f60172c3a5434192299d52770fe64b51c334862e48e00ec4f888a747632a0633

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d72c95f7f0e7da20c46066d40ad9df_JaffaCakes118.html
Size

175KB
MD5

68d72c95f7f0e7da20c46066d40ad9df
SHA1

c7f8f8e33cc2ab53beb74e092ad47a9719e7454e
SHA256

f60172c3a5434192299d52770fe64b51c334862e48e00ec4f888a747632a0633
SHA512

938ccdf09a0a0b93ed82258c7801c95741d0ed2f8484de1bfcdaceb371ee99e829e5d9a5a7b0790db4539a300d08700676cdca07c3636f3b226f6793cdb413ef
SSDEEP

1536:Sqtd8hd8Wu8pI8Cd8hd8dQg0H//3oS3aGNkFTYfBCJis8+aeTH+WK/Lf1/hmnVSV:S4oT3a/FqBCJium

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5808	msedge.exe
5808	msedge.exe
2600	msedge.exe
2600	msedge.exe
1440	identity_helper.exe
1440	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2600 wrote to memory of 5352	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5352	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 6032	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5808	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5808	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe
PID 2600 wrote to memory of 5148	2600	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68d72c95f7f0e7da20c46066d40ad9df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffbf32f46f8,0x7ffbf32f4708,0x7ffbf32f4718
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16512270392803755289,15162070173675831643,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
0eeb691412d88680d1b3ca8881d4a686

SHA1
3e49ef4c1f650b7802b7fd45cb1ef4cb55d8160b

SHA256
3f3781cbd0b11fedcbe5955ac06d294e599d95378366dc1305b3912843e65c7e

SHA512
080d14d9d92f2f8728d3d83f9e9af0c33766b7c10f4187add8a39b918c6a4758353e57fb6bcea5c8485d670e48155a7b19460117cc7ddaa013f3879f4edb3f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f6767f6a2bff9e73011d31ab5bc9590d

SHA1
a815881c401cad121e2f198a8a726f5709a04aac

SHA256
42570b5f0004f66fbbd792b317a8a258ff0d94a86bf1851d9161883e0f9671ea

SHA512
6e68c9f63b9255de95550cdc250d17222b88dfbf083639282d54593307321b5d6aa3d7dc69c1a0ded09a408754d7734349bdfd366e1ab389b10f3f24dfef0a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ffbfc16ac694186fa89712d944511663

SHA1
27760e87662a98097df20ecffdf1f969db89da66

SHA256
8f59c1a469a019b603666df89d0d57c61c19f5e48c924cf1351fd9d53f4137b8

SHA512
8be8a1fdb64b9b96f28a6364309b94e3c61b55d3e19aaa81a1fffe74f5d33a2f6f13a03b7cdcf08637ceeac5102ca3a139cd0824ae90bfea9d154dd49db92640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
38dd0c52a6a6411cb89d0c54930a553d

SHA1
419d32a5a24ac9f7b3f320286d1835b4ff7552b1

SHA256
fd537192c3aa10cc3438117204c2be22f7055e72318e371acd1131c47f3113b2

SHA512
408d8cf2275e182c976edac6a081913d3e9bcf807addf09e170de3297026a9185cb1756465307b47b8edb8c9f813ede2d7bfb38049aa1c17ab7e3f777fbe17e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9124ce88bfa5c059321948ff863a3ea9

SHA1
aedb45549cef359cb936c27723de5910ab60e9a0

SHA256
d429fe2f46f1cb6d1c4247f5df00f9144d9c48afcb93b02e8ddf09c1730b04cb

SHA512
a8de2c37d354155c8ede79f1b469d6fec8ba5de4ceca4e4d26667bc69cdfed62316c0a446db691b44c910ec7aeae358264777ce95dbcbdb13121d364bfec8f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64e04c232cd408aa01ac4e7c147069db

SHA1
2a7a634cf6462759c1684bfbab87f4f9548a1251

SHA256
6cbdd966677cb23cd02f4ef545bdbe9480007ea059c45998c23358746a577978

SHA512
1549b67bee9e3d50017cba4a61e2f1f80dc6d8c2120d52e8537010cb11d05e117d8cfce0256eedcd46e798751166f8e6be3cbc331c71fc0daf51e83595c60bf4

Download Submit
\??\pipe\LOCAL\crashpad_2600_BQSAASZLLKTZQMKU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit