599e2c67b1360251cba64f34ba094fff7983b48267681b7499fb96cdc5bc2746

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63d036e003c672599c622f40440e1c9d_JaffaCakes118.html
Size

37KB
MD5

63d036e003c672599c622f40440e1c9d
SHA1

f41e35664df64f1e6a762753e62597b5912275dd
SHA256

599e2c67b1360251cba64f34ba094fff7983b48267681b7499fb96cdc5bc2746
SHA512

5acaa590d14603c19a971cd904a40c2ebb5c7aa50bc9221df11d2f7a935d8ef4eca112a5fd1ce148f3a0138f7d2132425650ce50425ef456b15bfd9f6f89137d
SSDEEP

768:vKT0EipBt41UJuIb0mnd0YQ0y5v1v7xY1twBHFTtB3y0d2:iTupBt41UJuQ0mdrQ0y5vJ7x1lT6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
1760	msedge.exe
1760	msedge.exe
2436	identity_helper.exe
2436	identity_helper.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2920 wrote to memory of 2296	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2296	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 3264	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1760	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1760	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 2608	2920	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63d036e003c672599c622f40440e1c9d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
2⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
2⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
2⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
2⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
2⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
2⤵
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
2⤵
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,10439975714720836645,7917249144315431959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5176 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
04c9b7efcc1d875214735766a4dd0abb

SHA1
3c3ba60032ab3d47749f918056da985e6f4d36f4

SHA256
d2cd3da96f762f1d7512853780a3b14f9341dc073b4ecfc1d87214eacd9b29f7

SHA512
4bea50f0a59c616320a8a5ae49cd48ca42f941ad3bdbd73bb5d55895a84ac9d4dbddb59b8d14b3af74e95bf9434ee4bb44afdcbec2f6e89635d93933699094fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
360fbf3a1d05a4f7b913fd2e903fb0cb

SHA1
1b77c1aa39a40e2ff0f66289bc94d9ed343bf23f

SHA256
8ce9f3cfb648448ee8821c0037fc5736e0c5c17fd26c3ba16394fdd7e12ceb2b

SHA512
a2032efabb4f9b56fd238c8ff6dca79ebd544fbceebab102b852eb3e0c901478cde7a916cc24f0bbc23be1c8a3ec51ecde7b4b03b92279d74385fa18c2f0be4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb08feabe9ca64371d605c979b65c351

SHA1
a596a56cda2e6d6ec9115c85382dffc2d64ebd63

SHA256
4e2bffcb43f4a5ecb425d50f77ec43e25e61f0f6e91042f12ae44ce355b3dd5e

SHA512
cadacaed6cb293611a511268c39dd5eeae2de6b1978c938ad2ebf45de5952266e29cda0b5e3d5f1771d4f5203755b7c1693c63572f479ff47d59fd00b331ac21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec5307ef-cc9d-4073-9576-79c071896226.tmp

Filesize
5KB

MD5
d4c571fd4d016acf77f0489702771c97

SHA1
248ba351cd15043d022c704bdf655ed8ec1ba866

SHA256
77b7ef135d440db68a0352337ab72b629e59814a4c1807be5ff4b7408e9cc608

SHA512
d2a27ff3aba6538c2a32176c569412a214e1b8baea97176e2ce4378e4050c71d121792fc1e2c05621b2d7c12769648923da99ef317168643caa13309046d6f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d08e2f73b59c6dc675c641df8506da9

SHA1
4ba85b82011e7a59a91afb4e1f9f89bd4348f10b

SHA256
63bbda57b1659150d1bc163cdc9828eb6ec812dcddbda50ab856a66e189d1376

SHA512
9369452240d7f1de8159edcdb542dab9cbb6313bcb2cc32d40921ddee978ecc330e91924ca0f6c85215e94011e2e8ef5ed7c60e537923868665a3660907cf898

Download Submit
\??\pipe\LOCAL\crashpad_2920_GJMRZRLODXHQOOBV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit