f0115851afdaf10a83c0d4a0cc7291e5fb646591af19d3b205b15d4ce14d7013

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e374164c84294fb9eae8a8ec525337_JaffaCakes118.html
Size

51KB
MD5

65e374164c84294fb9eae8a8ec525337
SHA1

5bda5386a042c50f69527f97387f2c71f2e4f54c
SHA256

f0115851afdaf10a83c0d4a0cc7291e5fb646591af19d3b205b15d4ce14d7013
SHA512

126aedebdb268e82cfe1d95b9f7152d9a4da7137fd35f5f223286156a4fb231051211f0772182cc9850c240c7afb367d61b98bdfd4d4c37171f93031a7494dcc
SSDEEP

1536:zRRT9rCX7CeHAKsPbQJ1CPMeBrVjTRvRb8WNeU02zArQJt:zRx9rCX7CeTsPbQJMPMQRZPNNara

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3484	msedge.exe
3484	msedge.exe
1504	msedge.exe
1504	msedge.exe
3760	identity_helper.exe
3760	identity_helper.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1504 msedge.exe
1504 msedge.exe
1504 msedge.exe
1504 msedge.exe
1504 msedge.exe
1504 msedge.exe
1504 msedge.exe
1504 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1504 wrote to memory of 4992	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4992	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 1896	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 3484	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 3484	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe
PID 1504 wrote to memory of 4756	1504	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65e374164c84294fb9eae8a8ec525337_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
2⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
2⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
2⤵
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
2⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
2⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
2⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
2⤵
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,18047677029485577248,18045007262132071482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5968 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7b7102f4fe7ed805d1a50c02b7862733

SHA1
7c2f9985f223f141a78d181f0f71be1f156250f2

SHA256
38ff9c51d50fb6ee4524b6a40843203d6b7a15ff433fbb1b8c59a0889930e159

SHA512
59f2b892ed6ebe3f104e32d45decbf2a9964ce0a131f0aa7008e2d8e343970c838ec29012f6458566481e970540a5950c796946434eab9493af92a8ed15734ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
41d8dc9c71c4c61b9469bfae61dfd545

SHA1
912e02c400f62dc3f8a228e2498fa0225f85b3ff

SHA256
d8b6163969e23c8c438513fbed814ec52b2783f0f55a6feb66be55385d7b6686

SHA512
d2d7a7bbb6f8efb4b6d3002178bd84708044615bfc0a7e5bd111cf7571e337321017e416915135caf7267b493ce2b2d49c4c85804844eee33e3815ac951a0612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d1055a6e2212f1488f86d21e49d558c6

SHA1
30af869253c80064fbb11d253bdff4bfd094531b

SHA256
d2952dd89559bfbdca0aaafe12e039f502950860b0d68479331d67b289282b18

SHA512
b312c512f3b3227c0675f7eea23d334daf93022e7d37d81064453cc97d3f8306abb392ec207f7db271e831ee86e9e1d5ae7bd72fc0b86cf24e96dc617021137a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3baba3b3453c95bbbcc60bb6e31c58ed

SHA1
b8efd59601803664315f8911609c178e77d61374

SHA256
dac6e76693543f20347e9002c62bc9ef1d2ca48d39f6d07ebda3b43698be94b2

SHA512
162a7e33d6c8f3a9d972c730454f1be99c48bf9e468a140a3247378c02774794df35e5576acd0fb24c9323c7f0ab1d5ad9e2aca8fba2d37db7849928f2c939e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2b789467be81d675a7181a47c4d1d3f9

SHA1
5305ea794788898f3ce77c9e5f552bb40d9deaa3

SHA256
5e584f4fb47236c4f75c2c2813eaf1008d477ad4543f24bf9865d106cba47832

SHA512
92a4fac5d114e15756217650177d780298ba8d1a826d2975faa15c92e3d4fd97fd1210364fc0df4473fb68143d074d56c2b810240a653e0b0bf505891f5f9f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f057dd945bdc018bdad0b53c278b90f

SHA1
d4c6f99098002aa1b7ba622ef7e7dfbecf4bf9b2

SHA256
a9b58ab8b17cd82c0c8ca605b7c80caf390da1c62d3fa6a2f5a27964adfc1d68

SHA512
e0d05b58c8f0a2efffb19c145f12bd862331e82da29ac5c25460242670e8903c5659bf14475c37ebd39d8d12745ff50702e57696cc375145d1cf577e58d1ac47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1f0499e263c4d7b6f5e2543836d11a3

SHA1
dac4344dfa0565e52bba006365876ae5009092b9

SHA256
69f046aa3023c37d28f1a1af6a3f41f8ea7533303e10ac15d9b3d850ac565424

SHA512
b83ecec28b299c8996479cb7d258429fa5756a613c39c276d5e9f65f3f478ccef6a6a436c16d0b75a16b5c30a6497e314455662e91683f6cca439f71f0405bac

Download Submit
\??\pipe\LOCAL\crashpad_1504_ZTXTAVBBVGEEMSEP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit