0cc65438ea30568a6e6de1701c4d8569a4ad0e7a26ac16333cdb1a3793accd50

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e7128cb958eef625c8b60fb60438cb_JaffaCakes118.html
Size

32KB
MD5

68e7128cb958eef625c8b60fb60438cb
SHA1

d528c7e63f0a4b8dd0ee47e8d0b6fcda4165a213
SHA256

0cc65438ea30568a6e6de1701c4d8569a4ad0e7a26ac16333cdb1a3793accd50
SHA512

ad445f890c51c608fe54d682038fffcd693b317a73f6805d96c3540cd568f5b01c620742f26b6fdc1bd50736482662a8f3b48c78f45d176d22ead767957e821d
SSDEEP

768:p5NAdjhpr7mqqGI9f/yhvSNpZ2GIbB0Lf6QhssCUly0Bsc:p5NAdjhpr7mqqd9nyJSvZ2Gu076sFhBx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
532	msedge.exe
532	msedge.exe
3880	msedge.exe
3880	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3880 msedge.exe
3880 msedge.exe
3880 msedge.exe
3880 msedge.exe
3880 msedge.exe
3880 msedge.exe
3880 msedge.exe
3880 msedge.exe
3880 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3880 wrote to memory of 1728	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 1728	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 4860	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 532	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 532	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe
PID 3880 wrote to memory of 2988	3880	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68e7128cb958eef625c8b60fb60438cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1e8a46f8,0x7fff1e8a4708,0x7fff1e8a4718
2⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
2⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
2⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
2⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
2⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,549459239108557294,6801990649896042805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6544 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
3a53451bbab8704ac67c105a85f114d4

SHA1
58591939bba53c72a1d50e046004b183c3aba422

SHA256
35aef8911d01b7682beb06c528181a79e022a6461e7d45d95e9d6e3fb14126d6

SHA512
36f4ddf43bc4b3d862babd5f4430acda9e090176012076d6c3e6bad1a375c244b5d33b613bfa25f40716cafd0426d87eea58d56c33c1dcb0892d432b800f122a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f569a2f12b73aa357cb14ce86fabcd47

SHA1
e0622d16f582ba3faae8b0018502ae2d523f9f98

SHA256
9304c4ba0d85ba7f432e9d6e98641f103b9cc44eaf6cf1278fc0c950d87a1608

SHA512
d7d6a1918820acf2bb687a441712434b3fe945d85ba58c729114c5c4508333cf2449a05359969d19b03a8056a98172aff9236bb29eb5bf384d9d6537e53f0700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
171ba19c3d38ab4c10203ffb72915fb7

SHA1
7fe0c33e4377f44e612c8e74a7a8803da689376a

SHA256
7ae1e136f23b8565b8727cf8640cc2a668fc0cbc3d4912bee092b03ab29dba42

SHA512
619289e626e0e2501d5adfc7e1cc21cdedbb260403a8ca0afe3ec84abd00e41e495cabeafaa85a27d9e2d964e5ba652d706eacfba7bf204a00b4ded6a59295f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e9f63021db5d3c56b73f8787d41bf19b

SHA1
35e877fc5fe867e1e7ae0327d9cc159b798f9e6b

SHA256
15e2838b6be8163a27f7d932952179060459aeb8640e14ae4cf9615c013b2bc4

SHA512
6f6c25e948403279e216485fbfab9b99474606c20644905ac2e374252c74a18953841375614e146f37a749c052dba4c19fc8055b1c56e482da9192f6be882289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0ab69ab-f17f-480b-b950-78fda15d6e73.tmp
Filesize
902B

MD5
aba4d4db45ff4ab36f8ae5731e055d07

SHA1
55f3d6d79a57b74ea42f274dac9d25cc433e9879

SHA256
28c046f07c56324eef52b6aab946ed286c19f5921ed59850e549071c64dde208

SHA512
e825405bbb450ee7f5e69ad880a1f8414a83acd88a68a1eb316b3bcffb8cf085d606f03b4f43ee754fbaa1656a4329e679e88cf716386d56bd6e945aa22bb2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
974e21c667423430a65a05024e87ec6f

SHA1
2c51d51dd7a32938aa1c1285ebf1464baa27d029

SHA256
016f8d4e24c0f8e29d8badef9ce77ab195f8f2f5f18a8dfa55c2908ec703cb5d

SHA512
b73da4e1a70508e3045497ae2bdff8a2c7e881f87f85571bb9e2f9e9eb53266da05029a681ec3e761ccfb2c861d6e58db32ae9a8b1f5ab12b37f833c9bdeafa0

Download Submit
\??\pipe\LOCAL\crashpad_3880_LYXOCOCYNMGLFCZC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit