2e932e67b1471f2d1b131e3f42e49c0f31bb5d6c103beac1cd250a990efb59b3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82218191623b8254194495ce9f2eaa49_JaffaCakes118.html
Size

202KB
MD5

82218191623b8254194495ce9f2eaa49
SHA1

a16ce588eecee86c5c07dc426c5b8d4b5cd182a8
SHA256

2e932e67b1471f2d1b131e3f42e49c0f31bb5d6c103beac1cd250a990efb59b3
SHA512

7d99c87170e3041a8181df0350a2292c62d203f2743b7ddd3b55bb2345052167d06799ad284de2589af70d3c9f7552e179496822cc27c47c27e0df07424d9ac8
SSDEEP

1536:LuztRWw2yssaMuYqE2fJ6O1T0iMe5ZQ5yaeELuKdBh:Luzrx+nMuYqE2fJ6MZkPuKbh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
5072	msedge.exe
5072	msedge.exe
1200	msedge.exe
1200	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
1468	identity_helper.exe
1468	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1200 wrote to memory of 1812	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1812	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 4248	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 5072	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 5072	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 2372	1200	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\82218191623b8254194495ce9f2eaa49_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe008a46f8,0x7ffe008a4708,0x7ffe008a4718
2⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
2⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
2⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5220 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9042472495130205851,12254269756164463699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
b1db097cf12cc4029236b3fa383f8cf0

SHA1
d32d56405df5ab5fbadb9450f17a6a425f92f31e

SHA256
a142fa1b38011f653d576521242db5f92caf1df3a2f21643817684d01723537e

SHA512
d7276d1618f76361942e78f35b034dbfa98d4c6ed6eb46befb5565306317da0fb22af2f54efcd25a05a2f19a971d8969906afe859f8d6e78b9510f7b686ebe77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
6982a985b6007ae9f3978e56bb6a718a

SHA1
49f3e53b082c363ae22d878b28099df481beb932

SHA256
47d529340f155af99d7230020397ea0d86d2a5974f3d1e8ce439a9d64fb7a42c

SHA512
64ccbeb32e7c725a57c23f9e6077787a79d314ef66885b53812ed013ed2fbfd2f435346a32cb4809c8e2366b7387da9f93f672676170aa0c6fe8412c9e318e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0811f04937d82457c24a8508500477a4

SHA1
7ecc62c308d6287fe2b44f34694a497267040e85

SHA256
dd515256a2ac54875eaaf998da44081570e61788fddbfd35297b0b5b1130162e

SHA512
d9c1e2cd61e4e0f74b250e31a4b8c743c003d97360701bfd188e20c1362c4f3b870715070d212eab2f161987a1e37ea120caa9a4061df1a8783ac49e1c6e2c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e09d57d725f8cbc861e23cd52d47e1d

SHA1
c4f5324b02c700f2604aacc9966022fa3627059d

SHA256
1c76110428dbdb06f4f03f9e356cb74bb28f224cc1d361d1e607bd34d98a154d

SHA512
5a9c5643d2d8bb06d2100f5a823d927aa0145583f36d7d9bf4dd7fd868c306fc5ba5a230cf5aa88fdc9decb77cf4a51323aa14c4d379b1b7bf4d1f9104617762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2f2358e5b074c73ea6ec70aa159826b

SHA1
7700f16158bcf9c80459256c933d1ab69035fb4e

SHA256
a998dcb93a93ceb35274b6a26d44e9c99cdb812362107934392905603a5bd5c7

SHA512
f76940d9c13062d8443da9738ba73cf03328d2334f735a3ae9c4a80517988e9ad9d871959529e6e6cd7bf9796cda5d268dd1ea9871877c8e4d3431da6494415c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6130e08040a3a467a1cbad7e1c444377

SHA1
ae889c91c469b8fe27f4c1fbbde4f8429a83f5db

SHA256
4acc8602ef90defb617215c02a92e34519927f385d17c199cc38a86b1cfbf368

SHA512
94e3beaf50253480881cf7e9f3a9a0d35d50c69f9b74a1119f3ad30ca0ede069b2b7f022c31427574c96c1eaad68715760fa1ca944a36b0c6302200390265a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
90e05e97693f09a07d049fa39da10fc5

SHA1
aae13fca38dbbe0eb26facb462e9c8ed3a22afd8

SHA256
ceb54de9fc92535eee76caecf50f1ee463cf44f3aced85f92f0f14edd2723197

SHA512
f37620886b96453830bf003e4762616a84e81c1e1f9372023124d73d0ec375a823f393e788f5646763864b36f1c348866deaf4fa40e3cd1deb21c44dd97538b0

Download Submit
\??\pipe\LOCAL\crashpad_1200_FMLJHZIVSBAWJLAQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit