5aca7cd62847d80b640980e7f1120c96076e0517a25e8b91d335c086288ed1e6

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6402512c4f77f25a9ae71199b7fdd625_JaffaCakes118.html
Size

94KB
MD5

6402512c4f77f25a9ae71199b7fdd625
SHA1

e083197658ff42717cfbf4dbe5db7b6189d1f076
SHA256

5aca7cd62847d80b640980e7f1120c96076e0517a25e8b91d335c086288ed1e6
SHA512

baa44e0d7f5af6f4c9269be93a001ac1916bc883cc3fbc6b2d607a4d897497e92176502d3d53c7d91684029fb3b0fd4e085cf47572f92663e58be716f46d9397
SSDEEP

1536:lfbqQvWjk9zS8UfGKaKcTpiij9x3zr9/wY5ld2G9mKI:dbq0Wjoz5UfGKaKUoij9xDZ/P9mKI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
752	msedge.exe
752	msedge.exe
4236	msedge.exe
4236	msedge.exe
2404	identity_helper.exe
2404	identity_helper.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4236 wrote to memory of 4476	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 4476	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3820	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 752	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 752	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 2340	4236	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6402512c4f77f25a9ae71199b7fdd625_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f7a946f8,0x7ff8f7a94708,0x7ff8f7a94718
2⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
2⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
2⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17706596661062798894,3369935451797753491,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1400 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
718B

MD5
50eac78bb61cba6dac3660a7a914a2d3

SHA1
9bcdc84ede185aa889d9520718b750ce25196eba

SHA256
5cd3b6660c146ca40ba9eff826f89dc9762728a587626a65d677e27143f1bf10

SHA512
39bc787fdf41ba0cbb8092e4009e20f06869d30c577abc96169531e2244233a9345475c8ac31753be45c790ede0c938945f94d8737d14a9a38e2ba5bd719c4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a5727b50bf593fee3d94e53c1848bf44

SHA1
c2ef901fc334fa6609e7d94e402b0fa831f1abe3

SHA256
467c9b2567cee91bbbb900fe07d12f689361d75e287590d13024cada93c1694a

SHA512
87d72ecc5ddf24566de4de9fc9924f96ce0d7527b32d949a898b58b4f1a1169583a48b4c1501df278f5d03a9b1f1ea41196b6e25a16d99b0dec64cf020fd0515

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
21bc135b2832754b30b9d245125867ca

SHA1
923cd73fe06a66207dca30f04a4bd63f604babc5

SHA256
4b58fb05ff9e8a48fb2cfe04dad8a1ec83a91ad6f7e9aa0c9ae5b600a2cc1699

SHA512
337b692dba9dc8a857782c3986ccc20c22b1f36cd48a4c7a7f0a459a9185e3ee0eba7cc7972c7abb329b72cee511b4b54b46d05775cad7172106ee93bcd0e917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
36c12bf9887a80803454582fc68dab49

SHA1
5c1c8275f101ced1bfdd72503f89629fbfd640bc

SHA256
145ffe6382e0c6f5606a7b9e9611c83013e22413c240154c70771c392d1685bc

SHA512
2f6599b7bea1327d1f460c3e283266df0c0417c94ace6c683ed4003c8e859acc7abdede4c83beef683d2cb830e4e3968a6325179a08bc468801f04d01a77d23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
536B

MD5
9917866a43f75e4dcd18b334b7a314f0

SHA1
4cfc7994560c204a5e43cf764090ae320c866030

SHA256
d3ad933732d20f5f0f57a16d36e0e8284c32aedad8821318cfcee86cf203794a

SHA512
59f5459090ecf59837397d355a21804d1436c695027354385f2432f6e14e53bc8cab81b29e770dfa5c75cc1979efaa552df2784d8379aa4d7ce303610a3183d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
afe4c4ab08b95c363a359912957b13c0

SHA1
53e325eb708af454abda294a9399675ad1022093

SHA256
90fbd5ba6f5b5ea8034345aab10fc8027b6191f154f5d4388e3af4894441ccb5

SHA512
e422ec6780ce3fb295745797c6557a529380073a03459fc716109a81710c53af3d6ba671693114b661aa9277bf70bb66dde0f21b64e1a07594cd3b03065fd436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584ce3.TMP
Filesize
204B

MD5
4d567124148748c07fc030ad8cbb7cf4

SHA1
211941bbdab3df055184731194b11de06d5517fb

SHA256
6c04006773f94f25d5539ab0dab8aa4f4e5bf3cda0f68fef12b5e704028b8511

SHA512
aff682f821a34f36d890ae99ca0c04b332e51f637fee35177a97ed13278a1363f57edeb39fdf794cf373530ad8c55705dfb4fd775934326ab05820ad437cf400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
821d237d7e037ec3e28afe40164007e5

SHA1
d2aa4f37f6fbe057846247274aa04b2551e4a69e

SHA256
a04b13b3f0077c395b9c7521125950b89ee16f4c75d5a69f60d8279b7b712158

SHA512
870a81a8e3491172ff4007ff2bfa0645152dbefc5c0a7b8e86a25bd9bb45c0c7a203e005c191475fd6dcd52fc23163061f6227ee8ea19ab38ac8e7aebdbce97e

Download Submit
\??\pipe\LOCAL\crashpad_4236_MONEYCRPCTRLXJTZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit