7658811ca45e243e64dc8c4c5312006949532cd6d97bd21e4b1b5c9afba0b948

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6959f505fd7ea85e6f7dd480f550e870_JaffaCakes118.html
Size

175KB
MD5

6959f505fd7ea85e6f7dd480f550e870
SHA1

36429f6a0c7905088f06366485d6e49529ce0000
SHA256

7658811ca45e243e64dc8c4c5312006949532cd6d97bd21e4b1b5c9afba0b948
SHA512

447b478b902015751c14dae848be8da94e564804a17d061a9d2ac4a7b05aba89ed905644f68da563bd7591d1ddc0c00cb28ddec2880d2af9f2b8b0ac767bd8d6
SSDEEP

1536:SqtO8gd8Wu8pI8Cd8hd8dQgbH//WoS30GNkFPYfBCJiZP+aeTH+WK/Lf1/hpnVSV:SaCT30/FuBCJi2B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1620	msedge.exe
1620	msedge.exe
3164	msedge.exe
3164	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3164 wrote to memory of 5004	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 5004	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1664	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1620	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1620	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1668	3164	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6959f505fd7ea85e6f7dd480f550e870_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd8946f8,0x7ffdbd894708,0x7ffdbd894718
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
2⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
2⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
2⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17908143570420940977,2790517536922074952,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
a1aa357d29649096dba337098520ef0e

SHA1
d36efc10222f05869e00d4e072c36d71de9075b4

SHA256
272f787eb0810333d2d3e487bf4c2d84ace4b5997e6bc35c2a921d3c8af34114

SHA512
0ba5638974c8db2b2c228506bec2e73d74db337184d9d6d8245b9a9c67e481a661d0e1bae08c65b85b0906d5ef0651394944e1910bfa4a085241525e601cfb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
21e4e05cebff499bd12a07c5a9326c38

SHA1
cdf12339b9af954d08bfbfd32b64f16dd979132a

SHA256
9feeee6cdad9e1f507e0c358703364015ac6ab6c140948ac608bb12e1042817e

SHA512
3cd2d5ad246e91b4ad7d1b01bce67172099959b2ad9a846f1ddabde463c40282c9a46cf22f715d0ec7aa995d80cd0b7935b37155dff7e65d0b8ba91354d7b919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3768c3f8a07835d85784ae109612d2a5

SHA1
03ed9dd9556b3c115837115f8d74ae22f75b2eed

SHA256
2373e7f3043a1d9be8ed4c2b6096a420de7058f2ad4ad8d1039bd849af2d482d

SHA512
f07a354945e31766659beb87701fd62c2ea8f777d56ac37da7d50aa90c1ce52431a9c4a24bdef0c7bd0524732519e64f315c779e05948ad5dd3b7720acc4b5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19bea6bdcbbce3a88ee356a8427f8a57

SHA1
3a14d329b7046ceb3e3a9595276146c193ecd901

SHA256
c2a1bcd0e773819180b2bc5bbb0165622e2962251b41ffd17212e50676543204

SHA512
6c227cebec5852064a452c182d42df35ed29e7b122b546e414efe31c2b3b7207775c80143b6e872b5f8d853ade6d2a72940683c6267fa8970743838d7563df97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ccb6218267f207ec7b42533477915407

SHA1
2b8f9e504aa09a21a6edc1e9db4c50ead7cd7d83

SHA256
0f45b7ec75d0a7adf9515b647b4e09efca7cbade290673ff7263d479c914fe42

SHA512
094080b2385c9094b4d50ab7ca17b402139ff9c505f65e1f6b00e581475f7fd830d5ebe7637e775bf5cff7e48f3694386075c7e5607c8daa279a660bb4940181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bda7e19a7bdb0f79b49e4e7e99653bf

SHA1
b0809fa1a100d9b78a382365d1d098c6009ede3d

SHA256
fac83fb6f55787c79c98f365a5aeb84dd34bb7bd919502ca01d3a6219122f43d

SHA512
b60734276a34a4f457411aaaff3173fe52bf92b5ceb6342d3d63a59066fe09a7fbd607a982e045c44ac8f08eb555bf1680903a7f0064ed9a5d86832d585e894f

Download Submit
\??\pipe\LOCAL\crashpad_3164_UMOCJEFCTUHXQSQC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit