d1c14829418073120e75fe829ae32f8f93e0b19f71c15b6ece54a6ce81f3d8a8

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63fe82057e8ceca41baa6c209c3a77c6_JaffaCakes118.html
Size

73KB
MD5

63fe82057e8ceca41baa6c209c3a77c6
SHA1

ea826f82e104305a69a34b36d8ef1a82442a922d
SHA256

d1c14829418073120e75fe829ae32f8f93e0b19f71c15b6ece54a6ce81f3d8a8
SHA512

be99f0c2a1838638eba2e1645baaadadf7bd2a6323fd191a716460412a10bb14f763ba83d8879aa92396bf3a29c907da15b391f540a6e73e2540e7dd0cc6077f
SSDEEP

768:RgOriWNcaSoBgGzNc9kOnE4e6QqIMbefU7lf05LXjFmNIkFu29GN:malNcOOnEQafmlyqIkFE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
2800	msedge.exe
2800	msedge.exe
3936	identity_helper.exe
3936	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2800 msedge.exe
2800 msedge.exe
2800 msedge.exe
2800 msedge.exe
2800 msedge.exe
2800 msedge.exe
2800 msedge.exe
2800 msedge.exe
2800 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2800 wrote to memory of 720	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 720	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1844	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1148	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1148	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe
PID 2800 wrote to memory of 1292	2800	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63fe82057e8ceca41baa6c209c3a77c6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17915917366316805986,18074674963063202113,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x350
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
7dfe7969d2ea20bf7d3f77dca6155296

SHA1
77d0ce7714215c197952b32ae8e37c01c130ec0d

SHA256
afadcf1f2fdd91dfad75562e162713a5e14cac3495a51067bf7ca980b3a218d6

SHA512
0ff73f7438cca05b1fc722968412fd2cf05cc1417d1cae7e3a094e5ca91ad4dc63d2ba60de69f6b4167b0f559428a85de2419c4965bc797cb8ab00f05000fad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
fcdb092dbcea4eaef361e7c4cd7b6734

SHA1
3c2adfe2081693ef8e2bdf418596789b9517cc57

SHA256
ba3c91ec329918cbf83af75c744a9eff1fd5eb7283ede68549d2d1b2f7631510

SHA512
35d15be20a75a656f205e23d3202a460539cf4a897a16d9000bdbe9b453626b24fe8dfe339f3350fc3fa3635db904d06ec2255c284241f8fba4239cdf081b626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5253e197f8b4ebb73ad9e03b0c6ae99d

SHA1
1cc538ed9f39b8dacad3924eea0376c391c6aa5c

SHA256
17bd430765867f1270de1c73c097c457923a1164f1dcd763aea2b947e30afb66

SHA512
62ced762641a1f85cefc0b77b06af2b43d620cfa85ae6d8b3cf1b950f9eaad6da618938aedc573189224b4c45cdf0771c715a05a987fa268041329bd5da129fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36b1cff9d8453016e3a9bb63d3c95ccd

SHA1
d6e9525aa9be2627c9ec45cf028ba46d10b0663b

SHA256
2a4fa938e23c66ed9fa60df39fb06ea863983a42d30e569391e5dcb59e069e8d

SHA512
6076369713b9b9271d3bcbe0a6313d11721152bcb14891bd32082f6d054eeec061f3119590e44e258d08d2be6e50bb1acb14819beb1e2dd5e3a737e849cb863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
262a97e5a49cc5b64e0c0e5bba8ac475

SHA1
0d1633a6f795001d9d4b32eae5c4f21e75029f0c

SHA256
e11b21d4b4ec471c46bcb158c9aa0529fb8628b9bb78bbcab2f507451c95e74e

SHA512
4ad9b7cc40568daabe3cba3375fc6d6845689d9d2c0003c0259f81da1f719d2f52314a6e7ef87b3f4247393076e367dfa17fe28edfa01ec6b65c9d1ccf8e6b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cfecdda18a38bbe0152c6fd4b71087d

SHA1
3d0146b1343f25b982fd6fd8b301b5e91d38cc33

SHA256
a366ed42e04786e673778a08b5b57a6c47eb74c4c3a91cdec1d43513aa2baf89

SHA512
8fbd2b14361a33d4c1a08338aa410d7f9fc929f0ceb318fd8037c55039853c827a014feaba5fa643dd7489b98d02f11aece4b0f51c6bb4f7c84746b38ea749aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
645af9992b23198cc6ae950366d95230

SHA1
7ffafa5e80c3f98de093cf17aa7e79dede7d6f22

SHA256
babf44055c6ccc8730a51f14a1cf182b07519dd75516429279df8e54c5b76ba1

SHA512
d6f4440876b5c0ed4ba770551d96f2b0a6f6bc7b6490aa86b7e623eb4df476a87d7080ba30f3f9e500ab787d3bff0f45ee6a3024c4e33a10da7496ccfbd986ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70f10f5db2d75f33786b0ac943d3cf84

SHA1
0f4fba93663f1ac53c40367fe2efabc764c497f1

SHA256
badd0f7f4c9f1f36ccb3867cd2e89b843f28886fa07a44d5ffb67e29e3b57e35

SHA512
d6ecc0a69853712566e36985fe8999038fdafaf9d4a3863b3f759bfeda0d1751a32f21e218f101c775aaab2399485424d0775a5165aad3689b613f83c87bc9a4

Download Submit
\??\pipe\LOCAL\crashpad_2800_IMZBKCXERXLAYZBV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit