c92322d8b315dbe7668cf341d1673f5782f03d8ca50957c8fb08b31a409e8165

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c40cf6e115212d3a423dd6ac42bd1d_JaffaCakes118.html
Size

79KB
MD5

65c40cf6e115212d3a423dd6ac42bd1d
SHA1

369110abd2bf3fb6365d726ffa03c246e538c534
SHA256

c92322d8b315dbe7668cf341d1673f5782f03d8ca50957c8fb08b31a409e8165
SHA512

0440ac6a993874727585bde0bd86a14f5a93d4b4fc8ecd9cad78ec404f29f4394ed84dd8344256c73d59bd4f680c273d1040b896ec9e05f1475f2f73b43edbf0
SSDEEP

1536:L9szr+3Cz/OHzyOKcqcGI1O7zXOKlxIiOwiXS8+PQEd:L9AKBlKnOhJS8+PQEd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3540	msedge.exe
3540	msedge.exe
1460	msedge.exe
1460	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1460 wrote to memory of 1808	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 1808	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 4800	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3540	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3540	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe
PID 1460 wrote to memory of 3256	1460	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65c40cf6e115212d3a423dd6ac42bd1d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd16894718
2⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
2⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
2⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
2⤵
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10059701767428972673,6793511862394249068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c522f977ffad1ecffa1c1f5c8c28c4b8

SHA1
28dbc2931d3e3034e9b164c7a8d82b02e9de073b

SHA256
06336e4c7c64f91c64769b5761c9e52700eba1514daae8fab4758e06ef5991c4

SHA512
c9c4f574300f9f8c5342c28f97d4abfe8976fc8b716fac92318d877eb37de97c9ef72695c6ba8d79815ac457efa42ec1d19f9b3b91379bae21e352b6a7dca9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
dbd77d5cd8c089236913e8bad3b657a8

SHA1
9f49aedc7f1eaec466bf2e7492a8d8b775404ec6

SHA256
15415ee4151d99e0017e402fb50187f5c346bde925978411b23cc95815520c63

SHA512
3a6d9682109864e0b95ad589897411f06cd6716e4bb1d1b473a4c4191a86080c2200fda76f1924432bfccb6ae7342dc52a16c06798d0167cbda78818cec27e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
09f4a7ca0f8951ce68a84a12381a635f

SHA1
93ae0da2512da52160ac8fc6f1a83faf2eec1418

SHA256
9eb048c9a86961e44a724ab6dba7138d6e5deb3b92872d74afa7e37a40b6f9b9

SHA512
b07220681d1361c0fe986558f1b2afecc6366c629e80232c75a2bcdd3875923529dd3f73222afce5c36d4dfb5c62d6caee9d94ffbb06b4aef5ddff284d793027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3cd14f5261fef7200772819547a1da67

SHA1
a1d3217625bd69ad287bd79dd8f37fd4ab8c2244

SHA256
5f3416a6d4c4759a87890f3c7886148f623299d1d7f2cd76b83de4bc7069b0d5

SHA512
d7358080bfeaaa92ab6cda4cc70de7d8a876e305fa42a88c93205c6c198816d02b1b5aa8599ae01fdf2e8779e7b65900d083e16593fbd4dba3a29384b4361b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f8ae6a0218f382ce8c0630e68675424

SHA1
dde5b8dcd6e7701183c69b56726ba958a582950a

SHA256
297366d83fa73b6dcb189eaa0042bdfdda2d932d996000017fa50830bacb035d

SHA512
154b615183da229837345330e55f12598aff208faf09bba869a2060e1c05accfa0bb82d3b416c962a100e6c8aebccf9d17aaca7d5b05561ff02275e0970c1984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
844d00a42d3e6288aca32022a833937e

SHA1
28e5c09f098a72b13bad6848fe9fea173bb79b99

SHA256
038452da97f35f7a21678e6d708ea6ff7088d14a168064b008f5c0719d8ecf2b

SHA512
1dc75eb00378ebb5b6dc4cb6be47816e13ee9d56ce9077d691407244c35df83f89c1549d8f398eee6d468afd6ec5badb8667bce8ccd9cbffd6679d2c4e9cad7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
adffcfcdbab8573c58b40f12fc74c163

SHA1
e1ee82f43297243eda5d01137c4ce1c1d6f87945

SHA256
cc552a1fe4bb6ad0ff3ffbd3ec862f59766722ba9f49ca77e331532c82d8c163

SHA512
881f05a69238d0f9ebf638c41bbafb9a521c1163b0620cb7b11f4e2585066a93ba41f19be4fe60b9357ac5e6d4f45765d8e6c02a1da38505ba6a3eeb5211cfe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa72ab909d768757cedb927ce16a206b

SHA1
99dc388d7ab753a6ee563fe525d88365424b248f

SHA256
5f311c57d4ffe5f0fa6845b9c603e902dc229bb5e8efc8d99fc49c30ebcf0569

SHA512
f941132bfc7b789e2c7c02ecd37c2c717f86f80969497fe5e5ac2bace39c5292521bcefc4835a3b276735a13a4f0b581e17a098b06af068e567b55923c46ee32

Download Submit
\??\pipe\LOCAL\crashpad_1460_EADGXSPTNAVNXGDP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit