79fe16cb589a1b36458b25f8cd250e8dab73f682425a5830801c4750e13001c4

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688b026d5680bb5fceb8dcc4953a86bb_JaffaCakes118.html
Size

53KB
MD5

688b026d5680bb5fceb8dcc4953a86bb
SHA1

49d7e8c3aa5c0bc823969cd4166c6585deac76b5
SHA256

79fe16cb589a1b36458b25f8cd250e8dab73f682425a5830801c4750e13001c4
SHA512

6cd59c208e9a68008ed33b4c5535b0cbf738e54871f27b1a905852aadb5f85410a985ad3922543047217dd259feff0a145e89d57924d642be82f2adcae45d4c1
SSDEEP

1536:iUpciFkPHHXUBa3Uje1IBrFw4uHK5n2TNuy3QqiL:B/MHHXUBa3P+BrFw4uHK5n2TNuygqk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3796	msedge.exe
3796	msedge.exe
3636	msedge.exe
3636	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3636 msedge.exe
3636 msedge.exe
3636 msedge.exe
3636 msedge.exe
3636 msedge.exe
3636 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3636 wrote to memory of 2324	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2324	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 1520	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 3796	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 3796	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe
PID 3636 wrote to memory of 2128	3636	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\688b026d5680bb5fceb8dcc4953a86bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e7f46f8,0x7ffa1e7f4708,0x7ffa1e7f4718
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
2⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=4984 /prefetch:8
2⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
2⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
2⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
2⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10974129740099561440,17182088547096757013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\Models\dynamic_picl_models.db\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
381B

MD5
566e3b895df517cadcc0ca872b15c4c6

SHA1
2c4fe6d5db65c5ffa78aacf061ca0026fb4576f1

SHA256
752764b5e1b3eac252739a00c40aad9865c6fb062b9197f213253113cb3a07ad

SHA512
efc1d3bafb9bd3c8a35694ec07039a22b5028ceb16ebea3f006e8fdbf18faec85059534a69128ff789f92f2927ceaf2b3539fc732165a6a95f4954d4ccbd04d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0d5eda7419c47efb3c6e3a004f16cdeb

SHA1
2b2adde242ac74c7a44e8716fe9118325ba81a92

SHA256
a50191f17f9cfb765dcdd794fe99727a1fb34cbdfa932899d29bd7369340f14f

SHA512
b76d0846a10a5dbecd86dbb3ecba896ec6dee7638085300153621df7c49bdaae458228ecd4d71eb2899d4ea56e7974dc56c73fd3310e0c5d460986a14eb86ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f0976c8976019f14f60ec5d2aa11a08d

SHA1
5139904ae9e5896456194c2b576c03283aff8272

SHA256
79151ccdad7ef49f2debcc79906ceae725d84427faf103de356b280c69aa3f1c

SHA512
fe4c814ce7aae4ce5c3bf39703ef1dbb16f02fb3abd0b47af1e5da200084c65e34c5ed63a71680d750373079f3d8801e8604a861a42fa73cc1013994018e2fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8ce7838f860cb7db993ed61f4c2e69d5

SHA1
c9c95b93f2e028d12d80512e3fe6d55b33ead787

SHA256
0db3286a5f059715110bed2c2a27159e69eace465288f250c674176fac2b7a41

SHA512
0ad029481deec062434594e8916ac2494d4bf643559f0b923377eede1550518432b2ce33423a93b81308961af5246e012bb0a13e3c975f614a9538effd5832af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d1ffbd22cbd4fb025cb8f3edd5613a80

SHA1
22028da9c69242e75b8382bb64aea28e6147075f

SHA256
c43267648127b6770e2d41bd7d752670ae02c9e7bc6c1d862bddcdc459ec3617

SHA512
5c198187a94a0bf418c4e3058f0dfbae8640e1de2fb9d055d2554b9ea86d6691855702798110cd35f8e31a862deb424aa3aafb4ba3956bccfd3d66366a91ca6b

Download Submit
\??\pipe\LOCAL\crashpad_3636_OBMDDYTCPFEAZCTE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit