b456a9779de9f5219d049586e888754a51e90cbad4347434ac0919d685d2a86a

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6870c68ad422be05ed753383c8feb8c1_JaffaCakes118.html
Size

102KB
MD5

6870c68ad422be05ed753383c8feb8c1
SHA1

0c1e9eeaefb58fa4d36c5895b2d67635f7f3b7d4
SHA256

b456a9779de9f5219d049586e888754a51e90cbad4347434ac0919d685d2a86a
SHA512

9a07fc03650b3ac3c0d82df9d01f80ed3b5fdbc024241b9eec574cdf8778aeba036b2702db6cedc9830c992caabf84cfa512f3870fedc7205d75aaafabb3b288
SSDEEP

1536:sUBAgwmp9nsD4WWOtODOV0XONIJe70i5DaM/IlSh7:sWwmp9nsEW98qV0eNIJe70i5DnIlW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3728	msedge.exe
3728	msedge.exe
4340	msedge.exe
4340	msedge.exe
3788	identity_helper.exe
3788	identity_helper.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4340 wrote to memory of 3328	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3328	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1160	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3728	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3728	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 3092	4340	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6870c68ad422be05ed753383c8feb8c1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa996346f8,0x7ffa99634708,0x7ffa99634718
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
2⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
2⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2719958212649006542,13593119494593901613,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1b0cfa167d84c4509ec69edd89614529

SHA1
f97e40d7a7bd4cb3a5d2070a88a92ffbd0759045

SHA256
78c9626b0b243764862274211501c9dd5a786beedc2b926c0ff4d446ca9c5f52

SHA512
db6f05bdb38e24f58cdd09882d294c2b54eed063291686acf2e299ba261f0743c9c419164310f5ff6a6bafe551302de86ad7c403df0a5152f1f3ecdc7dff59bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
fa9ed95b9fc696dff71c0210299d2520

SHA1
0262b2fa4164aed0aff80ab87856b2bbd779e65f

SHA256
7a2e2178bc3f73aeb072f7092fbe4c44c961e711be63117ae52a05fd18799c18

SHA512
0b896aa1de1273f12e4f5ec963bb141d804e835d9c4d7abc84062a0be92910d22da03a3f989f98f72a0ade842c7c855b947022e5c90b5b57eeae3fc458050ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3967fcadb4bd6929a7359e0cf56fde8d

SHA1
426307a96bc790f7d5bd5c7ad629d47d5188320b

SHA256
e298ac45f6876805aafa07f7635e7a250228488b5d62456d732a6e7295dac48e

SHA512
03875c0cd876f47fb30d808c457e09303a975d5d53183051ecd413a8a89ea0865fc5cebd80d9c88bd6677b2153535efe78365442e9298739cbf5974b9c483733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4884e6bb575b3820f92307d19839a92

SHA1
16703c6f2d6781cb3f867748f952df198e7ce09b

SHA256
595d79822e2f4aff3635fce7f7d10771dbf848cb19aec5514045f25ded18e4ab

SHA512
7c79106bbaf1bbd941315cd747461912091ce08e968730c1562aa9721d096cf09c9a3645fbd95127ebd748f2b4bc6ed69d403333c117c598a8614d3d99a83475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfc9948afe019051523d20a9bc5516ea

SHA1
7935695e1118f9fb60ecd2dfb013e35877b4ea48

SHA256
75a6ad45bed11da97a8a361c9e881127434729cfe7deb08eb0b96a330a2f4fa2

SHA512
6a7ee82489e5905ce31a161e7d33cec353a6310b73c4af2e026b9bdfb27a2d002f5415f0141502d611cd28d6960239a44d34d11613dca4618d7ca12ddb5a3073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e05f0e3a70fbbb40bf829515de1f4f5

SHA1
ea7965b5ab4d1d7bc733d380d5072e30a6cd4d0e

SHA256
67288931930c277e369a156c05bd7373be2b397832e01dd8fac327dab7dd7465

SHA512
d4eb2bb7fbf70ea9ed7e05d1f2a846d1c5c604121b54f2531c78f9364b941d9b7f5ad7beee1531cf52dbddb844f35d6ed47ee9dec3f8d93c701bf014d970372b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71383ee83c9fe00413b04bd1ea99d56e

SHA1
bdb1c196fe5e5f607e0d0fd6dd40cf82e67470f7

SHA256
33857d593c61344b925094587f45ecf50c98a08cf89dc9496183af0c123438d8

SHA512
def6464d312d4abbe2d6b7dd1e527076be37bb56d722ede9e667bddfc93f6c3f2475700fdbb624a26794e9aedbe1df054fdcb0764ae6bb07e553d17eec5b582e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3bda41614266812aaaf0d900376de2fc

SHA1
90697a234082d3c4e0cf6ce83d2ddb8552aeaed2

SHA256
95595cd053250d3dc0cd306428f76514e6e31d674e93697612ea127263fb667a

SHA512
4ff135a3b28ef8a2d34fad607c65b3e785d31dcd78cd98466f6c972e091bad5a686040f1dd32e77ec1c146d72ad67194d5aa9f073c793b7c612df1aff69893b5

Download Submit
\??\pipe\LOCAL\crashpad_4340_TGUXSJQCBBGGORYB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit