c2166682df59a31c987702d7795df8ca9dc467844058f52d1f9cc72a41705eb1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

694cadaab6795b71c31db24f04daba5b_JaffaCakes118.html
Size

146KB
MD5

694cadaab6795b71c31db24f04daba5b
SHA1

e630e704a3df56140a93f27fd357aa7eb3c26e13
SHA256

c2166682df59a31c987702d7795df8ca9dc467844058f52d1f9cc72a41705eb1
SHA512

a6c2cda3f5858acd98f0c8d7db62d6c98453144d82412036ea569753598ec8fbaa8ed542417271ccaadd877924481b98505d1f4c9d16e428bcb2ecbd2dd73c6c
SSDEEP

3072:7IvfIDTdx9X6GCphKa9d6eZm0iyiHk23BohkkVLIk5rA+4SoqhI/gbmijbOuEKKx:Wd6eZmv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2904	msedge.exe
2904	msedge.exe
1412	msedge.exe
1412	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1412 msedge.exe
1412 msedge.exe
1412 msedge.exe
1412 msedge.exe
1412 msedge.exe
1412 msedge.exe
1412 msedge.exe
1412 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1412 wrote to memory of 3480	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 3480	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1492	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2904	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2904	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 2576	1412	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\694cadaab6795b71c31db24f04daba5b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
2⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
2⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
2⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
2⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
2⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16994386795920374583,459234052402534691,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5676 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
24c29f7623eddc298a813e570d0c98aa

SHA1
baa8bfded01826c95231fedd7ad93621bb0f6c16

SHA256
4148b9bcf6c6bb61c8a2808406b14f54c46bbc890ff655e2c9ae453a7282911a

SHA512
8609cc8af4cc012a93c72bcb17a477ef47a41afc8b7fe3831f798d3f5dd473e017ca2f6dc059e74034896c81fc4c7a63dada0dc7a852d3c7ebf1ac39177ea5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
091241544895f2b470459382d670dc74

SHA1
153aeb4c2fe23f2e0b631e46933abe3d7e5fbe2c

SHA256
8f33e6929500d4b63836d8dcb44b65884ccd3a0e1e1aa313bb0813f89c0c2d9b

SHA512
a2b85a978fe65ecdb51dcb8b698e781065c1af5a67f0b63eb00c04c1c05dce3e9d93608e03086d87bdf44add5611e1ef98dda422781aeca41c23167a24be3fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec2481d9d8025ea0185027675f3bc859

SHA1
5f0cbf6abb8309265f8347396fd723e57451cc2c

SHA256
6d0f5b04037dc858bfe23a0b972456bd0d8887481c81ca04991c977064b2a22e

SHA512
8ed069e9810e01edfd52e60c9dc584fa5f9cdfb8fee75b6551fe9cefea61375ea917ca77212943e2f28524dcfcb54e0f73f611afd99bc3313d8f58e81c3678ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
507ef41494c582134754dfb74f3e21ad

SHA1
ebf0f0500b0dcb01f3e5dd4fb75c2481573d24b1

SHA256
6e68a5f6730e714da31e7b0fbe0b772ec9b3e8a4fbc91dc103ebc376c21cc4e3

SHA512
f84a5939cc2b61492429b6bc35f2745b7d480191e96d60bf3e5c2dee465789a46df95e162299b712e480e67717070b064a523c4c38c7efb75a39e39ce9d97790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85a7bb8871b4cd2212214f7a4f773dde

SHA1
4bba2dafe60de7546c24fd1552535894a8fca469

SHA256
25f648c6b9dffaf27171beb8a8474fbebb56414323ed41f6cf57ba2ece514f07

SHA512
7e68d822c48a3520786e88916bfec94568feec7c67d7eb109700f18603b5c2b7f582fc4d327bacb8d91d862b1104bc4753ac5336938c9f577b60a15cf0c4b8b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05193e7c9ab9c452cf633779c37e4106

SHA1
aeb6dfca21a191aeaba95548a17f459fd852f129

SHA256
0c29f4f7c156e7a53651043d73dbbc40af404057e679533b6bc2d487a2937f54

SHA512
5341bb3770a553c8c9781e1e05c231689232af99198946f75a849c6bfe60574dd9152ac9cf6ed127b4b32fd01492b8cadf6888e56910319dd628973e12d77363

Download Submit
\??\pipe\LOCAL\crashpad_1412_VCMMINLRKHEPXYFO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit