cab41b8e01c90def3de72b5ec7218f050209b886f9c3de08780bd318a5c659dc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e6a8b39b630c8480072055ee0c2aa4_JaffaCakes118.html
Size

65KB
MD5

68e6a8b39b630c8480072055ee0c2aa4
SHA1

798a8e345e55d4e638dcccc4f3d9cc38f15bb83a
SHA256

cab41b8e01c90def3de72b5ec7218f050209b886f9c3de08780bd318a5c659dc
SHA512

7ca32d7d11968fbd04696d05cfb962ed68d1f2e0b057f46b921029b49c5080ed15fe3ce8da990ee53ae7b44ff26fef7945811e81c3288d0b6d1d820843e1a43f
SSDEEP

768:zgOriWNcaSoagGraYOD3qAOjb/CLfYg6jX6FwNgbz29gf:k/NaYOOjZgb/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4708	msedge.exe
4708	msedge.exe
3644	msedge.exe
3644	msedge.exe
2728	identity_helper.exe
2728	identity_helper.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3644 msedge.exe
3644 msedge.exe
3644 msedge.exe
3644 msedge.exe
3644 msedge.exe
3644 msedge.exe
3644 msedge.exe
3644 msedge.exe
3644 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3644 wrote to memory of 972	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 972	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3052	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 4708	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 4708	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 1400	3644	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68e6a8b39b630c8480072055ee0c2aa4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf146f8,0x7ffcaaf14708,0x7ffcaaf14718
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
2⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
2⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
2⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
2⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
2⤵
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,15468531686107448615,15750993733065853258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6724511b5a30feccf23db1c05e1f317c

SHA1
f7e19216a10f223e5b07553f3e49deb03b382655

SHA256
bff8b357f3e713d9934fd9ec76fb7456208185a88a1fd705da1f40c4efddfe9a

SHA512
fbdb4a6ae763f7624f7f386aff1730b224288d1ad1c8ee8d8f0efda5b420e612b74b11ef49cdfd7828367c9fb48df880a78a4be4d98946d64ca96ba4cccbdbd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
263504cae35335d0030aadf13a64eedb

SHA1
931ebf3d413dc4c76d7dba234a2a08f53da927bc

SHA256
2656f065af708472d0fd042982bcffcccf5d0fb3ec95f88da64edb60cf21894c

SHA512
926c965730d38e1b3554f0a51725e5b739b74910553d3c9f76a10e5a661ab77fc8a810beee7b44c98db98fdad397ec5f9108639aa844f48cac69c4825207f255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
80bfcc3ff2c9ed2fadcde3c911342858

SHA1
2d1ebd36d723e2482fa7cadf99fb633b742496ec

SHA256
2fcd4583a0f7865e3086b7e47f7efd610800bea0364cde60532b1bf012710288

SHA512
763d9399eb68c4b8ed7a6a1732e1607ce40ce3803b2132048d1b95b122a1865947d936f9c7f2e8bb3c3482882efa5fdbe84195fdda1da8ca89567717b4ca737b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f7a158b2633495c2b6a3a84a0974ea4d

SHA1
7f2f28174e0df37e228e364fed18d5472dade9c1

SHA256
9df87cda99ded1aa359e60c1c0ed9abe2147326edb3540a4ec5c26a4455e466a

SHA512
91d47c9907bc84a1bd155fe1e1d7efea9f0b99ee80ac24e916fa997bdc5331ce26e418624301228bb515f203c1547a9a8d50acd5fde86de5fab48ba1a64ba22f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47c7c340eb3a3d072348cb0b7a880acf

SHA1
c9e32b20edc0b8e2bd1e1c0d7830ca4ae38e0b93

SHA256
891b8e52a8712111e0d65a8bf727df0e80f908db4ca1958234745a30a74a7ae1

SHA512
e796ce7f5bc6bee5269b7e2cda13b7125c78afe8c32611e1e414e39645ba046b45dd393d46594145a1763bb728105e1c55814c183e642681c60abd7669f03f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc34cefc79770b7038b9bcb07074c491

SHA1
a4c508a62697795fab9c8878e7403346de026c0e

SHA256
75ca39982878f404166fe5a5338dd10e0887ccceb2ba51ab337e4694b973751c

SHA512
43f2d7136d9894cf220788d73e1de1ab48e6e915af9e4b67a92d0dc522298f292e2bf02eb8fac2701cac9eca38ef30891b22d0f585716a26aa876d433f1cb8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
afeba80ea1cc67a9705f0087e4c63709

SHA1
2395671e9b592a1ace6b096fa96a8cfeef2a9575

SHA256
9f9459c4f0d51f2e088415965833277221b348493c15356e7c9da74ce023a024

SHA512
a2db55348adbdd3c6f479c165cd6a7dd7691584540a7cf2a620b7e2badbf539905801994140793f3dd531c1b09ba81af010f19d2b8d6d4354a06bc588b99518f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a00cf151b70cb7294d35e356c0414dc

SHA1
b2cac929291f318849612e0ee8bf617326d32a82

SHA256
48ac8540e3627cb9f9d46b5159596002630ade159e2aa45bfb03c3585180d766

SHA512
1834b67dfa244c2c36f3bebe36a6613921ac315e5bba25cbfe153c02a6d26ad3378d97b7846c03042e31d25a821424b1330fa6339acd2b7480dc018db8857e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7954410294817307f0713f524370cde5

SHA1
75882d4d6d019f8b049152b723a400b4340589fc

SHA256
035deb4de7061dd02165fc07fe3e0626290173cae1b694bdb123098c65a04ef9

SHA512
ecd19ff29f6bf88abf47a149149089e66709a42c7772b263db747d4e7f3c4b99daf303f9d8fc07ca11e6bea52a633811fb4a5e1b622690866019c2da42154915

Download Submit
\??\pipe\LOCAL\crashpad_3644_PCLZPJDFORDFCHVZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit