a7f846bef32f08c2317ce5ce48cc814512806d61a496a2ac1fd2aef05f4d9a82

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68bebf755096e10ba4fd9ed5f3c85364_JaffaCakes118.html
Size

175KB
MD5

68bebf755096e10ba4fd9ed5f3c85364
SHA1

73097ad791b537c09287e0c94115a224657700df
SHA256

a7f846bef32f08c2317ce5ce48cc814512806d61a496a2ac1fd2aef05f4d9a82
SHA512

f4d83e813604e746fd7a8f3ead90dd02a50636f907e7b28a4817549cc00db6ce0974b24d20b77acfe1242a96f7b9ccf9ba662b71282545871a4241aa0a41c751
SSDEEP

1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS3XGNkFQYfBCJis0+aeTH+WK/Lf1/hmnVSV:SOoT3X/FFBCJiWm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4588	msedge.exe
4588	msedge.exe
3668	msedge.exe
3668	msedge.exe
4472	identity_helper.exe
4472	identity_helper.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3668 wrote to memory of 4504	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 4504	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3160	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 4588	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 4588	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 3580	3668	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68bebf755096e10ba4fd9ed5f3c85364_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
2⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
2⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
2⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
2⤵
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
2⤵
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,136430463168746611,10463214345095917455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
336B

MD5
f5c599575216e04ffce4d0abe2a34de1

SHA1
ff7318598b377e35cf6a5afa417609780cb9adba

SHA256
774bc2e9bd5cfcce5f0448e9e26341902f4d379dfdabbb12637646f0c8bf028e

SHA512
88c99511ed2a0a096dbe05c94256919b3e4b3fb528c22a3530f36ebc1a88830822b94c954ba5f467805130b6a405ff78197d9a0cd6bc4b2b19aafbd194418c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
48205b89ccfb3b4d2307627bbbc5c8b2

SHA1
c6025eebd079ef5eafcbd6e2197c4d7f21450e5f

SHA256
95f3e94e4c773bf178386082d03074e31742731b64252c3a3a7704584bde81b3

SHA512
00dec0841494a761acc0538220bda83d7eb3e3460315226ae52c599e7c54b708122a305d8441e1b447f7ed51333041093fd5a2deee0ff7693da58bf17278e9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
a94c98d96078ee19cd4e64c3781f9ea4

SHA1
452bab54997c7b05dd5bc916b1fb57126a6adafb

SHA256
c1f942a934b3f9d27d25f84ff673039e7ea0110a1142d8865646ba4538d62502

SHA512
f82fb343cf9967b1c902f031053d034f82696e1c02faaa6aabde8e8320d1182c58ad144b3d27bc8a03b01019d431ba5ffdd46e5892e88db9447e13562a7604e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3e5f3ea218944b373693f9fad604dd62

SHA1
e6bcb77151435443a0457435d8782779e684add4

SHA256
e6811561f8f5bf8ffebfb0ae1d41f498a33326f2f7cd26af87c78e31c1e0ca48

SHA512
2431c7973d8e227f3c0f0e1876490258be5751118a960b298f116b1080e47ffb34f5e9d549d71293ede9ac3dc5f66ce408255d09482f641e4d1649a9dc46a60c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
d4652c1392c6620674c46f99b2388ce9

SHA1
9d89cc9f1534bed44a80149efe01e19eb3ff2f01

SHA256
1fc24bb0ea95ef8d991434fa10baecbad8bf83e6ac9e7285a88da1ef1c27b8dc

SHA512
15b206452b4bf1bc03fdf96289e0e942c9bcc51c901a3af2374b07864eb86d8674845a56a629f1234c31c6f2f6a72ef03ab661258983e36d5a54ff4dd05689fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
869786bfc63dc42bbb7c173f66f7010f

SHA1
648f65993c1b097995269265ecde7729a161aa5a

SHA256
598321394349059720e837f48eaf2bdc33ecdf50474afcdbd5ea1c1accbc8a61

SHA512
586ca254fc3d0a1f477ebd609932b2b29914bf8fe16c61ed54dbfb83a19d1a071dd230e47ac9d44594b56df83cafec1f0dc3d9af72987aba173c5f8a029701bd

Download Submit
\??\pipe\LOCAL\crashpad_3668_IKRTYFARXVRRVODX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit