7393feab5ece1ea74a88be9ce1a05508e656becf40d1be20fd15483438f37ce2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b30ab4e5bc3a99aea156b781c54364_JaffaCakes118.html
Size

175KB
MD5

63b30ab4e5bc3a99aea156b781c54364
SHA1

7db4870c6a077c6c8628235097fa20f8cdae8122
SHA256

7393feab5ece1ea74a88be9ce1a05508e656becf40d1be20fd15483438f37ce2
SHA512

cd2a2d7cec9497b405681c3ee3da74505f60f9b91c5e9a1b7f271f0961fe29d80fe0c8cc3c821b1d923fa1b90f54fdf1053a47874dfc137244dda1e00fea1c6b
SSDEEP

1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS30GNkFIYfBCJis0+aeTH+WK/Lf1/hmnVSV:SOoT30/FtBCJiWm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2904	msedge.exe
2904	msedge.exe
5072	msedge.exe
5072	msedge.exe
2992	identity_helper.exe
2992	identity_helper.exe
5296	msedge.exe
5296	msedge.exe
5296	msedge.exe
5296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5072 wrote to memory of 1780	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1780	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 5012	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 2904	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 2904	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 756	5072	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63b30ab4e5bc3a99aea156b781c54364_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6e846f8,0x7ffea6e84708,0x7ffea6e84718
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17202049820027170575,14433133218145832911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
2a8733f016ad4e2afb6454c9db3f2786

SHA1
c5a98de850f1f80f568d72b28d3033a77535fa42

SHA256
772972c92ab827f13e79c4478f06ce6c71a072f5f9079ac965f5cfb5a068102e

SHA512
10b111d6af5eb88f91f4838c854c3a9949400adfe32c792494b400175705591d8f2e52b53321ac000c0ff6cbbd9b9f8f0664988242b5f49b1314f38f8d5b91c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2a91fa8e2baad4d8007dcb680cb17c04

SHA1
e42d60f46873dc5febaca6a71c0db8c2e87c9e30

SHA256
416b13f8ae83f7e8f901499de34137eeaf928a48a08ac2f1b7ff5b3f79e1f8f4

SHA512
5b53f39d16e5f4493a6d04e44ab1b9123b3268987d8ccd95ef355200360c8b45345a3227993fe4a253acdde2944355f769b83ad7c372027b8e499a1d30709c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fa96bbfaf46abf20062060cafd7b9b82

SHA1
a1d09df8942b3df84a1731bc28281c165585649c

SHA256
255feefcae911192e10d80ca319422ceb5d4effab56bb4803833d64205c97da4

SHA512
be3eb1328e9270f90784f61e0a9f3a48edbf54c53876a357a8c963e8742f55b828486b68d26890a70a2b90fc86515951892b119cf1c93d0db7be5426ced9f0cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4d7124cbe7cb3e858ec97618275de60

SHA1
728f8739e82a5af8416d4f1953ce4f04fe353b4b

SHA256
cf8040c182d4e3f3c0c64ebce7cac4bf89c23293062924b690f8754b33f3e3c3

SHA512
0db18c5b74271bffc2d33c6394d8c8012fa5e79b8a87ac1faea11459167e1fffb8f87a7a81e7ec45a2651684f4b1de09c445af5d9430ea7a305d333bc4890467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58aaa29b5e07eb651ce40caef5032bae

SHA1
4b4ad1d97b585129033b4a992b20f6b33c0b8b98

SHA256
2c7ddecd60235ad5bfbd8c3319dbd8661b13d55e8769559c19af3694a1746a16

SHA512
d435775227f529cbdb3e7ddc9e0b31444d4e95313ed2417056ee9d4a0fe6c82a41e9d59cc66382ec7f0d825baa4dfb4695427fdb936601e4f1a9f3a717f6dc5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e734dcc3c03ce91443c0a4696471546a

SHA1
a21c33195c49b73a4f6cbb432ef76b08db8c31c4

SHA256
6a0fca9427085c0208d339af56f8cf780bee6645d85746ad5dafda4064476db9

SHA512
cc2f6eca3e84f0a1b0b077d52f2159b08c6e7955870aee60eed0be0f4f8fdd1ca0668564dab7e6391755f17f5d265758bd5ee2c196db20b0647a30ca8245d46c

Download Submit
\??\pipe\LOCAL\crashpad_5072_EDPPDEQZVAUXYCKE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit