45af7e4c04b4e1dd81eb4b1fca63924fe5c133fb02d7bb10c8be915f7616adc6

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e9c04fb4269e3cc814893d94d8b951_JaffaCakes118.html
Size

167KB
MD5

68e9c04fb4269e3cc814893d94d8b951
SHA1

39c81955c72086c57f52819a9a4b3bbb083d8f59
SHA256

45af7e4c04b4e1dd81eb4b1fca63924fe5c133fb02d7bb10c8be915f7616adc6
SHA512

1b323dfc2ec034a35a6327975458e4c06802157ff78e605039c3144687c5c8545c8fc4e2304f01369a17d35502c93b7d0d912ce26bef31b9828c4f212e22335a
SSDEEP

3072:HwbmcAHRazvZNvKZrxDomfGFjLt2jdpCIQKtWlkeNVMs8sMyKMpgjnQ:HwieCXomfGFSpCKyhKs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
444	msedge.exe
444	msedge.exe
4976	msedge.exe
4976	msedge.exe
1616	identity_helper.exe
1616	identity_helper.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4976 wrote to memory of 1308	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1308	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 444	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 444	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4708	4976	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68e9c04fb4269e3cc814893d94d8b951_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd150d46f8,0x7ffd150d4708,0x7ffd150d4718
2⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
2⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
2⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
2⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
2⤵
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
2⤵
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
2⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17837510976022212740,8608734087675412745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
02f00f1b5c4ff6c21844b378eb474c3c

SHA1
3c53551cbeeba5fe174b8e23b6e9e765d80a18c8

SHA256
092cfb5e56d973363d74915c2bb278888790c1f0fb508ff8f9ebe6b4db4b9495

SHA512
fefa52c2004440df133f7b1ac5e75b878d1b43901f1b09517ff6f4bfdce2680cfeaaa0ac40d0f711018fd1629860b2528056faddf2f74c00b6a443dcc63a0adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3f7b816347ccb3a0fa9a5bfc72157343

SHA1
15b90525e3bf52e5be79ab9c30ef16a1db55dca0

SHA256
98efa4aef25bca81171e89d43f2d7134f1a68ab737d5a55a597fe8fdcafdcada

SHA512
b286ffd2b862980dd5bfd07b6ed12682c605f647ccc3002f5711005f59f0504da8958d58def195bf968404088d01ac3f2623e6cc3c868ce828d7284a6e2fd2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbb9820cb23755dae49f5a08021cc37f

SHA1
8bad37aa9b6c718fb1994a8b00e166b82bb7ab68

SHA256
d900836e30f63a426eb86f11ca0c909c39f8064a0b5de520d8e9ef2313f24107

SHA512
fbbce4eed0eb352c20763bf4ae54262efd15032f5607eb79c96a3f985a2462d624cd638ea08b83bbf5eaaba1354094556773595aada003653e407a580e09c949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a79eb2c884911926b08f91c77342c274

SHA1
1f55c4d843d19f34553d06975c5e6485bdfab56a

SHA256
c0bd0db23aa60af424a8ccf3975c4a48e481d1d069af4d52e3298b396cd2d34c

SHA512
14fe1dfed4d132730b20526bc29829c1dc8cf27eca1f87673c25d96ff80cd7dd9e75c45495fc961a0c2a23b8088adcb5f8f417b650c2d824d8f5bc0f5fa3c440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
629b21ac825628525466dbf20dc0d468

SHA1
3bebda085ba9c7ef1a2c30fe8faa48c4e2ea5da2

SHA256
d29be3ad238567c30cb57699cbbed5980434c9967628bf7a1aa27048504e351f

SHA512
6d03469aa315764dbb1875be0a09a09f4a26c0cb2a821ab82b55b93a02bda08596288e9cb680a2050e6513c53387eb29cc4e1499516e3f25fffd6b21dbd8bcdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ecd9a15e633414b7cb79d3ee8593b0f

SHA1
0c7a984e1bf81f37498bbb7c21997ecaeb551740

SHA256
857c926d116a1e947be08c0cecdc75e523ce0ae8254eda08921533a7a2db3c60

SHA512
d1277420daf9d98070437fca5727beac127b414a71e32b459b7946d9a3a48c950c17f363c5e6b4890af7ad4aeaa8a83ec8b07ab75c21adc395f56edab4517789

Download Submit
\??\pipe\LOCAL\crashpad_4976_EWPNAVZJWESNHORM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit