ae2fd54d17e2b191dd914dcb7e05ffbad7dc4c41af302245581fac4af0f4616a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

694362afc73ffa940cd378f9576d4205_JaffaCakes118.html
Size

130KB
MD5

694362afc73ffa940cd378f9576d4205
SHA1

da92e52c1dc566a9993b0e408dc435912ad1c62f
SHA256

ae2fd54d17e2b191dd914dcb7e05ffbad7dc4c41af302245581fac4af0f4616a
SHA512

dd62e7d2021abc6a8d25463b274b3d3d7538837f6345b7a58b58a4f2e277efd450b747139d9010f4ddfced62f7005e7c21a8694f0c986d038f359ce0987eabb5
SSDEEP

1536:kbpD3VLXIaKJQX06gfU0OhLKK8RbIXsASEoB9n+QVN5glF+ibotitrHqHAcp4MVV:+VLX80yFlI4EoTRH4S5qi9t1Bl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
456	msedge.exe
456	msedge.exe
4528	msedge.exe
4528	msedge.exe
4376	identity_helper.exe
4376	identity_helper.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4528 msedge.exe
4528 msedge.exe
4528 msedge.exe
4528 msedge.exe
4528 msedge.exe
4528 msedge.exe
4528 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4528 wrote to memory of 4180	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 4180	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 2308	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 456	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 456	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe
PID 4528 wrote to memory of 1492	4528	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\694362afc73ffa940cd378f9576d4205_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
2⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
2⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3205877757250027404,2633404601241357193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ac67e930c341e6781af0d824c2479f41

SHA1
6fa7744ff8d679d34d5fbde6f3a384904d34d4a2

SHA256
aeec82c2bb215080346ed7b8e97444e19c5172efd59048759309a36467cc9250

SHA512
df09fe3f450f49bd13c0307bd3eac8566909451681c8231f040e180218c8673d165db1308fd28a2903c62e00f7bb11cc53a93edc875a80303352fa69be1492f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
962583e31a43e916c8ce985da5a611bf

SHA1
6cf40b8af60067719ebb2a2de98fbb0866f14208

SHA256
e1a1e592f74495d95d276e20269ef5b315d4412d240b89eb87e33f53354fa709

SHA512
bc00986e121e16ee2faafbccf886cc5d9e31774065d271735652130073b2e05ebce7cb422854611a473c46984f8246e0c2022e8a1645d8b0ba62af9aaa3847c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d47ccc478e9d3c0a6574e27bc9968c2e

SHA1
3b81ea2e1d1059cac2266eaf7af9847fe785e967

SHA256
1dfad12392cecee890eac75f9f4b5ddf68aaf5dac1511fd8c69a6f4c62ecd200

SHA512
287e34affa8319a26e17d4ff5af8888afc8560d3df59b77686ed42e70970f462f8e3cda0d0371895069cc0f7f186662feaa678740a94aa66cf6b2a0253130b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c81896048594f03413b84ad28356e64

SHA1
b959dc06cdab7c1d961999ce65f5b3befefe2b34

SHA256
f0de00047523d4bde8032d3e83426fdf22520370423ec19b1cd46895aedcd842

SHA512
f224a37b34765a3d9fd60de93d60b8690e4dcb581158fcd2e0d9e478e7fd68215008401f8f50821e8388d5fb0c97b32123d81d459d30f821313dec6ae39ea11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
175bee72f4a868541a0cfe0c79c732ac

SHA1
47187e2c1e7d54eb4ece8a88692e79f50d252187

SHA256
e88620df814a7e53926ccc3d39a4988acd9d27d144b5484df8e239c55e9db274

SHA512
390077e6f918572c5a9153d53fe0f08bc3754e2b4a7e8a9ef29298be36fc9a835150b6609bcabb61d5995e9d35d7fcca642111e9d8c595ecf5392d6ea9d884a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47ecdd8bdacdc446e0d1d7cceecd8cb7

SHA1
a7ceeab3b136c7cadba0377a840286cb0c295c05

SHA256
b5116ef6fa821e5db9fec4b1ebfdc46012b6587d743f74c434a6a5576b3c6b79

SHA512
1207bdccc8e12c38c39b85e3561aaa95441d53bc00686b73b980d47e73240c966b264344c01b1db451dd85dae7bd070b2a023c7048f74fb79cf19bf403d20629

Download Submit
\??\pipe\LOCAL\crashpad_4528_USRCIHJWVOANYZOT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit