9a830d954052e83437202b4ad2f447dd66ecfaeea2014bb827afc22ce570c5ac

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e1b346b62763fce915a578f52f1e56_JaffaCakes118.html
Size

107KB
MD5

68e1b346b62763fce915a578f52f1e56
SHA1

bac4fd28755e630f99a83e16482b81bab514fc99
SHA256

9a830d954052e83437202b4ad2f447dd66ecfaeea2014bb827afc22ce570c5ac
SHA512

e54a2f7f2eba6b65246f3cc60ee2351e82b405189bdd3f16828c6d2e615ad872295e9d4870a271401cd6d2138ff531241ac4c25f9548a217241bbc16ba866329
SSDEEP

3072:MUcjvG8rMdcXmNRS/RHUCEm44BYpRkR8O4ktgf:krXmNRyt0RkR87

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2368	msedge.exe
2368	msedge.exe
1148	msedge.exe
1148	msedge.exe
1460	identity_helper.exe
1460	identity_helper.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe
1148 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1148 wrote to memory of 3948	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 3948	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 1900	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2368	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2368	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe
PID 1148 wrote to memory of 2260	1148	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68e1b346b62763fce915a578f52f1e56_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb263f46f8,0x7ffb263f4708,0x7ffb263f4718
2⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
2⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1076 /prefetch:8
2⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1076 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
2⤵
PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3522863426490234701,18142081223854412610,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ca2ea8ce29bb1cbcfdafa58783e9b09a

SHA1
411281b3ae3ba5aa47b5d9c8e4c6a047fa0ded47

SHA256
338a60f5058f92d58d5452cad8d1487b00578e74e466454ca5dbe049060bdf63

SHA512
2502fe74efad4722335cf354c40d061aaa747e16502621e0293540c01d447a4fe6218661b135f01a8d0c2a0e95a29b2821cda32e443baca01e9bfe6c0527f050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
007d33bd996fd15f06692a1f1491cd9c

SHA1
30cde0df2778cf1ea154189164a6da6c2cdaecd2

SHA256
82b122d57406111af0b06177de415f67ea201357fd14723d6c4dac1e4c8a65fc

SHA512
141bcef30fef4fba277c48a577849858ff3a4909dc7618d80b7bdb9a16f7cc178ff9ddbd2bb6672548ff15ad3ce7df0edc6443610b3d61fb468d85524cf1efd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
afeba47885f8bbfb271af312f8f72fbf

SHA1
772c72bb46b9e6e5e573e1b00b30475b33d6df37

SHA256
597d1335429a1546211833df53a05d20342b1a0034445e94a42c7d1f0c0adfea

SHA512
33d5d1ce55c7b00f2c88e8e80f79a5f091843a6f9976f26d4c08091fad1d65f7edb73c3d04772f2a4d8100d12b7a3bd891432396e04514a77cdcb0bcba82d24e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e371713b2ab68d4f3761b7579c76613

SHA1
66690921fbc2515461ef41d6706e28eabdcb9ae8

SHA256
b44ec28d5e57ea24b83b7e6f5ee0fbf2068bbdef5d23721ca7fbd995255629d4

SHA512
77bf6d59e96baa22dd4701975ee1d7a6d398263ec1c921ccd2226d32a373ca68a21691d4284e440bce86e20074df49331a34d9e5cf6d9d94b12ccdc3ebb5ecfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fecfbc75e0d3433350fce106dedd1137

SHA1
cd03ab0535746f4aa61401f7d2d5825a4cceb12e

SHA256
ebae8d5c46ebaf32d36aa279d734e4b83df7b1c256bc40d9eead2f95533b64f7

SHA512
91baa6b352efc70e4da930556f7aac7a7c77c7f259e1db6ea2131fee237b901ffe6299daee91770c5fd078eaa92364f51c553a0787a90b4fe50b025eadbacc85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eea6a1bbd55edfa4db6313632f86c25c

SHA1
cea399834d512d281b57f1926083ac0bacf2f123

SHA256
aea1d5f410b86e8eb1532be9d27fd6a17d4cee1e01fd36c9bfae19eeed94ece0

SHA512
5d96b15550f8759406078cb07ed8f9d4c9efe5d24fd69ecb25bc6602e71d03a1c59f112754651286b6dec1110da9b8b1f5d98d0541bba64d54b7fa5e7179d4dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df2ffbc70691e6f5ded5380b0ea1aca0

SHA1
726ecff074a31052844bbef44e92741a315ce5a2

SHA256
86682178588564705d9ce24a492f449d27e20758d19b425fe9828e96f1fac50a

SHA512
e5cbab71496ac47a8902eed17e3662c67f0dc250ea17a3a2bda78c111ebeef6db103842f57b332ec9c608e936fe75f5c0e52ef7c2ff54614dcdb8b01de5250ab

Download Submit
\??\pipe\LOCAL\crashpad_1148_WTGJDDQTWFEMTUGI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit