4b5c13172b3f95a632066d60b33243a70133d44011851318698d3be86a0bc805

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687b707cb997149e3d27ce10baedeb04_JaffaCakes118.html
Size

108KB
MD5

687b707cb997149e3d27ce10baedeb04
SHA1

f90c6263432d648473722d09d9e11ae2de4c21dd
SHA256

4b5c13172b3f95a632066d60b33243a70133d44011851318698d3be86a0bc805
SHA512

ffd7d041aa5f91bd3b1eae4c336be68d6ed85fea3899911eff48fcd78ea359745282aafc09290c06f6527a1b58ef952f7f398475df1d0ab28349089d82d01c9b
SSDEEP

3072:6dceCjeCw7DUcjvG8rMVlMtHvbbPMLfeFJp:6dceCjeCw7RXlvPn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3412	msedge.exe
3412	msedge.exe
1172	msedge.exe
1172	msedge.exe
3432	identity_helper.exe
3432	identity_helper.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1172 msedge.exe
1172 msedge.exe
1172 msedge.exe
1172 msedge.exe
1172 msedge.exe
1172 msedge.exe
1172 msedge.exe
1172 msedge.exe
1172 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1172 wrote to memory of 4424	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 4424	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 1504	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3412	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3412	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3668	1172	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\687b707cb997149e3d27ce10baedeb04_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14616008784135402979,11646131944361679156,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
192B

MD5
c523c40644f997c9069139cd846d9072

SHA1
c1caea7236d2df875661b83c7e4078193cf7ecc1

SHA256
1cbec922a6881771265ceb68e738ad7bbbbdb28e48d3c8045cc48a19073d3b86

SHA512
ac2702d9935a87d314712752e6837e870b6a99a04b696184848a921cb8fdc91b4e9c399abdbf6a338bc3f8b3479b0eb13a04a3ec3b2deb1b23421372d019a183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b062d0d26ceb99f2951d274a6e7b8e67

SHA1
b634710950cc5145eedeaee55f1253b867f09aad

SHA256
9b69986ae5f27358279bfc8bad86dd86dd07865c4696277245bbee6f42ffda9f

SHA512
fce450ef09ac437a0415d607165249a844716d0da4a07816c91e42b626f6eb2f164afd977e88566ba126a21caffd9bfec047267e8f63d7829762351d4771fbe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
021676cb559cb1a0a9b8a557ac4261d5

SHA1
5e96ff83c3aeb03f5d978338c32d0daf724dfc72

SHA256
b0c7e7b58c8307a4ad17d2016e4431a5fac92e2f4cf20a18743cb02f1830ef28

SHA512
b5dfb6de1c1c6696cd570525384b3876dc4d08de872974985677db6f3ba611b807deff6775e3b35e163c34ee4cc47e712b5aa8775122ffad0820b94d4d653951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d818508ad20d705beaf58afff5366ee8

SHA1
62acaffbfe9d6c3e67fbe1182f2adff6af51424b

SHA256
f6ba8a79584cf133716456ed5681d15cc8cafb6529255f38702a4513d29030d3

SHA512
290d9489de68fcbb18f924526b8d68feb6861bb47ceefa1fcad333061d720c6d3d9becc105913e513fa9e77875478775facb8986ca82e27f7a3f1dc3a24a7e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ff9dfd85eebb99f8c36abd6528aeb660

SHA1
0e0cd30846700d7672b9ac3c9509b360b991a9bd

SHA256
96012cf781905ac847e5c99ce82d1a1a05230c0c56ca1e673ceaaedb27f269a9

SHA512
a1bfcd5603cda78c0ce9bf640b1b7502591dcf95b5f02be5e4a112d1b220fa716f1e653e9ba9a41ec0ef8c06aba98e0f6fb3c9f994267c39699ab870614d3352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f6c48692f1ef1210558d57e72994906d

SHA1
fd0898edf38c6b68aadae9778b8923ba22612b15

SHA256
64f688439da48aa7a36a7c250d2b54c1ca63db13e8d90c04c0be14e068ee2bfd

SHA512
05276f644dc16d67522ad6b08a8b8bb0b69ed64b18988295a025e96507e9aae799a69f7a808edd5d423d866d6d860dd058788a96f2bba38f5be9123a3c8573f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2eed9265a933af96cf9024018f8ae78a

SHA1
58fc87f532b2b54eb77a80782b5ac8cb1fe36e25

SHA256
6fb1f2df7abea453880d62a2edb0d43d746c0ee24031edea797a3e70c7ada799

SHA512
3aed630c1b42e1ab94ae88d639c88f0eee578ac3e3a30bcba03b8da4026bac2f7c8e59eb7ba92ac77992ed56b46e96dff43b7096a44fabaeeba8515f483e2484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2ae23818c3a8aa70d6b1a655b0c6e99e

SHA1
f153a7167f33d24807cf882ea5f6c8122e761698

SHA256
8e3fd1b7e0164aacc8e51673ee6fdb83b427cff5d9a4b466b73882e8137273dd

SHA512
88be1e33252c47ceed24359ac2f36f0d00ec2da7993254c8e40eb52f445004bddd00a2285fd5b01c0ee66fc0adb6ba68316546de2307daed64d14f1726ca9f9e

Download Submit
\??\pipe\LOCAL\crashpad_1172_RMMCUBIRUPPDFNFL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit