edff1ec5ebd5e2f82a7eda6512e6defc89b799f29ba2da31427d161df54a9c5a

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69579e7857fb3c60cba13538f248e3a1_JaffaCakes118.html
Size

67KB
MD5

69579e7857fb3c60cba13538f248e3a1
SHA1

9b6e1471e0ae1f6c351bfb8933b89ac6cd89fb72
SHA256

edff1ec5ebd5e2f82a7eda6512e6defc89b799f29ba2da31427d161df54a9c5a
SHA512

ec940c4d50af7df6e097272eab8f24fce4a089078e7dc941566116dd9ef3a1f2dbb14b774d1bb3e7027882f52fcd7b33f4791bb9a9b2bb325348c449fd18d65e
SSDEEP

1536:amLwzTYFKiTphmkR6T3qV0obXIwq+m383LGs70:vwzgKGp8kR6T3qV0obYom383LGs70

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3732	msedge.exe
3732	msedge.exe
3332	msedge.exe
3332	msedge.exe
5064	identity_helper.exe
5064	identity_helper.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3332 msedge.exe
3332 msedge.exe
3332 msedge.exe
3332 msedge.exe
3332 msedge.exe
3332 msedge.exe
3332 msedge.exe
3332 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3332 wrote to memory of 3872	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 3872	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 2288	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 3732	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 3732	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe
PID 3332 wrote to memory of 4172	3332	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69579e7857fb3c60cba13538f248e3a1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf48d46f8,0x7ffaf48d4708,0x7ffaf48d4718
2⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
2⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
2⤵
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
2⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
2⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11202181939909934651,2436885423941129209,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:372

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
1b26450d9dc3aecde68aab68d3b5581d

SHA1
0017e69d67d8761d353972ec43305e2a025c886d

SHA256
86a0c341bf02b5d78b5475e926b5c59a4f6f5a2fe205bb798108927078832ff1

SHA512
40ce5b6f4015a26d581d241a5dcbe72ad83ec25bd41549331868ea7aadc211c779bf9e6c7a3e30284d0b4a9d7e303777ed254f56c7c471c5ff44a44b3b2222c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
ab549bb69ebd7e4ea0f015233109b2b8

SHA1
b93035a26370c9b10c465be76c88ad7eee0f8856

SHA256
53aca805d9b350d4db8a0453b25a2547a92edb21cf6dced426182a3335dc9ea5

SHA512
63cc2d463d24ec478dcc58a6539c05e6eb278dfa9596faab8f65d40cfcc37aa3603d6bcccec40d63afe2eb0a25f12f6466030302e64f65ebdf438af4450b6cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
919b65134f35b3b983a6ea7bfabb7b87

SHA1
f82546018e834a22349ecf4b7fed1cb0c4b824e2

SHA256
029bb01fba1f1970ba4819d0b0d085631e25b3e59bc28724cf14ff6d72fe53f8

SHA512
ff0baaccb7d20107ce9e55ed4acf040ab1790e85e9a5258d44e84e756cb4d59d0195eaea76a51f74631e1e0878aca0ce2d9fcf111200c9c11575dd1f8d9793fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
622beed0eb64164ad0150dba3c3b438f

SHA1
da1c5f9fa65e5fd9d17b984f84466700160528da

SHA256
593cd5a62a796c4ac0604585c2c512bdefb2ac0c20b23eadd0b22e05c9d88a66

SHA512
3d46d07cf27ad6643378c6cf2c89a346a27ba8804fd83556a508bd3cb924993fb124fbcf163cd3984adca4bf8266865a291c13e46fb765dd49eaf98d1bb1b2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
5ad23965196e784ee52ddb1909b4a950

SHA1
98680dfaf31918cf0796327a34917b1fe6373dcd

SHA256
83cb12c08a389984746539f17fd59ebc7e17e7a065c7e072cfd6b1c34169b63a

SHA512
0ce22ca35332bdab597d345ca4417a8ebbd5c8dfbdf84ca170e3ea9e6defd1b8a830f49e25ee0b4dd36f24a21b0a7284125528a1970897e303aceb48ffb8d5d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
05747ffa1fc9a298671f39bd29ee4774

SHA1
a2d1ff4427f04d2a709168e32fc5dc2f44513004

SHA256
2f23dddd25fcf93b34d767727cbc772c61cf84aae16081ad2c6bf805e2d4f750

SHA512
dda04a4ac2e40383ae746705552b4bc9ed233559bd00db7d1a420d9092f11521ee5c9038234df28439a720ce50110c961611033c52f7ad4690048fab0a0bd228

Download Submit
\??\pipe\LOCAL\crashpad_3332_VMKSBCQLUHHDNKRA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit