79a45cfde1d6f37c7c1adceff57278a0c3d2c3c050ed45265779521cd7821ff0

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c8aa17742aee50eb8c5d22118db1d5_JaffaCakes118.html
Size

175KB
MD5

65c8aa17742aee50eb8c5d22118db1d5
SHA1

d66fbda3edb9a95cfbcec4a6b2587fb1f4b26121
SHA256

79a45cfde1d6f37c7c1adceff57278a0c3d2c3c050ed45265779521cd7821ff0
SHA512

860908401cf283dac1557c7f20322fb97b2c902f2bb0ef3176b8886e57cedcee3c7a709e07599cb4078e84400018f1062179c62f5e23634668de3d3b6344e39c
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3wGNkFIYfBCJiZ7+aeTH+WK/Lf1/hpnVSV:S9CT3w/FtBCJiiB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2068	msedge.exe
2068	msedge.exe
3496	msedge.exe
3496	msedge.exe
612	identity_helper.exe
612	identity_helper.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3496 wrote to memory of 212	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 212	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4020	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 2068	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 2068	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe
PID 3496 wrote to memory of 4580	3496	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65c8aa17742aee50eb8c5d22118db1d5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
2⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
2⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
2⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
2⤵
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4540406094109631360,2152950743607192752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
13d2ef4c81fc10234b613af5ee93cd71

SHA1
f7adcf2884d5e10f164fdc222591450143cc235c

SHA256
f2d39bd78cbd5ecd69764fb4f2c36d4ea7c816819503ed53b46dfac8926f89b7

SHA512
83fd2b1cad24b752ef1e0b204df822b7193a97e8e6f3c0472e6c12efb985ca9974932286c11030ebf8a84a406882978eb5240f9f5814a4d3e432532f673c5757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
e272ac6fd8d19633ad47c1de53d20a49

SHA1
7bc0336211369bb7df0afd43d53faf5497fdcc8c

SHA256
27413ca37d943c422dcf198bf70a08659b89f1f87e1c3b802f5d2d584cad4a9d

SHA512
0d429781a2dfac799eeb09f112a2cdf1ea83e40d19da0bdc98583831f469735d160f5afed83600e502b259ca29cbe501e07b85a34de8506079aef517ad5a69b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
093026d40378df85eb033ba35b67a232

SHA1
54dffc1ff6cff4e56246d59284b78e99f7ce8bab

SHA256
a4545fd943eeb20b69349beb88e1fd4d0a940b20707c1bdc349d4c38f1222474

SHA512
d943797acfa510db6ae46509279194ff2365e1400f18b689bff5f98387d113c4946c74896f4a01bae8b6dfe4256da356110727c8ecc726874fba7774d77c21b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
891c8cc62f5d08fd84f5d07bde08ea31

SHA1
aba9489fd00abc184d834131633c557004790658

SHA256
7914a57dfef396af32a8930f8ed72532fe5da3781484c3320b61ca8d60a8ca12

SHA512
c4402737e1259b842b8e9af44516959218d21ac9458e96dbd566d4d44e806e463e9b3afc9bb0d1772d93e66c2f162a0ff18a4f2712bfaef916cf34beadccb9fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
91fed89c6059710354ea0d8a5f55c309

SHA1
0ff84ba75ed488ca30d44a78cae14cab6745fef4

SHA256
27a19dfaeebb376d6d88f4085c1597d66a09d2b38cc90f87295a3592c0598814

SHA512
00a08e37b586c3939cf9ff751072169ce8d7477d72dd773cd7c9466dc9060a9c4d333c5434c715e5a0edccec090a91535ef3ad4381f8bc564470e63e05e970bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
cf36eaf3020090484e5b941c7a081c3b

SHA1
8e35dbd54f0a97eb44a82c58c7afb91adec1c3c7

SHA256
a49bbb4737a64e4bad53d65439ca856dcbae14f895f02101ffee447a4a1d946d

SHA512
7849411a8f762c7f0de7a26057ec7669896092931eca161a7ba16bccd77848c32abc0764700183e062fcfdf3b813b5e972f6cfc4638da535b0808bf25efcd1ab

Download Submit
\??\pipe\LOCAL\crashpad_3496_WFZLVEGKPZZXLBGJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit