f53afc2d5f0c78b32f110ec62b07544e7a353db99d0b74ca6e981ed0264cdcaf

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63aa29d62a27ad0c00e598e9627701f7_JaffaCakes118.html
Size

81KB
MD5

63aa29d62a27ad0c00e598e9627701f7
SHA1

e0e7dcf4e5b6ceffb932e9b7cd8ebde915019057
SHA256

f53afc2d5f0c78b32f110ec62b07544e7a353db99d0b74ca6e981ed0264cdcaf
SHA512

88a7e7f0f76a834d75602090aa3f4a26a4ccf9606efa9e9c728b0177574668c5973ecc0e272ca95d9fe789fa0855f4f33136c861378043ffb4288a4f818da362
SSDEEP

1536:yDIHDIeEI9Z20jgGHMs6/OdiUxUFYayraOnUne4L7j8L4cRtQC:yDIHDIhJs6/TUxUFYayraM7y7jKRtQC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4436	msedge.exe
4436	msedge.exe
6056	msedge.exe
6056	msedge.exe
1512	identity_helper.exe
1512	identity_helper.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

6056 msedge.exe
6056 msedge.exe
6056 msedge.exe
6056 msedge.exe
6056 msedge.exe
6056 msedge.exe
6056 msedge.exe
6056 msedge.exe
6056 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 6056 wrote to memory of 4872	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 4872	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 3084	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 4436	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 4436	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe
PID 6056 wrote to memory of 512	6056	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63aa29d62a27ad0c00e598e9627701f7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9843267359387778694,5639712317527816276,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58c1f40d-f560-4dce-965b-e11878348d87.tmp

Filesize
11KB

MD5
86bf97923f9f71553fd09ab5098fd882

SHA1
956d155d273a7e24e5aacd83d17b8a9257c2dad7

SHA256
3bb545fe22120fd5de3a6308870a3ecbae815fb9bee5b5e613ceaa083aae4e68

SHA512
793922887f90112e3b3f6a30b7c0b193b99d972677adc73ff2a1f68a1fcfc147310b91bcfc2ed617d538dbf5302c78bac2ba01238cb34a847ab8accaf4890f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
e45afc621837204089dc7ae1cdf2602d

SHA1
173b1649698400c4bcf457f9edb09388e45b4729

SHA256
b523f963552a739d28ce27d9333841a435b51bdb595d80d08f2cce1bd304d576

SHA512
8cdf72dcdc04bb7c670bc2daefd779e00e52b2dc289fc0ee828594cb5bf56ad5396f15a78bcced5e88d6df39c1091b8b8d6f208ec9f7af81b81351d274d5cb49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
a7102ecddf9f6f829cfe1232d1ee3317

SHA1
fae09717908cf15b713d19fee0a15a2d6821bc41

SHA256
8c9f78cc43f315e922c6b93437b234feac59817e7482fed8b3a194d0102e78de

SHA512
58da9bbde55b5291e078ba61288e98f47be14063912ff9eb06c16d97bc47b49e3e61da1482eae78c35345db5e357ba568c1ee49030d768afd16e1d18f83673b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0192cd35819801bf43cbeb6acbe9dbb1

SHA1
126e7a255a593ff7c78e98013752310c13718aea

SHA256
349d849b622b7af8709b836f39f13fa9c7c0c806f182a0267bf0aaf87190ff4f

SHA512
e3aab7ef212fda1b3cbcf85d99751a8faffe92acbf4bab9fe4b5d40f5c993022ed2fdbbaca7b38c993aacdc2daffbceb4a9a39d5cc31db08f5d925098727271d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ff2de1b1b74e4abc0ca05e092a8da84

SHA1
1a670e290424e8be7d4cd484c809c2a5a395fa46

SHA256
41b28bb538877d34fbd6865e776ee9d04a36fe41b4cff120b7eeb9983ed20802

SHA512
2be92d7ecb9902d9bfcf5a1d04219df41fb2b8a0dd95e82d54fc900b32d54e81d005fa2be5ed021afb5d2eb4ff65d6ce89862ceb83dde6734067c927526ae718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df286bb09c8cd5e02cb45756204bdd55

SHA1
64533c657990b254fae80f3cc7eb5d5208e6ba13

SHA256
186fabdeb14f301f06dd81f4300f9df65be2dbe1a945071c2786785899f56e2e

SHA512
6b9daf461c8449cd3cbfbb75fa53ee640961831770bb42d8ef025dbb4ae014215d5c2a52206578260b530ab407ac6a59a30da3c3fa2e42b5be681053206a0072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6feb05619044c0de2ec7a6a68ad3641a

SHA1
2ff6197c703cde0401c989f4637636e243e2bf9d

SHA256
159ba837a6ff41109fb755f8d49a9a7d299ee00ac984bfbd04672ce0ec81aa5b

SHA512
b9ffc981a38241da08cdccef2a1e5f8b62ef7e29aae3e330cc1d5605524f5ac59d3cab86c685c965c5215e80c869c789235fe87c195f050e5b36d321afb3a6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
\??\pipe\LOCAL\crashpad_6056_GCJKKLXJUVQGUVUK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit