0426fec19f8e89bf27ad2a6f54ac356bb6495875d2956476f2b91bfd8bf938e0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

696f4c8e7801364a74287baad173829c_JaffaCakes118.html
Size

175KB
MD5

696f4c8e7801364a74287baad173829c
SHA1

eff17fe4b745c76129792d9054501fbf0d159fe8
SHA256

0426fec19f8e89bf27ad2a6f54ac356bb6495875d2956476f2b91bfd8bf938e0
SHA512

658e62a61c68ecc34d63b1a6dfb0241f84efc9dd83800c25023654543f3e44fd5e66ec34b4df3dee728f81823fcc6b64283cd17b1f3e71ba15e971b16bb6c4b8
SSDEEP

1536:Sqt98gd8Wu8pI8Cd8hd8dQgbH//WoS3KGNkFtYfBCJiZc+aeTH+WK/Lf1/hpnVSV:S9CT3K/FoBCJijB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1436	msedge.exe
1436	msedge.exe
3480	msedge.exe
3480	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3480 wrote to memory of 900	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 900	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4464	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1436	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1436	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1540	3480	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\696f4c8e7801364a74287baad173829c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc113e46f8,0x7ffc113e4708,0x7ffc113e4718
2⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
2⤵
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
2⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16458046794999043226,16055788977818443616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
717cef6831a45ea91b64499d39923853

SHA1
c35727172e6669d4faff8646fb55c509e6700fc8

SHA256
216d2c1267f66652affbd8f5e40466014365ab9eed125800bda1d26cdc28388b

SHA512
de7d0f6c79b1ea0da7db296e72bbed7ba42f420f13820625e6fba39f4764eef53b6046c349a110f815253e55412caee4fbeabc955fe36da4766799f5b378f28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
49e47a140d346ade6047983ac35bdbd4

SHA1
8cfd89ab51d21fc10bab0c1d0b78ef2a8147ee61

SHA256
7cbf375c2c11236b668aaad27324d1e839ce3b63018882db8b1f52ad83fc2492

SHA512
2319538e05a948e2a2e4d508e51096475925b5f13b658844b8254bb08225061373ecd6510e18bf047e98033a1b604f3451e44760ce30c6a1dc44a559d4a81e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
92e049d19e9210f80c1e308e0e4c052d

SHA1
e8872adc40b16343d698852aec82a2f16fd2fda5

SHA256
36c47c7ac68d0bbd39c529fa8035c6c671decd90f311291cecb48429d26d6d76

SHA512
83a5a1f84521133f9285caae09dac8297479573b9f6b37770894f576690699b58e108bd1a73970bdd11e82a3f5bf4efb28e7738c7c5835cf688ebe0b12c2f799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
11e7190e871abc7587ea3e026417129d

SHA1
babd06b678e441fcc716cfadf6d4949505e61c4d

SHA256
e1c8b2b751a5bc9e19e0fa3a546f1cc8d6a6386c19ff579cc91c3555ab5d7a86

SHA512
9cbf667381465ce8eca8de4f28dd4f11635d78eb4be38b8e841523f047cc8b92aaf18ee176cb923265b5ee42606c0770a200f48407b373604d5e22b7dad003fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
73c5d894a0eb3583fcbccba75683b438

SHA1
f2a21b6e8121c5e5aba62e4ccd6378ee232abbb2

SHA256
fa1c540a5abbf3e5b5ed005fddf82417501481efe15b8d978041e3dd83aae2a0

SHA512
7ead1b8a435f1f5a17f3314d753fba863d81dec3907d317a7692dccdb3185a3d5ce99e0ef6743d2387672a2812edcdeefd15e7b8fcac8a87c394bd2c1cef1c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7eb45c5ce961be03b6b8ee287b25011b

SHA1
d4d42e6017a7b918fc6472a73e3c79b34c05a278

SHA256
3a8c51b6831cbe2db1747aaa5d5abdea4a903e6125e4a320c2b11b3e9b264b76

SHA512
7511a0b3bddf1f59f9061fbb79d85946efb6c4c98a4977818f8c13a7e8463c1a71c6379a558df22631e890ad0a2c5a5a7bc8f1d7fb6cd7a19e5a3b3df9f559de

Download Submit
\??\pipe\LOCAL\crashpad_3480_VRVDNHGZICYLSTGP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit