dfdd58d830cfadf1d4445ecb6429cdd21128b3560c89e31aaa76b05fbeb6a740a1d8481052ce702306955f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
6d82b670609299555578506ba8c3369b

SHA1
f9eeee86bea33c507b24f5279911e5988f39a933

SHA256
3e16377b7ebf7f83ca576f67694d1f7261fff3de05b8e2cf743672eddd74ba09

SHA512
66dbc4bf49fa2fc395c023a1d367ea7c560fc3286a7aa0acc901bebf20186d064976d096657c093f86f179e85a375643564993827462f8902a23f3c85e023a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
194fc82131d0e76a582df8183ae9dbd8

SHA1
a113b57f156d356b47dd35f4175fe24569f5f033

SHA256
babb9d91e66c618300b6b9c68cf5f59e7feb50f1f607a1de23bc13008de87766

SHA512
4dfb115e0dd917225974eb7407d479d9553037c197e374dfe2c020b6323bfe724b9a8b4ef4d2aee7b585fbb0302da66ebfe4602bda6ab6bbec1dfff12f3b1480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
42c2282c23a90fc38bb437f389d33275

SHA1
5f87607cd2641f31894daabe89908d5d484539ef

SHA256
62c18a9e4c0bf33588d01db793e67ce5a8b94adb30fa408a296780cfda18dde3

SHA512
1e57c0f8123dcea647f6f3ea25df8f91e6e9d2471974fae24f50980d73086afb0c9ef541e8e227536c57abd93a0284e7591b3ca2e271822187961e5d2b9c7efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
01a893963b801934672427c6da7e2876

SHA1
440ab8d7d0b8ea726ffbfefb97b91359a6ff7565

SHA256
55f7b9dd73a54eda1d59ed954cbb28f4211a57d776c62b5ef63eb2732aaca6e3

SHA512
4e716d6c772fc5d651e8f3d97b7aff03133bbd0466774148b9747b9af44fa2716c860b48b799987a8377fa0cdd983b27b56fa2d9f9819284e3236d838c145e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
4c023171d2b7afd306ec63c0d37a209a

SHA1
77801bccbb24fe79a57b37fac8ca6efa58615d9b

SHA256
5e7b16b8d6df6a00a87a1828ab69ee57c521c65aff811fa4d27941164b779ffd

SHA512
53ab81f61c9ad931a501fea84a0e89cdcd5241b51ffde06e4931d2a7a7d8b8cde8a8e40c69d9cd0858a03a02c499715a80e67f16b39d614be50e9d300c103505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
8725f3c8ff25461566d5a1718fd629b5

SHA1
6915b4d2ac0e5b3f7324f82612e855bc27c7d375

SHA256
769e2e7130e762754ea5bb7f1141b6e3ed2e9aee5761e624fb3881f885711216

SHA512
9f2a5491e7d10bbc0433c48d7217ac1b4655b757135c1d41c7f6da650e7a3e3a64b8d228fd61d99021941ec03bda9a8be4b2d32f061f6b9dfa8afaa16e4a0796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
8ca38943060c0249d84cdd765e4b5866

SHA1
1d1dee386b83c3e43b7b1ce8bebf7402e465ddf6

SHA256
633b2ff76c590e4a83274da74bc5837260daf455d61b3835e2c4cd0a613689ae

SHA512
f2f68bac4fd6c8abbf665dbedf3fb89b11a1f7c709a82f42b9dd8131ef6108a682e3961769360c078784f6f1dcf6f29b7507d733f1440ba79b76233103308c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579069.TMP
Filesize
2KB

MD5
1df054e4c265a7e5ba1ab70794362c9b

SHA1
9af0f4de13604f7aaeb7010d7690bb88d7f77426

SHA256
cc98c3c0872b476100e0121d61e5f674f7227ef4f92d25fafa2f5c7b50e8e22a

SHA512
3d0fcfe90914b9354c20ba4db3497832bade089711c4a540cbf5b604cf893dbabd027244a7bba078b8def653f41de77cf99f3638579d9f118e7ebc3aa8ffce13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
ed8f2e66df069ceb7f96c7f3dc7e96d9

SHA1
47e2bb9408d44b257b8c463094b838b98dd7a8ff

SHA256
fd2b4bd9b2b985c72141f0432ee5505eb6aa7da49748eaba8f40d128ba3b41af

SHA512
186972450014de1e22b4c0320196aa8be8618f1e71ee3831034471aa7b0654716dab6f50c14a7f47f1c9a5ef0729d3089e629338977736db632816de079c167c

Download Submit
\??\pipe\LOCAL\crashpad_4840_VICTUVEFXSDJIZMK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit