a2782daa0b306b7a987f4bed6b1410122d87a2d5fe25f58cb7692f27c270cdd3

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65bc95e5067e71b5faef442083aa6852_JaffaCakes118.html
Size

175KB
MD5

65bc95e5067e71b5faef442083aa6852
SHA1

407ce7efd3c2fe7e03658ea94302b8074ae2016a
SHA256

a2782daa0b306b7a987f4bed6b1410122d87a2d5fe25f58cb7692f27c270cdd3
SHA512

1c4c422c99d75dea87b0471fd74377a59632827c005f69615c28d17c493d5cb23aca3ba97d8c912d9651b887f151a5d7e41fc1c09c1c23f2556b949dbf339aea
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3dGNkFCYfBCJiZd+aeTH+WK/Lf1/hpnVSV:S9CT3d/FTBCJisB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4336	msedge.exe
4336	msedge.exe
4896	msedge.exe
4896	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4896 wrote to memory of 5780	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 5780	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 1492	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 4336	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 4336	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe
PID 4896 wrote to memory of 2384	4896	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65bc95e5067e71b5faef442083aa6852_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
2⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
2⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
2⤵
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
2⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
2⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
2⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
2⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
2⤵
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3827331189456113869,4369264867100948564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a7537ca062cf7063_0

Filesize
243B

MD5
98f6c3d0c1f9944c756a0821603b9755

SHA1
7f7646f81f55beab424e94601c954464de75141c

SHA256
3608f043eba5748473d65f4745ec13c8ee2d33b37e0897599b7c1f3e2deb36e0

SHA512
fe8f961d84e595c8632e1317630ae6c0b0fa2572a43fe0769a6271671a23769ac05d9436a44efcca73ce0d6735eebf3be4358c2e4df8064d6972ffffd4688b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
f56e8f1fc7c757b94701cd63d794cf31

SHA1
6a5f50d774ba6d798855ac2342a05ebbae28b471

SHA256
b5401262d072ad07025635bf290874da07a3aced96a1a300da4b1317d239a238

SHA512
220164b230e606bb58a9fc727115f098ad92774d9cb2f03290482e25aba759fdb427b4877a794b8d1e632c2079af5fe64629a605c8f6f71777f2a23e6fb73c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b81ebfe74b78bee7388a921487d046b5

SHA1
c0e9f431f59f4ecdd784dcceb76f5f768814d04e

SHA256
38c7f7500540e4f52b5cfb92d246dcdf3c966208f6ac6c3834bd15f43f4f4fe4

SHA512
02fe47f2b89cc0cf64bc03496600b042506ea0bd051defb3c9ffce2ca2fadd8ed9677b1d5cbfc14f32098033ff60b4f923d3aefd487d6ae2ab6fcf7e9fee3563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e54f82de75ddc2f3388194a0dbd5f1ee

SHA1
4f5227577f3d4c39fd6cbbae575869f3128cf81e

SHA256
a1cc6c42f6e9acb2c0b2404354c9d141f719dabf012c27a0b25076b07b7e8765

SHA512
a4366c1f2dd0befa454fcbeb85958d93743b77bd6ca1273625e945e7ae065ae84ce1f171b1a2d624b38e1705ecc4a49fe6972fafb01e0e44c98a6f55cb96714c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f06dd07e4db25405f53846819c4b8d4c

SHA1
f240b0f22574ab608867f8712f7002c7a21435ab

SHA256
c451e9230547d54cddbdc177c3acd0e0199d33db9abcaf96906b5dd53e6b5f21

SHA512
412651ced10ee5c8627b5be1f71010df936cf04a37b2b4f7a48ba367d2d9542fa330a41a2b5377beefe9b369bbaaaf9dd0f6fc5334f41a4a63fccfcc28b12fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a8f430cb73110df89ebf7e8cb50ae5f

SHA1
26f4eb63e2432807e1ae30a7d90141ab1e25a253

SHA256
257663685599e0553e0d82bca4288148d2a5878c77be4e91deba4ae28e1b7973

SHA512
ab20afcbd62e0f2176ca372c46b7a43b6dc30ea283bb9155044afbdff93449a422ce17a626bed0feb4f213f039321e4c454c0354e99ebd9a378d77c243585bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6ebf4bcd6673c1062cf9a07abdfab8c

SHA1
cdcdde45bec1a5388add293428de460e154adc01

SHA256
0455975a402a83aaba0937154f99919d197917fa59dacad957e2768ac1ecf0c8

SHA512
1d738cec7748887f5310a0d85edef2d93ad5cab323c3410fbb3fdf41dacca4daae7dc76aaa267a606853b601ab396297615ab80d3378f52f18c1de7d376c6e07

Download Submit
\??\pipe\LOCAL\crashpad_4896_BDQUTIJOUATGJJGH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit