604c6c9dc854c83aedc80b7dc7b9ab2f040bd8f66eb22cc718fc01c3debf4e74

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d96ea4436fb9da4475b9cf352d10af_JaffaCakes118.html
Size

175KB
MD5

65d96ea4436fb9da4475b9cf352d10af
SHA1

e9b2b5894c8725cb60857c455a3f9abfdcc04e4e
SHA256

604c6c9dc854c83aedc80b7dc7b9ab2f040bd8f66eb22cc718fc01c3debf4e74
SHA512

fb9cfe9190fbe63a6f2f1b1514f11c09a415dafb623814fb4df56685f8a44fccdb3255d78dcd0a859ee4041c094059f08819e8ebd34d78e3af1eb74caf84bb6b
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3AGNkFfzYfBCJiZX+aeTH+WK/Lf1/hpnV+:S9CT3A/FyBCJiWB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
804	msedge.exe
804	msedge.exe
4516	msedge.exe
4516	msedge.exe
1340	identity_helper.exe
1340	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4516 wrote to memory of 4228	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 4228	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 1508	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 804	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 804	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe
PID 4516 wrote to memory of 3868	4516	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d96ea4436fb9da4475b9cf352d10af_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
2⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
2⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
2⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
2⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17470947939249901843,14521556302613691421,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2944 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
dd9df7cdff7793fadc6caec4ca475e9d

SHA1
7d10e9ef05afae32627c882f7f442bb325c2530a

SHA256
73144573e8a651d2a5c23843e3e4c8fef1bcad4819410a73562f2ca5a75ddd9f

SHA512
acbebcef86520c126db12b3d87f2bf979560d8c90a5e1c4ad026b909e551add50f257973e6178abb59fa8ad47467dd91d2b7820bea94edb05e05e29cc337551a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
cf9905a4f7eccb10712fc291dd33a8c2

SHA1
c32fbeed412227e3d7f41ef8e7b31eea30358fcb

SHA256
fe94e6defbee49ad59986041146e95069a34e8729cc53fddea1ebebcb86deeb7

SHA512
fd561f9d0cd1e8e86d4b29ff6c6cfac51e2d529f010848395721a2d8a505a9aacaf81a0ebd151ade462ec4b617ccd8c6b5f74e3843c047dcdf9b1002ed8261f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
f145c50e087a73406390e0f0ad4a3e77

SHA1
b5a2027d77ff0141423bb637a9b37868033a1a0f

SHA256
c8713c6856190d5b21abbb0a11c1a44f8c37575b4d8287d43c9851d0ecd9ab8c

SHA512
89da51b6da9d123f5a48801cd96fc17afe5dec2e1afe86015862d9fa951db114c68dd9d60b4c711d16dbba37bc6f63c3943d51816bd7ea3a8d9447aaf54b9bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b2b4373510dfdc2395fabd9c7ecd1874

SHA1
e1269d334d2c4a57b9a3161e3d9aca996fb0df8d

SHA256
3faf062abb11bb0865d74c035a98c188bb3ff2a37c450e8d3c6cfc31b920272e

SHA512
0e427daa73ab4172a1d2519cb12e6b20c157cc27141c4f63ff6d143cf13d69652a5e770e0e268943bbd17cf41b90bcc8079a58d6fce6db80ecde6f38aae2c895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
ec46473a0dd5a170a75ea46620b77644

SHA1
3ca8ced18f8c25b7d3133be862c1c0021dbf6bbd

SHA256
392fba6611aef24f7b2af35e2e8eeedc618c8df6cf55582f68aabb5f2fe42d3d

SHA512
667b6019042994e9cb02846606c3bbc3bccb1149d0f4ec0117cd17c7c14c3448bdee02a64015ec5cf296f33e882259f8a6140bc7ffe470095c582f154a1d6444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
decca200cee51f9a42aeb96497555acd

SHA1
4bc6c6ccf2533c29b39680c563eec5a85f9e9e45

SHA256
2e84faa960eaa8fc3940bf4526f1eecb5e420f7456e5ab6e462d06c5c2bfb131

SHA512
14ce9317297f219d8cb97ab27daaaf8e2c91805eda07a2df19d6274157fc3364daff44ecca29032735643e71f03d495321252cef636cc403a83726c63a09df2b

Download Submit
\??\pipe\LOCAL\crashpad_4516_MLUNARXMLVJUVMHQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit