82e49e9f81235317665beb921e16b8e49539e6c6c2c00bab1fbb0ca2d441d430

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3667ef82b09fb49678e98b42a0fd6dd7_JaffaCakes118.html
Size

46KB
MD5

3667ef82b09fb49678e98b42a0fd6dd7
SHA1

51d894674de9d175f352bb16524f23f7ae76cf01
SHA256

82e49e9f81235317665beb921e16b8e49539e6c6c2c00bab1fbb0ca2d441d430
SHA512

0b0bfd05773b38b27ceb62137e57673700c96a18d08e8210fdde35173ea2842d35b6983d62cf3aed71011a0769e4984290b68668c3802b3613a127d10de75474
SSDEEP

768:HVT0EipBrtIuRg7J9EgN1flV2vNX+YqcwpfUG40mMktI2IMfRWTg:1TupBr2uRg7J9Ek1fb2vNX+pffitHt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
3596	msedge.exe
3596	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3596 msedge.exe
3596 msedge.exe
3596 msedge.exe
3596 msedge.exe
3596 msedge.exe
3596 msedge.exe
3596 msedge.exe
3596 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3596 wrote to memory of 2368	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 2368	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 3464	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4552	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4552	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe
PID 3596 wrote to memory of 4020	3596	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3667ef82b09fb49678e98b42a0fd6dd7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf0d946f8,0x7ffdf0d94708,0x7ffdf0d94718
2⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
2⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
2⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
2⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
2⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
2⤵
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3898693063749143223,9161897480483942240,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
6ee4c5caa7be03e9cd84eb23fb1b03ab

SHA1
2d0a008d74420ef1fbf83312416654b37fc4e252

SHA256
8a6aac81ed9ff25abce7f2fa7c2d43cd86330d79b00a21418c7e60352b894e8a

SHA512
5fb39bb90f31f537aabb90a927f75c36243a641f9fa14a1bd51a097bbba591b9721bc4534c2cb943a74a65afc005c605801d47e17252ff42e4c862e3bc5cdb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ada16c8-aa33-4d9a-8138-f7e036438a22.tmp

Filesize
2KB

MD5
5ad012b95988e6b3663e7c497599fe5f

SHA1
93f32290565c4d6a50d61d2a6047b37a81c93889

SHA256
b34209250fae8e8d9f058e6801e77c876347277d6da260b3ae0ccd253f4e6dbc

SHA512
1e6480b4ab619c97a82107e79591eed774f24d3f4137a8748a51fe499a2352d354046bdb17977b741abb9bbb1c463d80ffb0bca4bb1556db7e4f543aaa0f212a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
21KB

MD5
549baced2c151db8a02c3419aa5c01be

SHA1
1f36a9716da201c5e45c1cc23c349bbaae44a3c9

SHA256
11938f83bd463e29316808f3e118440f718f1c7a0761bc860171255a96cbefca

SHA512
12c40a66af58d9436d7c3361de906077402cfeded97361c81d9900d69d405b5ab002ac36aad3f8152c6083e00755442bd1bcd1766af26c097638051dfe1aa9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
45KB

MD5
94019c00785285cd78d6da8a1bdeaf80

SHA1
33ba11bbe8c91eca17a84c3dcae4667638a61b57

SHA256
2ea5a487d117c082ab04c8b2d979adc04c18f496af90ef2caf9910d9902ef8a9

SHA512
b58d23d9333290e203ee3191cbcca4686ae1f9b4c135ee8a8e0f014e7db4efdcffe6aa82b502b2d8e63bde705895a04726d799a4c6b0e22783b6925b4d297d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
21c0a0c95e5e8f46a682fc9cad307a4c

SHA1
64c0dd5ea55a249ab2888bbbf61e8a4406569b26

SHA256
c59ca992918abd69adedb58b4eeaa3db264c0e455d0d75f294001f4d8677a3f5

SHA512
71dae459dcbe572122ff177c98266b9e44edaeda85bfa2fd19427341938338b9e6b82df9ea38275a3de55f9edd0a2aab9e93a443d944567ce224a66710f8c2d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
170afab0de5083064d048bfa926f9d21

SHA1
119a8aa266050176c20843384e599358c4cc8eec

SHA256
63de41f4c50aa8eee2831ac59f52ad61cdc4c345ecdf7151fc5167957304589f

SHA512
b68617eb7106ff17fc9795d79367a60ae31cbf40c7c1390c1ec60760ae72ab52569970a63625cd56c8e553d6d2eeb250da3105fed20a34727e6aa158eb11a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e687258a77a6ce7b70c046128ade44a0

SHA1
03c18bdf23f5f1b2d81ca1615b6565f300ac2e3c

SHA256
763c1f6a27e7bb8c1196faa4c5f24d735b759fad60e61d51be4a5db3efa476bf

SHA512
52578ed3446acbba56efdbfa3a4ab2e3f38420e0c62338c2a62d11ea2ec64b41b6018040a0ebd976fcd0ef14f80c84338463b4678bf954ebf9e22eaabf3867e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96d3db2fabf5d40b879fb0ed2d31edac

SHA1
58abec3e5138a35b411e2924c639d58fea21dc63

SHA256
3068935f671dd4fca1f0ef98063ffea8f562681b88b0facf41915c3cd545eeea

SHA512
15b2e95afb61273d67c8db39dc48d7c9370859b3aad19336a7e3fd09dc0f78cd950218cf7bd93c6ac94ba1c9207e45cb47c037fa8249aeacb2e2f6b492ecf40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
61fe541d095fcb3d1caaecd5a38cdccc

SHA1
9ef80e3f1bd4264778f23552045cdf999a27ebc8

SHA256
8426988418f0abc80e1eec5562f36da96519af62e00284b915104ff34798b8da

SHA512
32d47b56a910f94db267a1155bbee2b2778341ebc1a0c46c6b0b77dbd343c27f0548b9bbc27fcf743d7fe9b59b289ae0b7928c7a7f859f81f6472da6425dd496

Download Submit
\??\pipe\LOCAL\crashpad_3596_CXUHKIEDUKLCQHXD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit