069062c3c4ba5808ef90bcdf7fa93b571c4ed5fd82248d22451e448a45f7d8a9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6576ab27a14a05dba9dbcb0151a49540_JaffaCakes118.html
Size

175KB
MD5

6576ab27a14a05dba9dbcb0151a49540
SHA1

ed92f71a477c9fa801b70549cf4d9556c5260406
SHA256

069062c3c4ba5808ef90bcdf7fa93b571c4ed5fd82248d22451e448a45f7d8a9
SHA512

58f8c12bf31a8df87d6cb4b075fc32403ad13ae508a90fa4e7426722a83cedf47c4756170b80b6b11ce4f6ea85be4703db79397a980bcd42757d5f4912fe9c70
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3EGNkFnYfBCJiZb+aeTH+WK/Lf1/hpnVSV:S9CT3E/F2BCJiWB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4632	msedge.exe
4632	msedge.exe
4428	msedge.exe
4428	msedge.exe
3080	identity_helper.exe
3080	identity_helper.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4428 wrote to memory of 4800	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4800	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2888	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 4360	4428	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6576ab27a14a05dba9dbcb0151a49540_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec5a346f8,0x7ffec5a34708,0x7ffec5a34718
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9026354613174735607,8313820412051394558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
f6357be4da80706e01af5038b998cde2

SHA1
821e15c69193b19da5f19b33f367a45a907bd391

SHA256
98a771b80bd5f3d5602add8d501307d94d61e4f59697607f72e413833756199f

SHA512
e0d45376c9843b01769b962ce69c90ccee030611be05b38e54f64c7368a35e5a58d4e3d1f2be666603882237d7d305ccd8cd51a76af86ac2700bb79b5116d8ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f89267804f366e5f0c1643784646a460

SHA1
21ae8ce7f731ce4fc09efa3537a4a06e90237d13

SHA256
06ebed26b47ec87f8f949e05c5430c49f82845f797fc74532157351f944af807

SHA512
67f6e268d9d0bdd273aba1a23932f7ba5ca2307fbc5aa997a1d18452a91921b1cf742ecb0c53d2de3f23af36b25a16c8d647d4535b525834444acc395f328c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c1bb190d46dfc0c8aa2e3e8c7c4d826e

SHA1
612faeb8b3358c9496ef50ca134fed4ec5a6b935

SHA256
87fa0986c7da4033c76aa26bdfacba47b2d241cf3821ac7e01e09bcb73ae1b38

SHA512
428c8ff411af5efbdc1325f966da8fde36bc24b0088cb4e052252f96cbc83cd06d603bb3a3650b4defaf4d2b90262432375fb1f5fb76868276ecbb7ea4a2a65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
610fa6caba569cbaee415a4f41773b11

SHA1
8f1936185737151771e6ce6bd08252ecca15d5e6

SHA256
fd685b867ce33cc717fcb8c7040f38a35e4332504a8fa814cb3589b900a9d75b

SHA512
9f13d112fd772f74d6ff296cff102e0c39ed3b793811fe88c3308ff2f68fb55114fa63d53261d7e764a29e7394ab38cd39d3b98709fb5b43bbabb0f784be274f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5c0bea2b0cd75aa14d899bd8cb0ca4a

SHA1
eb508e8c42abcacfd96652aab94ad9ee6218796c

SHA256
82325a5cbc13e2a4f3cb041d932b3b19a748c036672a00a8e78c4e95d46190df

SHA512
059290558f634c4ff63d0f9515ad13d29449e463fbd140c7f9e8cf474081ea0f0eab18a78b72c5369fa9b75a5e5e7c0d317bf54bc91e5911a5f65c1621870507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0a8d3d5-5e85-49e6-bd48-52598e76af2e.tmp

Filesize
11KB

MD5
1b39ddb6cc6ffd4ebd4cb797b75947d5

SHA1
99b04baa1437986eb0d6367ab84af6a2d111052d

SHA256
d16bd3381e5883b2f6c110b76307ff921343d9cfd31361c3218e0bd42ffc7919

SHA512
1ed1ce9f62f4a44ed33075a04964a965c3ebbd63af42dd6520a11119381aff50d94652b9356c7ddcb5aa5f924d8398ee914b93100af60e905b62d269dcc585c6

Download Submit
\??\pipe\LOCAL\crashpad_4428_FOHASNPAEMWOKCBQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit