a40c8946bda77b3f8a941429932340ae8c0da551f6470d41948458cca755c082

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65beaa40330da946e1a6617d1c509b30_JaffaCakes118.html
Size

124KB
MD5

65beaa40330da946e1a6617d1c509b30
SHA1

9355882aea5f1ef962d298acb810c755c9f1a491
SHA256

a40c8946bda77b3f8a941429932340ae8c0da551f6470d41948458cca755c082
SHA512

57bc74325163a19a9d46f36eebc4741ac65455dc5dbe3dff72400b4611e6e6072756a6060a0eaadf59c2aed5842eef1df8f1c6ded5fdcbf7878185540fc0a78f
SSDEEP

3072:4UcjvG8rMUcXmNRS7xjbM1w06o1oV8zEtjMv:QGXmNRE81

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1196	msedge.exe
1196	msedge.exe
1868	msedge.exe
1868	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1868 msedge.exe
1868 msedge.exe
1868 msedge.exe
1868 msedge.exe
1868 msedge.exe
1868 msedge.exe
1868 msedge.exe
1868 msedge.exe
1868 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1868 wrote to memory of 3988	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3988	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1160	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1196	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 1196	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe
PID 1868 wrote to memory of 3940	1868	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65beaa40330da946e1a6617d1c509b30_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd4718
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
2⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
2⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
2⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16826012820608939712,10581090663888913171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
4e2b78923cad12142236b79fda9b2b75

SHA1
7333a061bd2162f4a8af737e0f64c4cc3110c8ff

SHA256
915030932d34ece5ef1654d63cc3a06119ff179c1123319e9c7a1fb1783d170a

SHA512
ebe7c373f1e9b92ff02639075d5be190c3e4a31370e17b8eb5938579c4ae5d8350cc2b6bb15b26850d76e12ba841fb5d3f200436452d2c5a9ca689c4714aa6ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
e989972c962969678183e32392d4ce39

SHA1
ea2df834029dcb214e7e53bbc6cee25634bd1578

SHA256
00fd3df6092c853787f828af2f6167cdef55972b3278119e46cf714a3af92583

SHA512
c30376213202bf5b047cf1aa9c2a9a0638636c283110e77f2df786e8c5b7f64e36558633cc16c1d1cda509e9507fc57837e9ad3dfdf35d229bf29005a6e892bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
609d3412ed0c5b063b1c205c10341786

SHA1
78b63db3bc65a52e08421c30be59fd2fd3807652

SHA256
dd5c539dfd573be17ca3913106938c83a88041b42141945aaab5c516522f1540

SHA512
716495698bfc6ade5bd0ee7b799c61a14a19865c06310448ef21357ba6e13885345543124c1fe34c91904694ad717dfbf4aae3b1d9ce158b0ba6d45f564e27fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
6cd669c572d55eb75b31557b06cbcac5

SHA1
6d843ea3682e49f66b7b210c8ffe60dccccc0826

SHA256
339b937517cebada1d330b3e5115e3558dee6e7b15ece67b5cadba6aefe78520

SHA512
8470a0fc6cd4c56ec37973d9f8e3ebedc478de4d863237bb48405407761fd9b9db5a4607288d9911d28609e27d787765beb4b26f4f41af578a3fb822f1db0b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
b07b770b11646a9deeb8816c9c4b3dd6

SHA1
484c9a42b75119c587a17eb38de72aff092221ff

SHA256
00827b779f243897e0acb46634be8be5118562bb373994d5692d0df6a7d01670

SHA512
1764acd0f797889c1e0c4a17b9f6b34ba58f6a7d882e807a87a9498e8cb595038a05349f319d58a13a7f06f9ea3f1de385c3832eab9c5ba97a2147b427f57479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
a242deb6fc2ad7b49abe12d7e5cf3c28

SHA1
9285230321b36d756ad398c12b3ae9a87f080f22

SHA256
836a8d047aa994b760eb6c3466f607e4c36018d64da9004c9b52427c55d3b57c

SHA512
57639d532129f5b93bcf83b770e6c350ce6f11d43a9232f3d03bdd979217e2f6825ba8cdfca01219f21bc57ac00ca3877d09fbe4e3d79c55c41a147323f1b608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
fd48a3da8a68bf14a4aaf448dd02b481

SHA1
90adb76e156b4fe24f4a2f596b1b8036bd36cae2

SHA256
b42f21b0041774bb6a8c19a08f73ce1cc8ad8c7639d2565b489340849a61caeb

SHA512
69be2da24d0deb33516a4062c8f31545c43e16e5d5d408f7572e390d8bafabb80167e8b1f9913e05d27418ff8dd2d05bd80b1b2e6f9e3950f52ac085d3b59600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
15c5a4044aaf3eb06478af5b16476457

SHA1
b1964370705635498a185fb7691fb99ee63e16a7

SHA256
79610606c12814dbde80122685e69865f89246e30c74eac3a726281339a49dc1

SHA512
bec217f9e84a3839af4df1ac00146bb20d3c8d31ba7442d91dc0d2f3a63b499a2f59ad4e2ac855abbb6719bb7f1f36110ecc35d04e8fb3290d2c886097280cb5

Download Submit
\??\pipe\LOCAL\crashpad_1868_ZRGNJMKCIWZGSPJX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit