864868ff16dc06be576d707ba8a66aadb25fa3a2316ae987fd12b168a9a06ec5

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692613e083c674c08a6bd2b42caa942e_JaffaCakes118.html
Size

12KB
MD5

692613e083c674c08a6bd2b42caa942e
SHA1

4fb62415299c7dca187f0da79da3c0c2c7ebf8a3
SHA256

864868ff16dc06be576d707ba8a66aadb25fa3a2316ae987fd12b168a9a06ec5
SHA512

47efe30e4b3c40a7c4e9dbc78b95f5808230b05216063e8b472188d68456fa2819424f5d00998c9b30199be0e0a129b01f865951f6221131db452e0b079c2053
SSDEEP

384:qO3I6RxkRMp0/eUuLDKyWETci1T/GzEWEd:ywGMp02Nn8S

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2924	msedge.exe
2924	msedge.exe
2336	msedge.exe
2336	msedge.exe
3116	identity_helper.exe
3116	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2336 msedge.exe
2336 msedge.exe
2336 msedge.exe
2336 msedge.exe
2336 msedge.exe
2336 msedge.exe
2336 msedge.exe
2336 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2336 wrote to memory of 5008	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 5008	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 884	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 2924	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 2924	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe
PID 2336 wrote to memory of 3012	2336	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\692613e083c674c08a6bd2b42caa942e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952e46f8,0x7ffd952e4708,0x7ffd952e4718
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
2⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
2⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
2⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,7986561343686434246,10442150434325200959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
859549d545ebebcba6d64e50be27add7

SHA1
febda81910381094707f43f385e0dc3041290296

SHA256
78d5f26c617f640397e5a3829c91cb4115dc910a0100f7df97fe573c47cd5b7c

SHA512
7803833e6d1ed9672c04e8eed54a7dc522641844a2009e101f3145015a374d8104fcbae7b0ccb09246a85ce97e11782d63e7ecbb8835ae9327eeea741a8d4961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
191f9e1bdfa401c464b5bf674e4ba04d

SHA1
2199c1816ca3c700414a3dca4295e8e359f73ca4

SHA256
c3d644de6cc1e24f89cf187782aa2fcf7c14aad0e628ab428e000241fac9ce1d

SHA512
3f2402934f2b20c4cde682cc9b80a01c3b0cce33f61d8b48938bc5b450b6daadacd2405acb60311042ecb065f10768be23597b89da574e5c3f463f6870565b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f7b4f59a07dd6b213bbba7879c186785

SHA1
830ea6854dd9dd59e26975f96e49413a8fbef013

SHA256
8dd71c7db67e6d26b90803c22db680e1b70505af78d844f2e3908c6d8538d09c

SHA512
5ee8cf26fb4697ba8c8f31882144d117db2bdc4fe5e307ee70493b522553959ff3297b1a8119b8a0f214f35fb832388583691f57c1dcaa785465559ed142e88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad22d85b-3b55-4683-a785-457402c2a5f1.tmp

Filesize
6KB

MD5
e5c332bb524f71ec17cedb4b503e98c3

SHA1
dcc4d5e8d9fe23484cd006fae17b626053d95c52

SHA256
8af8ae0f2f4a7e4b51f867b2069c6835a99cd3a36d28c5f13f40340997f1ec4e

SHA512
93490add72916175a9743a507874227c645a16bfe6fad3e606e78c78535f4702c28b62eae73c810b1af8d7836e57b85b7398ec86b3d1fbabd94664a7907b20ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5f707b9-6ba3-4a0c-9a15-1845fd920b4f.tmp

Filesize
6KB

MD5
7e5fe6e5d8f83da46622d609e47391e3

SHA1
902e7bdd7f861693a34421b94e9782f7bce9f8d0

SHA256
8af9da9fe21c838473791abbc27ef476d3b59e3c0227b3fc67db6c7af459e6a8

SHA512
2b7c385d37316a3cc31127b2019ef313c51f24bc2add06ffdf3335453fcb0d7acbdaece61cf70576cd19cc94eb7d5c542cc71d85df4519a0115c1030aff84629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2daae47a1a600b3c2ecfe667b77acaf0

SHA1
d3a4aa98fb8d52f79096ac5c4877a7db4117c63a

SHA256
a9cdce25b31026eda2e9b7d8fa360228c9a7b46edb5bb20cce735ba6a72dc872

SHA512
0e4a97236688f2cbdfaf2faade9ebe96e3e03b977a36d5c14532610a5d822d1fe91b80d86c7e3fdff3986ada0e7a6bb45a8813f10154580e9ffe2f398b0cec37

Download Submit
\??\pipe\LOCAL\crashpad_2336_FDEVNPRSAWFJDMOY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit