1e14451084521a899f88a7370f1a51a36f97f7265ab1e6140c9b9f824c00bb5b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3661aab5b01318a3f1cd4bf43dbb89cd_JaffaCakes118.html
Size

57KB
MD5

3661aab5b01318a3f1cd4bf43dbb89cd
SHA1

3438aa3fda58e63d1a8ddd643c3df5a9ebfb9ab1
SHA256

1e14451084521a899f88a7370f1a51a36f97f7265ab1e6140c9b9f824c00bb5b
SHA512

25feaa8d75b2946d6baf0e1ebeefbac0c1b4f0fdaa52a1a23e5988ddcc90b9304d870d2c8cd84a1247c6616e050ad5fc2d0f7da0078d1956815d8e6deb1c8081
SSDEEP

1536:gQZBCCOd30IxCatcZfefgfPfffSf3fWfHfXf+fUfGfIfRfcf3f7fEfJf8fefafcv:gk2Z0IxSmo3XqPuP/mMeg5kPTsxE2yUv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2344	msedge.exe
2344	msedge.exe
440	msedge.exe
440	msedge.exe
2224	identity_helper.exe
2224	identity_helper.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 440 wrote to memory of 2408	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2408	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 864	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2344	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2344	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4760	440	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3661aab5b01318a3f1cd4bf43dbb89cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9549c46f8,0x7ff9549c4708,0x7ff9549c4718
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
2⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
2⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
2⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
2⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
2⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4644 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
20cb182f96e73d8b500c3c56acd455bd

SHA1
6c2428e516cdb39a2161da850e2f0e9aa49983f3

SHA256
3d5c84772d4a892dfffb07878e1ff6007dba633362e2f62bea52c8ca15921ea8

SHA512
916c02b5a635f3fb1dfb3dd398023acd0f0c3f99746f80ae7a6c9605a80d9a60060bec761a3562fec726586132280202e4042e7f39e8cd176483867fd1ec0d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e4e9b80ea986872228c6e2b81bbd44b4

SHA1
637a8877b410a314cf6de296779a09e5ead8e4ad

SHA256
29856080017c39e890636d025accbfb1d2599ea57df4942342b32e4fe86a9f5a

SHA512
84dc7ec4282cde2247115b7b09b0cad206ef3ccdda5c9b639d9629e80a4706213cc8cf53232a2d773038a6ae95c7be5714420dd08583e4cd259275c2638d590f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a603e8963631c7eb5b1f8c1f2c98cbc

SHA1
2c087666d8f1136d3a2ef5fd40690648f9c8de3f

SHA256
fa5f45947691fbf37622ea1345f7e521a1ed6499023acb61b67ca0d26f6bcda1

SHA512
1834bbfcc1935a17b72ed629c4398c1e0292e68eb04f46383ef5fe5d711d3c8165e09793fb88120abb336f8657bf609893988df42f8f98c075a59711945930f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20861459a4068b4992d1ccb2468de2c2

SHA1
861bd580425535c42da55a538e86dc482d544c1c

SHA256
8869824897cc14b9e2e2794e10632873e0fafa10f8960340ae1f60ed3e1452dc

SHA512
f83b675156e62cac7aeb1868f580f9cdbbe4e5156702ff411847397baf5549c05929e54ee8efebf1cf3d5d13caac6371b4928d297a7221e0e98a640f9ba7bbbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93f577bacef81edc6e9d0854a05f1785

SHA1
372ecfab1d255faae29f532a4372a38e773c6ce2

SHA256
dbae7d96dbcbee0aac0e16ca24bbc57cca24dea181a227ef8bf0788677855d62

SHA512
1d1f3afd8b70c012fe467eb44f8d2364ebfa24ed7066712797b9a573ee40766148bd268202326b68299600d39fa1534dbdb2dcf5ed7a070cc41fc14c6b6a99ad

Download Submit
\??\pipe\LOCAL\crashpad_440_HVMABBGEOGIKZJBY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit