a69c9db06710a9f282f5ff255d0814738d98caad2ae6d8ace70f95f0c2def369

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6959d557dca6d59b7d3e5efbb7af0b44_JaffaCakes118.html
Size

259KB
MD5

6959d557dca6d59b7d3e5efbb7af0b44
SHA1

a834de3a4c94a746fa7e7314e5dec9aaf691a193
SHA256

a69c9db06710a9f282f5ff255d0814738d98caad2ae6d8ace70f95f0c2def369
SHA512

7d2b7e47922c82451adba329ce0cf80d074c23187de8b5269e81d8fa43fe13404a63b18c9bffdc559e745382cab09cd6227f118f5f41ba8bc10a55d60d5b8033
SSDEEP

3072:vhg2oYXX2V/NnatAqsBMXSOjWvj32pJv4reEGNuVHgz+/UcOSfY27V3nv5:pg2fn2NnatfGZvj32n+VH9B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
5116	msedge.exe
5116	msedge.exe
184	msedge.exe
184	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
436	identity_helper.exe
436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid process

184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe
184 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 184 wrote to memory of 4040	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 4040	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2844	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 5116	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 5116	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe
PID 184 wrote to memory of 2672	184	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6959d557dca6d59b7d3e5efbb7af0b44_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
2⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
2⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,804347521952268243,16140297467501187862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
9c9a1fc14b741b80dd3c36a635ef0f80

SHA1
e6bf2fc73c343a7f85a566e5a2121d8e3a9fa8cd

SHA256
82c9080b5b306aadd60a2100f046f80b665208d270ea770fc9e6259c33dcb486

SHA512
c2aa82f54038114380ab48558f5ea2f9c53b37f75fb408503ae5439214e0bb19f8f2c5e081d2ac98f9668e90daf54bc4345afce7618a955d9bf7f9c0f1f9d942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ef3748619e47e57e77d54cf6edacb26a

SHA1
be821de225aac828ebf193852d7e60dd87958037

SHA256
1e7eaa3d1c283aff36c9f9e37df08dd2495dd06ab1c508db43a7e4c0f4b85471

SHA512
74608d94a33aa9569722c270c77fc4b6c2150bb0021eadd659281eccc59fdf48bfa89506aee8b9d9f3be31086f8f21d0d66adae9992d1d3316acdfba6addbc2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
be4e7a411904b26875dd6cf0ae90e5ee

SHA1
692fdd013de019fbf1322b66f330b78563655148

SHA256
ceab68a272eb2f32a208487fb9f5387a91702e8cb3aad6a2c50171362458074d

SHA512
0b2f424384c0dc37909f9e620b82bbe6987cfd7b4ecd5f07a8b10fb6c27e25d458be76bcee4329edaade1341ca7acfde5de7e4728c9d004dfeb8df5e6d76f0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a600397ef75ebb503369c14476db3881

SHA1
8602951c61dd175fb0bbdd351c4b07a820d68a2f

SHA256
157f624a62a8e09d2f922711b310c65cb4df22c620ca9c3a4fa475add9637ae6

SHA512
3f100e2c19d13ea9ca4f5c7bdaadbdbb72174c3ae0caffe34284511700f1030137c5339119b0e6bbcb43d983fa9ef92075fbdfd118be278041e8c4e48dd3c44f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7eb868fdf00fa5f1fbe7ac9fbb7ab285

SHA1
8d72297ea380e2e7684270d45b509b0d5dfd1813

SHA256
5bdfb07fd520a480e0dad7bdbe8a845749ce9f6eb14c20006df1b1aa3e739e39

SHA512
3b172c0830bbb5821f929de2881c58bde7878d8f7aebdbf7d2b177f2ed7151b5115c33d3958fb99d4c6a8f2a43ee4cd7cf7c8a11098b7fe4691fa3d7d8d95f23

Download Submit
\??\pipe\LOCAL\crashpad_184_IHKKJKISTGPDJUXA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit