cfd02e39f6affd031f9570b048a99d6d43601924bff6903f5a01f9bf3729583d

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f0b050070f78bff4f18ed49468bdde9_JaffaCakes118.html
Size

117KB
MD5

9f0b050070f78bff4f18ed49468bdde9
SHA1

9efa4f863947960c221ad653eb9a34a72bbc4bc3
SHA256

cfd02e39f6affd031f9570b048a99d6d43601924bff6903f5a01f9bf3729583d
SHA512

77752c73ffa7cd199ec25e906a7f7df61389ff53e39f6f0a9a65e60870320699879f9577934f8642d5046378f9d5fbdda2115c710e4fe9ec36d7b3153d69b8b6
SSDEEP

3072:2eOh/SSodbnckaYJNQMcZf+fxCqwf3+5xNrNDkx9x:gh/SSokN0Y

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
16	sites.google.com
18	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
5100	msedge.exe
5100	msedge.exe
4028	msedge.exe
4028	msedge.exe
4368	identity_helper.exe
4368	identity_helper.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4028 wrote to memory of 392	4028	msedge.exe	83
PID 4028 wrote to memory of 392	4028	msedge.exe	83
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 3504	4028	msedge.exe	84
PID 4028 wrote to memory of 5100	4028	msedge.exe	85
PID 4028 wrote to memory of 5100	4028	msedge.exe	85
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86
PID 4028 wrote to memory of 3380	4028	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\9f0b050070f78bff4f18ed49468bdde9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd576f46f8,0x7ffd576f4708,0x7ffd576f4718
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2744841409282812565,7364146588370714086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b0fe4b32cb2dd000ae5d0aa505f0dcbc

SHA1
b28ea620076f166b63809b55eb93b2aa3bdd7f94

SHA256
ec5bde10ae1ff7954315e8a687fb1627957d2e1c2ce703a604a266d5be592fbf

SHA512
c4bfa12cb756886802df6662ad8dd787e45337c6d19047f2d2b8568da572ae9d46790063572fdbd0411e6af7f87c3efef0fb5440eb86682dab35715ee9c00351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6bdc970229cd24ca1f2a4d43150561fe

SHA1
76be6b49914302d740812fdc1b243943c792ff00

SHA256
27cd3ce50c0ef555d0034ef055203929e3b21ac57b250cc40177cb3001db5fdd

SHA512
d51fc0c6e97eab1c7e7e77fabb40914b853f24e379507dcff440426405e162e66adba0ed4cbdaa8efe638e42288b1e8a3415661c764e37582cf0c7c7b9b671f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d199ff0274e4231ca45b6fa7d1eb5365

SHA1
7dd6e2ab2f0078efc574bcef51430ed1b08fa785

SHA256
270e95c166c7f3c2adf10efc61fa08071eb83335f605656d7112b30c703d64f8

SHA512
ed698e3b8211ba754c539c8f7d388a97eefe9b4c8c5718bd5d48bad9c6b8e6eafba428e9a6dfb49954381b50ba68227f19cab8c3a7addbb8393e2188b996fdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ca8d3385a2f97255a2dabe997f4c8ffa

SHA1
6c61293d9659db0ecab3bc212ccb48e369553df6

SHA256
74e95c3192e2a77fc5dad54d6644481c5ce0905216ff01140870505de982d2b9

SHA512
1806f6f72448289c7293fce04605593eb9c5cfd9cb5947d21c3144b1250d160716d7df9ef2b4ef60c8c9a608e90b4ff3fb7e6f2d490030469de07a32802e2bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d1e583834f1857f2274127506cf5e46

SHA1
1b90e7c1d245e1c25b5ebc63d0be57d64e45275c

SHA256
5c24972dd2ef5e22e088d9dbc828f39bd6f7f8b87fc03fb7d1d9cde40300742f

SHA512
e40fd451753580b57691ffaa4b6b84cd5a76616d78e690af162721d64d81397613bad021459cd0fd1f3ebe1c92bd1c4edfc31b950cc086b7662705178c8c0a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a19ee338d65bf6b1385bd94797540cd0

SHA1
380076fab4417aff3ee1c1c70ef20479a1f2a4f2

SHA256
2886fa7b94dc8a8f79eec0a8f67216a7860c0639db78761a641419990d0cd55c

SHA512
7594351ad4f7300f72604ee7caf9336fc00dfc753e7b413faf4a976e10b37a2bd5d0a7f6e4398eb4cf0f0135a3f2c14ad23cad3f9de924a8cc508cd430044734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
732cbcb6327ba71ed31626beded37374

SHA1
2ea032837cc18470e9555b60d5c24b26512d0edc

SHA256
5255dfe4e613d94942db73421c62e6a04989ee658567d41da726848e0d723f7f

SHA512
5d2c2013a9d18e566fa0f1864d63aaf0b6a4fb71faa59184bc6315a13e78daeb12f9d48a349bb24935c1aec9f3255e945445e4288567c64d6438448fa7e07381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
44b3df59a948266bd442bcd435b1d97c

SHA1
1f9991b11853871e2876f60c4e2f1ba654d7cbb0

SHA256
65bff17bfb2ab02e737d19c26dfd5e053bfbfea436d9dda543b25424b1c99fcf

SHA512
eb4095d91dfe4240b951d10ac13679e3c7fb819b0c6bb9b55848b3846eb115a7594be4a5712fba781d4341f69c18b6a10b54d68e7818053d16d7b84d3bd1d7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47d9dc35234b20cfddf4a409118c3491

SHA1
5e93654121ddf9579607d3918df126709a52a88b

SHA256
57e94f38d9e9adbe356c685794816c2c7b77023b51a9fb7045a49a82fcb6b587

SHA512
0ed8827a12f1a8e5200883910917777a16accf6f315a8494c5504704e2ed3d1cd1f30c20ccc42edeafedb40802be9afff18e57f86969740d417f72ca8220e8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2a1b1c2f4d3a8214d760fb1be12c6fac

SHA1
a7df3ec77f11c8d6c4e027506c43651e20212751

SHA256
ccc97f3c0bd83598233831f27a8083d08ab5acb7485ecbd5550bf2afd9d2e900

SHA512
f9e8a7fdd59e4dd48d7b24b3967240a419c4b48eaaaa2a8b4550e5357e2924164ee3027bb925573b448d54dd04cb6cb33ef229c25e3113e90b7acb9448414ccc

Download Submit
\??\pipe\LOCAL\crashpad_4028_FGCEWEWKAHCOYMFF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit