bc60917312b2701ec5bedb7448ea06b4b2e276fd011a9a7fc5c4589b8a111004

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6575f4d5bcaf239abbf2f8595cdfcdf5_JaffaCakes118.html
Size

151KB
MD5

6575f4d5bcaf239abbf2f8595cdfcdf5
SHA1

54192c9bc3a1a2a57a88adccf8e92b41ea4f6d6a
SHA256

bc60917312b2701ec5bedb7448ea06b4b2e276fd011a9a7fc5c4589b8a111004
SHA512

7775c6d91bb51dc11accc1cfaa68d9412e44b9452f668e967c826f81950a4adb05dd4f12b39122321780209e1dce4511746604025e8d60908bcedbff68fdebec
SSDEEP

3072:/TYS53+We/3fcjyQ8SoJLcKUP13G4k5QhLpOatVSUq5e6kwPd3kFBCPyPAlJcV2x:/Tthe3PSotU3G4k5QhL8atVx22wOoS/I

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4888	msedge.exe
4888	msedge.exe
1400	msedge.exe
1400	msedge.exe
3804	identity_helper.exe
3804	identity_helper.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1400 msedge.exe
1400 msedge.exe
1400 msedge.exe
1400 msedge.exe
1400 msedge.exe
1400 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1400 wrote to memory of 2872	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 2872	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1652	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 4888	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 4888	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 732	1400	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6575f4d5bcaf239abbf2f8595cdfcdf5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe811746f8,0x7ffe81174708,0x7ffe81174718
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11447655781617845564,4351027088697826112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ba2b255570d23f187b6b63be500e5a15

SHA1
2170b96bb5b2a18608966144a2b82d3a1fb7daa4

SHA256
54c687b261849ca759ce28783f88b761456621c84781d836e4f46c51a9a3e856

SHA512
8fc5fed6af7b163330ffbdcd9fb81a9124668120eb0f1988475db7d38734d9f77cd02b811147f5ef89575a1fff78ab91f51c6430f60da8c9a7c650a4943fbd58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
762c2b5d3e327f0aa8d36eb91b689781

SHA1
e9ad3a504f142931efd61bfa50de57cf1c54a0fc

SHA256
968653dbefaa8e1917ad9db6799ae5f195d87cf62ef39ab6ba3edb75fa013dee

SHA512
c34f2a259365652e4061b435b4a20096e6f228ca07089201755bf3056bc113e8fff6f613f4c6e5926424c5d19cccd2d8583ac8920c8950e01235b10c90256160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc85f78516f1fda529a957ac99fa5035

SHA1
fe819f57a343f7a55778626d92273dc7e6042adc

SHA256
5bed1ee3d368251e262dbc9e64694a722afc036fb761ffa8912c374a1d1a1fbd

SHA512
da90e4f212714d323f879598eca6ad1daab58800b583d90ed264736e3842f05efbc3d05ef8905d17d286b05f886cdae44f05fc57c364aae25466e791080b0d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7488e1b14f9baa0a860755c0b3dc920

SHA1
0ceb7213ab771d63e2c72d270eb73f34867a52f5

SHA256
cc8dfb8fe6dc9285efa2f0ca105dfa0cb1d2f6ece6e3523a7b4f3910a5dbe741

SHA512
33c5669d84f8e5db9758bb0d688b85af2f9dfeb6f1b5bf6c6e8d0f50adf070adec8a261e7209e804a29c8581e7af5a79ab60e04694c11e2f3098c919122bdc56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b1f03df38998f3e820d2b14b175dbd4

SHA1
c6f0aedba0ff6d33767fe9afc7f6b01a11100f46

SHA256
6cfc4d6f5420aa4606e5a8653cb03385b3017e5ea8187a1f54b5233cde88834b

SHA512
ff3d27ca1ca58a9617e4f9abce5d8ccc2867a7641ed06e6261e138c02c4a11dcbe596648699a99ea2da31d987f725e016edf92cb32b4cbd3be78d068bf36d249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
dbca83ee30c2452aac67d9571ab27064

SHA1
b41e84f349f93fb5f885552dcbab6ac14329afb6

SHA256
cfa99366e08dbd87d3fcab9ed867c15825134fe1177ef52ff959471f655a0a67

SHA512
9a9170dc6353a099b6cce1aecacd2bc0ec17f710936763ba2a7d92587d4b4e4bdcd458705cd77b49532832ae7d45dcc6312b2201c7aa80fd7a87450e7313adde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5849b6.TMP

Filesize
203B

MD5
8fdaf70072d45101846882afa1b2621f

SHA1
71787b69eee7662a1f1b76881c20179c48753b5c

SHA256
2678187a6edf15d47966914430dc0dac4ef756fbd6acf15756421cd39fa924af

SHA512
2432def40f031978fa4365d72b27ccba4b54ea880aac6b466931a2a68130919cf4f0720895c4eabb2e911c5447ae000ccbee9b02a400a675533b78b98ae31935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
198a0b661ed1a1701d7c85836e9bf74d

SHA1
8a7b202d98f74653ec9cce96456362bab1a0529e

SHA256
40bf71eb387bff3676c8c3ec7532ebe8a5d6828f505262b751cffc79456c1745

SHA512
2515ec55a512bd3157793fac8c26950ea1eeee58e5b87b228f748038054d27dd196a433a46ddf22b1619e939cb6ae8b456d904585b72760764def08465072548

Download Submit
\??\pipe\LOCAL\crashpad_1400_RQUVOFFEEYXSVKDZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit