d5b806eade0b3b165ea3ce7b1bbadaca102eb523c6988111ef039c61e7dcce2a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6941611a1e96c069846ea3e403007f13_JaffaCakes118.html
Size

175KB
MD5

6941611a1e96c069846ea3e403007f13
SHA1

fee2d37f17e7f81c8b6c73411ac9a2c8db696d27
SHA256

d5b806eade0b3b165ea3ce7b1bbadaca102eb523c6988111ef039c61e7dcce2a
SHA512

5b868abda22d5c20d7fe08e0e5a0069c481ca37bebe3cc9f6a724f5dd155b5a7679b01d27f00db518384a15b2262c6eb62c0993504124cc1a6176b3eb3cbdbed
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3xGNkF3YfBCJis5+aeTH+WK/Lf1/hmnVSV:SOoT3x/FGBCJilm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3624	msedge.exe
3624	msedge.exe
3980	msedge.exe
3980	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3980 wrote to memory of 3100	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 3100	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 2004	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 3624	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 3624	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe
PID 3980 wrote to memory of 4968	3980	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6941611a1e96c069846ea3e403007f13_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
2⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
2⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
2⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
2⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
2⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
2⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11349009407756792620,1550439580007683288,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8cd139ca4bf3572a_0

Filesize
243B

MD5
a495b38bbce2595c27016f4d36003759

SHA1
7c4cff216e0a6041695f827ee6a276d8e340cc74

SHA256
413307de8af41fc9628667718b3147d99315e7928ac4ba171d4af79e8e63a7f2

SHA512
3a47fa0430af55f8d7f9aded554a425b8267140000835b1d1c3c58b270dcf15b3b8760fb5ebe90fdab0b3120bc339c476c1dce228ae12b6e0e83fbcc1f05a319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
422161353d977e981f54fabbbe3a206f

SHA1
7e30f31a9b531aea0186e49a8182327abb341192

SHA256
6a924b94af97af116d96d2933a004f499f56b15ef39be7235b9d6c1a3b7d9bd6

SHA512
9227d5a9acc63e4e80a810b52f61e733e9fbccc42116725f7dcbc1393c462ad67da6123e121adbe7fdc36ce1a1f09c65e7e8abe3528bbf2e59ae2f81424d1d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
439170d61939a9a19d69cb2ee88abb20

SHA1
aff5731e87ed36a7c6cf5bb844145c21717ae313

SHA256
fb020ec445b9a6fbd3cb0278a3565a3099b74efd39d2280cf29114064276d7fd

SHA512
2a17fa2ced27046db541ecaee4515b584f1a422d91993cbc7d0d62751a717a06f8c25aeaa9b76c2e45b89ab7fc25463672afe8fd44132cba8e9f5de51e09757d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
716a974719bc6fddc4348600c333edc8

SHA1
18b9e9c42428307a492344512e4b9b87859d159d

SHA256
bcb428241dc0eca12c0016f0c6095c7892d71649355331f5d939862fd4763b13

SHA512
7725f90506386bbeb650b0da403f3881745caf22c437f667ec396720da5a6ac87c381946eb3106ce50d379f35492d4d011eb5bf9dcb68438a9ab974453038029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a92fc6f5015b54c775dc60f7abe6c51b

SHA1
04339bb54a66ad05b60b481a6bafa7bf0ac1a256

SHA256
34e0aa13932e5651454ab2167679ace137a71cd13a68c5ce68a48439ab2fe4d0

SHA512
655fab6461fd2cc73a332d76d80fb2a3f425aa043c4d6d18cd915c59ba595b28a5bb61a0a2c212193937854cad6b7f2d0865de6228ff9c28da85d5f65bf84e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a78bdda087aa73954ba514b5a655d904

SHA1
dc8e664b3c4e3bcf0d634c76e1009e05b0e3c03d

SHA256
b3386a2bc4aaaef22dfd6dcf96c79e9204cbe16f576c0cece7ea2a1f451ffd6e

SHA512
278326ce0dd93db68541d8c0e44e8f73f05f82d39eb9964480c3f53f439db2bd9f7a09b9fbb187d5e8dd603cee270dee282688875fc85f5b91aed4c7a022374d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7ce7849c229a54cf9cef562b2d19df5

SHA1
9df849fcacad1766554dd1ec7b8f6c61fea13794

SHA256
43a143f5aea6c331fd0041ced8d5df8139474498dec65d25e63437f999d50afc

SHA512
4405df19c54fb9006b53e1a79653871e966ec4ed498a28fd27b709e4a48dc4fc876685d091fb14d6dfeee6c92e25b15b68654f231cd407924f1a479097848edf

Download Submit
\??\pipe\LOCAL\crashpad_3980_OCLIQWBWOVHXHRVB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit