9c477dc01c933f1be834665bc85b5808a00d67661bce3eda5435d1911c464512

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6852ebcf7014f207e013aad735dfeef2_JaffaCakes118.html
Size

94KB
MD5

6852ebcf7014f207e013aad735dfeef2
SHA1

37e6052c1c95b5129bfce0edcf051d1ab04833cc
SHA256

9c477dc01c933f1be834665bc85b5808a00d67661bce3eda5435d1911c464512
SHA512

4d6aa1d3a23eff4ab1f8588cb531e54f256333ffdc357c0d82f6c948f1cb8c56d6a7edc7096997c699b12342a768f450d166d19f8981f94e043ee76beef9a422
SSDEEP

1536:MGe8rKZytE/o5IRgc4JjfUprTAcmqf8qq+EObwWpb1M0boHiX28Ggc9d:MP8rKZytE/o5IRD44vb3XGgc9d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3192	msedge.exe
3192	msedge.exe
3660	msedge.exe
3660	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3660 wrote to memory of 2424	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 2424	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1208	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 3192	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 3192	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4384	3660	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6852ebcf7014f207e013aad735dfeef2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee01646f8,0x7ffee0164708,0x7ffee0164718
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11122831177793173061,13113005197625472099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
65df334b1b0af8cbe807560ba8878b22

SHA1
21376966c2ae67f397c4b8a0a3997880e8c323d7

SHA256
5d6745cef72a49853aa89185947f4410a6df9eafc1a79c1aa5a9462472f42dca

SHA512
a47209e6ba1c8be2b18dddac78f307a4d758cffe262e42f68f4c732372a5988824fcf70e8d1d46dec98b2457d458fc4c749384c19c2211ff9bbb1b2020ae0de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ee18eb374a35af091af6e8994fab2295

SHA1
0479221decda3ad2c4748b7345be7266612203ed

SHA256
11b334fdc026108c5ef316f4b1aba3a1c4ffdcda1b340d0441592af271867bca

SHA512
916623d0e8d0cf5bf0c1131ff5859a57fec68aa123abe1fc0ac4a3d9983311a8ab50a7b282950f548fd0f63a28fd64fb81e4ef8596d27d452815b6705a5a476b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a77d72694445817f9e717aae10b9912a

SHA1
d8822ca650e46a4d70800e90f2a13a6b2ba0b8cb

SHA256
5a32129b83dff444add9e3f461f071fa4e9264fb6110d2c9b6740c75e7cd7d83

SHA512
7f099716781ebf632e7859957e209018f8a4e30d511e293bb0d2e023d8ab03467e4f0385fc3511f8b7ad476d9330ea5b507600f3232ab0182543c723de34e5e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cfa05644a54a4d73d8b6cdab5ac7065

SHA1
f27cac08900e604fd182fc675d2086614e81ac6f

SHA256
c551c569d14ef336498c713a874b00702ad7d28b90d0783828dcc4b56b5a5344

SHA512
e60dd6a4fb313baaa6d1336d75afbb6d7f150aa15ee59f547d9f8054a500e9d35d31f6f998f66af977f09671302cc134a39ef615e28041a77e394192c380a086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f6f5f3257ced86e9498f59acfb87212

SHA1
afc646c8969c33463182580b7a00496502dfcbfa

SHA256
be52353a995224acf9fda1bfb32afe119c8a8721dca685e4594288ce47c515fe

SHA512
4a1c92b00a27463471547fc75a2550a616631223588cdfb489e7e4ebda2c1f37a1b7a71419fdab32292248394f387677692dce877e7950a8ab036e26eceb9d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab6414c818c95529c725f84df02bcdc3

SHA1
bbc7c4d031231540e20b53dd58724b138435873d

SHA256
74e5961c69db32240bdc44943064b8b9932b3c6e5fb87a908222a9168860ed78

SHA512
c371dccddec1ea8616a98570047eaff375d42a88780ee0929b25c9e42845c530051889f1b229f081b6b734282608535d7b2644289acb89daf17bc2f227b34f84

Download Submit
\??\pipe\LOCAL\crashpad_3660_DTBJJMTGOZJILYYV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit