77358eaf8e4f121a284aa0f68c917ef0669b0fb7075d006c907acc4b80788aea

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7483fb05a990bfa1188aa7295e655abf_JaffaCakes118.html
Size

289KB
MD5

7483fb05a990bfa1188aa7295e655abf
SHA1

91481bbd0711c79bab401bbd9d224e0a0ca04d5c
SHA256

77358eaf8e4f121a284aa0f68c917ef0669b0fb7075d006c907acc4b80788aea
SHA512

095eca43700e8596b4471df41ee094d42d7ec4f4045cfeaa74cd39df73358026dea044f6dc798870a9145e149dd581c8efee97135b4d25c84ea8b0b843d73ae0
SSDEEP

3072:rEm2tkgfVv3taMU3yOM3DuqHdD0bUwHmE4U+htm6:rERp3taLT6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2908	msedge.exe
2908	msedge.exe
2160	msedge.exe
2160	msedge.exe
4032	identity_helper.exe
4032	identity_helper.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2160 msedge.exe
2160 msedge.exe
2160 msedge.exe
2160 msedge.exe
2160 msedge.exe
2160 msedge.exe
2160 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2160 wrote to memory of 1176	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 1176	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 4760	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 2908	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 2908	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe
PID 2160 wrote to memory of 3560	2160	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7483fb05a990bfa1188aa7295e655abf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde42446f8,0x7ffde4244708,0x7ffde4244718
2⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
2⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
2⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
2⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
2⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,2739357236677493518,11571221175307821789,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4000 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
decf814022a29b61c0b9f4f2f01a2011

SHA1
132c39ff7fb7daade92c6780461bbe41de6b505c

SHA256
83138389812d9756b8defe778fc56244406c5cf42c62fd1a031abe8dfbdb472f

SHA512
ee10ec6b630381f94850aeaed3b9026d63bf17542cbce651b967e64e49906618afcb9dc3b7cf66dfa807f44cfcee920f4653a7e0f4063168bf1dbe90399c5c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4d0f49c6ff2ae1ed930026ab68774fe1

SHA1
b6e216ff98341937ce46a475f3174d5eacfb9e91

SHA256
a32afcabb7ff9a76b813a824b996cd03df9041ad6f698b19887e0ab2a48aa830

SHA512
e24950a9b5f830c86b5e45549f45dc79cef976ea94d42af3ef307e0e9b01c07c4ce23cd416c64bf957f18fe6dee12e290f1bb1659b889818335593f5afdd597d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c52b5ab9e9b63e9621760d8920cd14f5

SHA1
e0034a2e95eda42a9e2bea62f87122ec8b9e0db5

SHA256
32167b1609d48f8cbb718e0333d4e6113c74ce618372b23bdf15f83fa40a0015

SHA512
eb2875abac50d58d0a0a7cadc27a7794f8f739a4c3ba15ee0dacc53ca2e826013f43e6b4703ad01e136631ed3db46242c7ac639cd2523a36067b7b9690dfd68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7f9dcd94e153dde32a6d99f7188c4c87

SHA1
213075b8c735abd86b75709b59c3aedbfb40022f

SHA256
c889fa53680c73611077d24c46bfb032207bf9a412da44ba3830d5656e2dcc58

SHA512
e0c59a6dd03e6bb93cffcb608879e78d2bbcf5803340b2d5484331557e91e91bce6f36543320457459b2353449180fb47017f267bbac5939dc14354c0857b022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
a886aaa4880cd5d15b22ebb2d64dfa7f

SHA1
0aea251187bd9f9d2a90c4597fc40896e97096ff

SHA256
6e5b1e92ddbb18214f43a74e269a5010cec4812bfbf4cc942e1d9bb38d363e01

SHA512
efca007c2391e8d95eb897f13ba9f2323de0d9550071fa40dd71c496a9e81de8f3d143393335120ebc86c4274fc50e04baa625b222fce519f77cc8617dc9ffa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
095d4faa9a0085f112d63b300a6ad6cd

SHA1
01cc38251dda73d6a52ba03e3eb6418b250dd432

SHA256
1a4245d4c1aad60cad03865d5c775f91411911376820f6c691d19c5e2ff942ef

SHA512
980de97d85374849ef8cca1b7a05c686aac2855ad5d1d2160a6d4d00c0610a94e885ab9ce47277bc41cd53f233e6a81a9eef1a2046339795fa217e6e0d205490

Download Submit
\??\pipe\LOCAL\crashpad_2160_FPOMUCXLSKWNUYMT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit