92bc7f4750f9031639dfa84841336aff0da2d47fe8cacb3dbf4daf90753da7bf

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83ae3bd6ee99b0491bf3d6874ab88dc6_JaffaCakes118.html
Size

270KB
MD5

83ae3bd6ee99b0491bf3d6874ab88dc6
SHA1

490a6e7f235a8ad6a5729b27f73fc0eeb7e35a6d
SHA256

92bc7f4750f9031639dfa84841336aff0da2d47fe8cacb3dbf4daf90753da7bf
SHA512

0cfdfa7b2beae8d715ae35b9b04e63e4646a017009da3ab0e45caeef5486f0843c288c66efaf2cc629d2df3c4c26ed72928220694271470aaaebd24447059361
SSDEEP

3072:HuzrxgV9RfBibI9DpLOs0rl+dPQzSxuYqE2fJ6MVkPuKbL:Huzro9vqI9DpLOs0rEdPAx2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
1760	msedge.exe
1760	msedge.exe
1636	msedge.exe
1636	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1636 wrote to memory of 2976	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 2976	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 336	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 1760	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 1760	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe
PID 1636 wrote to memory of 752	1636	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\83ae3bd6ee99b0491bf3d6874ab88dc6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd3e7f46f8,0x7ffd3e7f4708,0x7ffd3e7f4718
2⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
2⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
2⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5540 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
2⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16783118051862466110,9638735386618460942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
2⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a7e60e3e2adb15a91e5f27ebea96ef95

SHA1
dcf50efa9c88277709427a88332bf6742adb4ddc

SHA256
20f10850130fa95f6179d46266e5cf0da49e09090a5cb4da1fd8ef0a73c47524

SHA512
bfea6e6f6d8878ddab18248bebea382b21d72f565812656b25fc637b815792214207b8312994ddd64a568863db6eb6a77b562d26f81c311690dbc1ea63426819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
5d7c00a76cd8ecea72b2569bf54fef28

SHA1
6f8e60c83c5bce8c09c9a636c29ef7e8afe2661d

SHA256
9fd1552b9274d86d5c0b33ddc4b74755641cfd3b1fa12a8369116754820f3947

SHA512
85c6c9b9eaa49b051233cce56a1ce0e314958c3b5d3f9c1256b382e2c7385e9183fb28915ba528e2a839363de0aa4742318241280ecbdb3d8e6f64ec6df4ea0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d267ff6d72a9a64dcca81369322aa2dc

SHA1
2e9dc3924434bdfa7c45972cfc15e79dc2ef0943

SHA256
ab8ecc1b6265b0e84230d3d07cdf9d78d445c23068f088917e45debcbd6554db

SHA512
bdc8be3133893c7155c178d1d4e8dc3dff9f678260c12bde7d47f3bde54b8d75a127b0a8f7160b9ff8e300dd7484e0622ce0462d34cedbf37ffc24cf6a10a935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e0362b7c97fd716da7e04d8da791686e

SHA1
76391d60209e4f0836a59f52e6eb4f8b5d930193

SHA256
99f597d3fd410a75992ab53fc98dcdbdbf30accfaa9729ddf9187879edc555a4

SHA512
69b8b5800664e0773d3c32ba17c5186baa9397d4f5043bcf74fd874364f1647391935a50b908a5d34881166088900eb3f6ab4e0747844e9474870ed9d9f4945f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4eab7d5bb63292592440d1cdf97cbc2e

SHA1
348273a410f436990ae054016676af20075b464b

SHA256
c7e20108396d0f0323dbdea02833f65533ee2c1d4fdd7158e1407403ab0446a7

SHA512
342644eaa4f3ad52c877fb62a3413f9f792dc871cacf61cd68f3b23709fbfbf1242e946b189c1cb7f07b4a3560dbf0d8252c39a335c21d3bf1cf2cf92e273c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c6e054caefe4381346cdc168a9be3954

SHA1
0637e5ef048d70f68a81b8afd846669b68e6442a

SHA256
29a54be5892666a376e303fd5ba760347df81dd303bb22d8a0ff7e586cd21ae5

SHA512
e4061f51434507c995742ee187253a46ead0fa2697f267a10ff6b0b0f7998d82ab1b3e88f69399c1026367f11a237c76e4e62d1d717355aeda258f4b9b668603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3769a613a7aa10eb5616d14efb49d7c2

SHA1
0bbcc3e596d95ed1727bba4e8f2bcb73125c9aff

SHA256
bcceb232f84fcda8cd920627867e19825b0d420a37f21d294b1811918befffd7

SHA512
9ffa1e4be7d216f849aae44d7cd9d16806e0da209f3e9b9b685d1af8298ed72aa2e3a81a12622e8f01e485ee149206ad4ff022a1fb243b9d18f687d92e388262

Download Submit
\??\pipe\LOCAL\crashpad_1636_MIQWOEPWIEJEYDPT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit