1fdc177123abfc6bc642e2c5d5a834f8fdc0a7c3cf8dbd87e67906670017984e

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691a6b4cab9e5874dca47be5038308d8_JaffaCakes118.html
Size

42KB
MD5

691a6b4cab9e5874dca47be5038308d8
SHA1

d760f388dbb6d723a144d4a8d66296b2ffe0d6b9
SHA256

1fdc177123abfc6bc642e2c5d5a834f8fdc0a7c3cf8dbd87e67906670017984e
SHA512

eb4c281887fb5aa29973ba3b47ed6c59a8a1a07323b55a852594c6ef9106808814a38da325d70ecd402f4b4807141e54baeea1f6b7d78ec94a515d60607177f1
SSDEEP

768:qpopDYslaUxXAWWbhRGjbia9OLaPJhBnT2+QnR5m+mqBwj6WrbJUDVsjUtNhNZ3I:wq0QuunvIafRtqR+bJUDVsjANr+AEthz

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

19 sites.google.com
24 sites.google.com
25 sites.google.com

flow	ioc
19	sites.google.com
24	sites.google.com
25	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4072	msedge.exe
4072	msedge.exe
4248	msedge.exe
4248	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4248 wrote to memory of 1076	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1076	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1088	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4072	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4072	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 4788	4248	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\691a6b4cab9e5874dca47be5038308d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e0146f8,0x7ffe8e014708,0x7ffe8e014718
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
2⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
2⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
2⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10114577027137253958,4723551178866693570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6076 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
a6dd7988409dfe4424e2f7ea87fb7cc9

SHA1
c20bf507595146d061648b945a02953ec218b07e

SHA256
cc9a7f42222b8eff36dfad32da32488339e71092e269d320ff344ff769a29a90

SHA512
4ffa2572e04472120255f373c5251260973e2c9aa0662b7daad72a2c022aff7e2865bdad8351c8aa09987fee32137d574d384fa25e868f46d909a56fb4fe51f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
d489dfd23536fb0ad55efed599f1026f

SHA1
8a8d1ccdf8ee51e942e5abe6ca1191801e53db61

SHA256
739f4753e95ec3b9ea8081e79867de01cdc2b422f599f23a03b83cef8d6d79fa

SHA512
f5e2482f486baa463ecf3614105e35fedbb8a8573263af5f5a658e7cd9cd3fb9b324f3d17b0e3a7501524a1b5b0a69eca4e1699e63a9c9f19d82fccc890f6081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
581bcab04005a84244d32d8ef2a070e8

SHA1
56a9e051fad3d5a3a748bf03aaa257f068b47e9f

SHA256
d4100f0875ba91e643a9337c2df8f79589e6f392bb00bfd77c5d26921cc648a1

SHA512
9703acb1fdefa4dfd70a0f682990588dd05ee1262f2d3c138e6032b4cd04d927baae234c05420ece2c90aae9aa28b4c438eb63ed23972b3563ccb0990c06dc0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
705a3e65446f0c4cb162890b6937db47

SHA1
a40e62c19b189ac8ee6b1c6ae09ab6265c7ec19f

SHA256
826006af54ba884319db47209d2a0f739e58604026d4017400c8b6d6b2fe8ea0

SHA512
d6ebbebb71987fa553580e37f28a9467f8136cfe03744e4cdb4b9575511028cc68929dfcfe4d7cc42b556270859299c6781b707f5b0910e869cb71654a8fba27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
9b40ead21f67cff6c51bfb97ae09ae9b

SHA1
10c500adcab09606b766da3ecec427c8e29ed491

SHA256
9b151887b54dd7892b0a5782900242e04cc7749f57a6b48bbd78a3a1f2cc175d

SHA512
cbc2495156451ba8daea8dcb0682e6abfce5d34d49498a6b2288d506409a1df06e63da87fe4d3b7b4026b0f5444180951f2b534314a5741f701dc86f6eb9339e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bbf60716c50923f7f48ce28a52d51dd6

SHA1
0ed1d99f78dad089f6842078e916d38352cf36ce

SHA256
133a85d5342ec417ae897f387a209bbb8aa0aa5070d82ca12d3d273a762aff4e

SHA512
c2b9f95e29e6f04bbf8a3a3a746427a8973ab1ec745e91f8468663c873b9833d8eb45be146b4cb7840bf06ef0ceeb27abb52427f45925a4b9b40cbdcda7825c9

Download Submit
\??\pipe\LOCAL\crashpad_4248_HQMVFWDRLJSHIJQZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit