2ee16f34c87c075db5409af18cbe4f346ea336a83f2768e80e8d909991e34fa6

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693c35f3c476913bf1db4549497ee6be_JaffaCakes118.html
Size

221KB
MD5

693c35f3c476913bf1db4549497ee6be
SHA1

6ecbe0e236522dc6094408ee2c83e74a52c6b764
SHA256

2ee16f34c87c075db5409af18cbe4f346ea336a83f2768e80e8d909991e34fa6
SHA512

29eeacce0aab7ecb03a62a48b2491bc32d8163983b93c3b88ddb1fa0e56b0795fb23bf7ee7eb787cc12f1cebf29e0976b1bd82182bc2da7867dc1a6c5ec5ef39
SSDEEP

6144:WtpMppopYFJd6rL8wQvtKfpzOm/P/UWtBUuQiCHVptnpvyglfz4Va+tMLrFWj//n:GpMppopYFJd6rL8wQvtIpzOm/P/UWtqA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1312	msedge.exe
1312	msedge.exe
4624	msedge.exe
4624	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4624 wrote to memory of 700	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 700	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1516	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1312	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 1312	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3980	4624	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\693c35f3c476913bf1db4549497ee6be_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e5e046f8,0x7ff9e5e04708,0x7ff9e5e04718
2⤵
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
2⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
2⤵
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,234927085332268917,10028666029388876432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
40KB

MD5
5ce7bdeeea547dc5e395554f1de0b179

SHA1
3dba53fa4da7c828a468d17abc09b265b664078a

SHA256
675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9

SHA512
0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
2d0af869d3ddac0b77e40500ee5bbcc0

SHA1
4263f2058d92b20c7a6bc6907c5e88a91ce8cad3

SHA256
fa7d6ae5bfc76ea77ef2c0be66b61c97d9746fcfd712c77abf1113b1fefc0395

SHA512
6f6356681610ac9b9ddd90e32fb47dc6658b904fee576c998e24e0c57f1f9e54ee57bfd28b3fc98021269b122779eefaca0f401e4cdc23bd246d8a4d79373059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1a7dfdea351c7246421869473d5e5a6a

SHA1
3444e761aab702f12a8490607c20e488704c144a

SHA256
e6eaa9b3162c03667b9317583093e55ac66fa3daba0aff261aa6796cddec9ecc

SHA512
d650d27dcec82f279f047b513a205814c4492e8aef614548ab3a1c173de3bcd6dc9c48749f7bf7bfd4d5f80367aa87a3e204eae7ffb72c13aeb584fa9c628347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fcd14764cef831fa146e6daa48058245

SHA1
13eb5342e9721e3592c8a8886cb0c3fec7721fdc

SHA256
ec9296e180bea15e07d71878ee59bcca82de8dc524190747a5a1ad294404f803

SHA512
c325c39733796f2ccf23207f3fe5a01e0de2516260a112cae31cd0d540b3cc3c24edb8c26fda25a1cf3129b7430e81aef04d088d330c7275dddc3a5edcf25cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68943988c6dc4503f422311e2ee0c6be

SHA1
a21a082b51f8f700f72e50882525dfce0b9832a3

SHA256
2267cc9266618b749570a1040c1037e3aa88ed46b01a77610e4cd24092de5826

SHA512
18b84f7bd6150b194ea7d8f35418baca61a5f4c3de3836824e9809ddb857bf5e264971cde256c04199d782d89a34755432ebe76a1bac576b576a3ed089f3f04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
231402a328daaaa35ae06257a14af3ed

SHA1
a97fc3618adda72bcc60c7382621933a09f4a1ed

SHA256
054c48c2a82ae823a2450541e0c92fc6166c1d08a9e08e3a72dc93a177a8ef9c

SHA512
2ef64e40f19da4341ed7530943a6de022f48e0a2a852f7df8dcb84a5c5def6d6bf27039eab4b499bd1ec45041961a499d158f963d9c9e8d75f30b4414b093c0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d80adb34dc7d8fd5ae1def6715c51a1

SHA1
75a20871cae1b4384fd14751c4ee0f3117fdb382

SHA256
9a136f86000e552edfebad9a91de6fda8984465f289111609061b344ec4762ed

SHA512
47912088cc1e52446b667f1fe0db179df2911e4d579f3bf5f042f7e60b1844200dad9d8bc42ad1fe02b9d676f41a48b68fe2a32b8875d710cbe4d3a594f0b584

Download Submit
\??\pipe\LOCAL\crashpad_4624_QKDCIZGEFJJBCYTK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit