3656a3c0d7b1e3eb795bcfbfb550aa0e93d76973d6a68beb6f6d8e91b3137641

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b505c9c5db44599c9d70fc6d5a8cfa_JaffaCakes118.html
Size

25KB
MD5

65b505c9c5db44599c9d70fc6d5a8cfa
SHA1

ba4daed697357cb5f15295d7740448ef1c16c9f5
SHA256

3656a3c0d7b1e3eb795bcfbfb550aa0e93d76973d6a68beb6f6d8e91b3137641
SHA512

f63eb8006faa3cfed66a0a6f2f8c8c9ddd86e202704d2b797e5da28dc44329af92e9d4e280ee96d7d533d3281c56f87321a97a7072b5d29b69e367c6f89c3afc
SSDEEP

384:ccTxUvl8ZhuYokirIIZjr1JAjiU66XWVU7XDVFBrpYTM6oqpFpip/GRn8vpOvXZq:cD+NxNGGDaIiMJUnNr1xo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4652	msedge.exe
4652	msedge.exe
2460	msedge.exe
2460	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2460 wrote to memory of 1716	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 1716	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 2952	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 4652	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 4652	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe
PID 2460 wrote to memory of 3264	2460	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65b505c9c5db44599c9d70fc6d5a8cfa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceb5246f8,0x7ffceb524708,0x7ffceb524718
2⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
2⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
2⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
2⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
2⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
2⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
2⤵
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1524,17316663057432606646,17965140309906493077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6696 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
12269a6e93e64997b7f991b747e37ef0

SHA1
92429e2968d83abbcc6f51a678d584b5bff91cbf

SHA256
ad24ffbfd322660ed1cb3cf2e2ec12ff4a925cb2f82f4385c58569f617776438

SHA512
a525bc1313aeab75368ab8d234153c0341ac156ec2ad5e5c0c1055ba20d0b8c748b8cabb5a5225a74d4f0d187b640cf3c708094075a87f577252cb29ceb1122a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
6c3c2ee75a43f17e1c86877ea45abd83

SHA1
04bb3a4a68a7054f765bc6bae7e469b40723b351

SHA256
71f408a2b8459d983c3ffcd360ba76def3806623a9049c58a16b6a12e723facd

SHA512
81a6156e613ef1d36837ba5295d5e4cce1fd86d50f98b4db226d904c7b5c553eac6386388817b6507d7a1a353ea6dab9e365b5ae6c25c528dc05117e8c753a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
546f441cff3095077008747bfd1e85ed

SHA1
d15a4f2ffecf121260e6d107895b8769168d657d

SHA256
47e4859119c37a948616e723d0b9133221b7c083c5c0b65f8991d320e969853e

SHA512
5f8d1c1c730e19db2d8f8d4aa6fb11867d71ae8b495155ae3385eb3a3f75015c9ef36b760627a478be9965a51c76d016b4d90ac28e7a59d991688e669863fd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
33628ebcb942d155e3a998fb0091f4da

SHA1
4a42c684aa76ccf864ed6e3cfceddd500804f23c

SHA256
d40953996962f9347fc31773a7384ec24b91f4533694a22dbca03e59f9c6be17

SHA512
b727f6aa41865ee6aee95fd6c8dadd266610ac056a693af982c073ab7c5fcbaea1e8f6b5c188b5b4ccea020be034adb378bf7942316dacae7439f05ccb027789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
8c8a2c1ea1eebf1e232f09f97d620031

SHA1
56fa5ab07614928214ed969ac5b4a71f788c2fb1

SHA256
f5cced45f65d30ba2ba7e59054d8b14f05d3c647b783c273a552bb65f8eafbcf

SHA512
af2c65eca8f24aa1d435287bceb3a394cbdf60894f8fa89252d6a5db4df278e774451337556290e6faf13886f1b478330b79b4a097d1dc3bfde80297b519b198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
49f4622d59e7763756948e979aaec8d4

SHA1
4b28f104f2c58a48e7cb86581413e0dc794ba73a

SHA256
55a28c7cccbcc47c237a3b8315d3c5c7fc70f50de99a0b08d2058afd124f238b

SHA512
ba3f9322fe994260507f89e6deb770ddbd62cfd955bd0850c64dad648cbfdd0c9cf83409e3e8343171283a3afdcf3026f7e1af994cf2310266962d3962eded05

Download Submit
\??\pipe\LOCAL\crashpad_2460_HTCHDMAZUOJSLUBO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit