379e0764edf1d383aa5e99b0566be2d68ba462a613a0eefd06740d2005fd94bf

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

263d467edbe1dc9a53e433f8e1bdd9b8_JaffaCakes118.html
Size

72KB
MD5

263d467edbe1dc9a53e433f8e1bdd9b8
SHA1

aa8d9b3540afec494edaf774e36a6e8cc7ea97c3
SHA256

379e0764edf1d383aa5e99b0566be2d68ba462a613a0eefd06740d2005fd94bf
SHA512

9ae32713f421d7d0cd7cde40ded137201281696d0be0be4d55570b694331e536e098e1b32551b90b7100ec4d17df39f71ac0a8c184a7195008031efb825cdf6e
SSDEEP

1536:txt+4rNzeuqEXONiDl188S2k7NVZUJRFCF:tO4rNzfKNiRkxnUJRFc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

628 msedge.exe
628 msedge.exe
4812 msedge.exe
4812 msedge.exe
3248 identity_helper.exe
3248 identity_helper.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid process

4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe
4812 msedge.exe

pid	process
628	msedge.exe
628	msedge.exe
4812	msedge.exe
4812	msedge.exe
3248	identity_helper.exe
3248	identity_helper.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4812 wrote to memory of 5040	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 5040	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 4016	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 628	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 628	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe
PID 4812 wrote to memory of 2956	4812	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\263d467edbe1dc9a53e433f8e1bdd9b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f9a346f8,0x7ff9f9a34708,0x7ff9f9a34718
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
2⤵
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
2⤵
PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
2⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10879398310929203708,11617746652025880994,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
33d6e13998fd0d0294b26b1e0d1cb1a5

SHA1
ecbd865f1ad65390182614bf092ca72059873c59

SHA256
b3b7a517231c686c80205cb33407fb4cef5c45b0409eedad09091dc9c4fe9b8f

SHA512
7d86f735cfec2ae47c183e7b11b31871fda8bf0003d00ef7ae8889dd9b1b381b22c54ac93df61c00c9ced6791ef94724f1eaca3e253fedf4d5cc37cc9a1b1b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
1cb54c05d15e983b7e6be5272a37f486

SHA1
33781c57dfbefbf21307969eb78fd2690929f5a1

SHA256
6786eee3f06354dd3c2150939a99d735e3d7956f36082b5719c471cae5c85d57

SHA512
34c086557c4e112bf891fb2ad04dff32e9c89f35652c76fe98227645868f07a1b484d8e597d154fbe3a6b8b7652e69c0d3d2668164ec79938f15e32224b024c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
66f81144cfa15764866a80cebaf51aad

SHA1
e85d7eaa5c77f0e5497e47fb1879547fc257a61b

SHA256
e77ef5125595cdd17a9bc959037e9686b92cd343f2566255dcd6e728046f1b06

SHA512
6f2fa1cb8c217494791a67d50ebe650ae3ba12d246aa28d18df8df5117f6304c8a88d4999a59cbe32d702e943ef6d172d3c3b4de3601e80e2db0d6e6350474c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
af2d183a03b072865ab8cf520bf284dc

SHA1
df294afebaf07e2ce33c443d3c8d8c9b628d57a6

SHA256
a43f9d00de34f31645f4fe73fbf771a10b38f57a71fcba9b78582724f24b3c86

SHA512
3e8225bd958aa21c611a909c232c8effca41d91579196c092111ab6dfdebbbc4cec9eb9d46e3226758c0f27c01faeb442f8c9a2fe932de4fe28b0aed5c9610a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
fa7c91fe4daf6f9292319903c9c1bf08

SHA1
3fd02317af76f1c1217ef2e1dece3fb5b610f1bc

SHA256
5ca3555cedb74a19cc3ee93415dada37c8be70462aa841045270887d4e73a289

SHA512
016510a9c8c1cfe608c33d65698ba22e8d2541cba48fec8ec51b04f8b448b405b5f310c2484065afa0680997c5fa50542dea17779d260b9611db0843af02391d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6b09c44f1cf5134ad447cbcb054a420e

SHA1
aaaf4701562d4e010a8fa43ca6416ab9258f3187

SHA256
be0a0335635a62fcb7f2aabe90701910c37f27c115043df9dfcb9a65f96d4966

SHA512
50bfe8641bb8a31bd97c809100f0c3008048592ff79a2532ee52cc7eb5e468ebe08617cd23669db88dfe3dae5b024712345715f4bbf00ed67e685a65b9e49425

Download Submit
\??\pipe\LOCAL\crashpad_4812_QQBIBRURFIADYRUW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit