087a672e753c285d6291ba6ea5f26853228261187df6f5066e78ec6c68497669

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d69b1c3a8f95ccec083029ce6e72e8_JaffaCakes118.html
Size

48KB
MD5

68d69b1c3a8f95ccec083029ce6e72e8
SHA1

5e779889a324ca1b7ce3518ec176feaf534287f5
SHA256

087a672e753c285d6291ba6ea5f26853228261187df6f5066e78ec6c68497669
SHA512

878f3504e990c5bf2d5ff7bcf308550175e5825a21b8ea18c8450a481f93a4d2613bd422d33cc113e88256d0d36582343004231013ac86f24d373333c5d95e43
SSDEEP

1536:lgh8KXNS3m4LFWwt/uUXrT9CS8BM/cVBrVVY0vkSTk/e2VeE0R9tXnjGlFy9ChK5:UXNS3m4LFWwt/uIrTUBAcVBrVO0vkSWw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

596 msedge.exe
596 msedge.exe
4704 msedge.exe
4704 msedge.exe
5048 identity_helper.exe
5048 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4704 msedge.exe
4704 msedge.exe
4704 msedge.exe
4704 msedge.exe
4704 msedge.exe
4704 msedge.exe
4704 msedge.exe
4704 msedge.exe

pid	process
596	msedge.exe
596	msedge.exe
4704	msedge.exe
4704	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4704 wrote to memory of 1968	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 1968	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4808	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 596	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 596	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 3244	4704	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68d69b1c3a8f95ccec083029ce6e72e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd7e046f8,0x7fffd7e04708,0x7fffd7e04718
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17899408982576406626,4901032383610437636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
be3c9971bcb9e1e320586e384cc2cf3f

SHA1
03bb5bc11560483b98ee4e3c6a24c696fc56511b

SHA256
eeaa03b03f077e1220dfe0923bfc9d207c2138916e87b8b8bac3b8ba655d6554

SHA512
ba645b783523f548ef08205a938d15aa278f0d73519f4ee167949fc5bc952a11d13687fcbb5af178a9643c4e1a2e8f832ca78206a9befd0f6ea7760861629704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c50e5e73d27bcdafe92b944203ecb7af

SHA1
f864a4d827ac047c004aa38c2d06ffbba1fc356c

SHA256
23c8b6715c848c3f60393cf4ce59906a56590727e46a9b2677d4c2c2fc5098a3

SHA512
a088f902e888d4b140a36f233460715c17e20530aa0548e0c820f73c69dd226e52108dbd7d1a108ee5eef3acc7b8a19e6211503c13867d0778d6fe09fe7b601e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
254ee3bf923096c297d8ba2c911c4858

SHA1
dfa2034e27fca759d4c78d3f2b405e38ed86a767

SHA256
74bc07d03adf556e5215d028924ce85a4c0e1ed68fdb135759b2010132077b46

SHA512
8e81317428bce072bee085cbfa197b97a6fd798bbb78e049a52ee49a5927f4545c2bc975babf1b4d2186fd84db4eb8363d3f246e455bc5b06ab2b0237ee4307d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85233e49c4efebc84adbb8b4da7b3411

SHA1
38dde2009b47ea53c59a59cf28dbfb02bc403f10

SHA256
ba12b51259eac4f0d80a0db845645e63fd3a75c06f3aae1b1dbf7ad59a66bb67

SHA512
6d90fc0b2f68d4cafd2c4aac2db0b26ee62b56aa14dea68714dd1aa74af99a893a4fe4d90723a834b5e0825444040158269bfc226c7f846b26a089f2776c56b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69c124be38202379ae391ba2ee74e2b6

SHA1
889f42fb80ba35867b969267f6e74e478e8e7ee6

SHA256
38bc1db40f5899ee77261be19c2d6f7c9211e3163d781e147e253ac0f69ca982

SHA512
2055374c2afbb346231e328acba6c8b2743ddbcd78a5903535c67f24aee05e475404250e7ea9ae365a3db4b69d5bb0f5f6f2d44eda78e9494426cae05a3d2090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f86f38d061fdf0d5d8cf1769581af49

SHA1
2ff6d502bb31d954f402b1c37f7d7535dfc9855d

SHA256
afd8bbf898b8de5e03870697bff33d560372fa409f9b9c3e0002fbdfb35f85c0

SHA512
f68c9de17e8c2313725fe04ea905cad94c1dcb3e80f8629c8b5a727fff68f98f38fbd86b54470ab6f77f4196bd9dda42f658489ba77442a5e6b7eb05efe9acd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4536f09a4e9950d229ae8dca39c3f070

SHA1
6997355da50201e5ba0fb3ccd04c0c59524ee691

SHA256
f05fb30d96094e9ab5b38d32878debe859f314c037f8fa7ed4f07ef08ec73618

SHA512
dc298196e0ce5e17ba484aa91cf8b62961ad1f4018912c42e27db897e2c63bcf63ea720222aa03561c571c5030c832fe19d06cb363aaacdce174de450e091ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc5b.TMP

Filesize
204B

MD5
445f9e5ac4649bc525a45eafb95bba4f

SHA1
032b9babbc60003f019d63ccae1f144af728083c

SHA256
3d93481842e294b564fcfe31f8f63fff94cb02689c734dc67b787308279d78ef

SHA512
6799218700c3e0b84b16dad18ad29c9cc9559110d48c2a3904b4bd83aa11bd24ee4cdd527db5214d69a83ca43885b3f66168811c8c2e01f0883dc1c65643054d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f649173231f354c4ce97425e5b02034

SHA1
1163f5e4bf8739a50af8a76591f2c6f09dfabb99

SHA256
0c7dbcc1b450a74a27f26e0eacd2cc88dc583e68aeec04821a567b056589d41e

SHA512
44cfee8d69bb00e7a0011bf8957b3dd5a9aaa4e53ea3586488cce3b83a185d136844a4f45ab1bb92f4c35fae08ec43f9d7073fc0b974e9f2f27007f8f94c7524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2f40621956faced9ad4d2c7ea0e990f4

SHA1
c745172e2aa45c124e46f70906b1e215163d72f6

SHA256
b3c2f0fb9bfdc0d4be3e9353cd358bc4cf0b17d2e0fb7434fe99c9149e5bfd23

SHA512
c1e380eba5e866b4eae5dd5b27adc2311d449b0f6ffbd2fe4d982fc353b8ff5d803007819539f0ff6d8e8143d47a210764634eebf1fea280231c48aa6b58f530

Download Submit
\??\pipe\LOCAL\crashpad_4704_XGWYWDMEIPARWTDV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit