7a311dd1a74b1e7fcc07d439ed0681cc4666802cd6b9d49efdae5c434b799021

Analysis

max time kernel
34s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Octane_Injector.exe
Size

704KB
MD5

5ee0fa66487080e85cde7ca26e09790d
SHA1

0724e0b4e49a1598ba38da914b113fef6649daf2
SHA256

7a311dd1a74b1e7fcc07d439ed0681cc4666802cd6b9d49efdae5c434b799021
SHA512

27c7bbb95f3f34354536cca03550b4fabb172b718184c1e55d98d7847a96d528d362143eb6fc042df8b7e7e9aae199652fb5dd5398b879b515e366339345bb02
SSDEEP

12288:qH/YJGsdbZ5CfW7wg79ro20/9toNc1jWYWhCIwLph0lhSMXlizNocCKbYVk:qf8bZHwI9ctFtoNc1jWYWhCIyh0lhSMa

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

16 discord.com
17 discord.com
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
16	discord.com
17	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{11C8DDBF-3490-4CD1-BFED-346F732C3DA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

868 msedge.exe
868 msedge.exe
5068 msedge.exe
5068 msedge.exe
2596 msedge.exe
2596 msedge.exe
932 identity_helper.exe
932 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe

pid	process
868	msedge.exe
868	msedge.exe
5068	msedge.exe
5068	msedge.exe
2596	msedge.exe
2596	msedge.exe
932	identity_helper.exe
932	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Octane_Injector.execmd.exemsedge.exe

description	pid	process	target process
PID 1148 wrote to memory of 1728	1148	Octane_Injector.exe	cmd.exe
PID 1148 wrote to memory of 1728	1148	Octane_Injector.exe	cmd.exe
PID 1728 wrote to memory of 5068	1728	cmd.exe	msedge.exe
PID 1728 wrote to memory of 5068	1728	cmd.exe	msedge.exe
PID 5068 wrote to memory of 2072	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2072	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 448	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 868	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 868	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 216	5068	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Octane_Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Octane_Injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://octane.lol/discord
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://octane.lol/discord
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc66c46f8,0x7ffcc66c4708,0x7ffcc66c4718
4⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
4⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
4⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
4⤵
PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
4⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
4⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4168 /prefetch:8
4⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4944 /prefetch:8
4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
4⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
4⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
4⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
4⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18338376680771687187,13345732689604589476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
4⤵
PID:1812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
bcc20a6bb9a08612fcac36369f90cb42

SHA1
f280d2631c799fb841e465b2d2d7f05262b2c64d

SHA256
606fad4971de1bc98c0d4f5a1b9c8d4bc1bbcb4ca1252cb0116a8281875408df

SHA512
2d8561cd59125a5858e8a81b7cfdbb59f19929efccb666ba92923d150c3b0610c5f7e978a8602b258c95e8b9e5a5207e067c4881f66e334e9f74e843a014c742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
391B

MD5
292e9fa1d873135d897fc11b4a6ee010

SHA1
fa9b66825fbbb28c713b7158ca5ffb9d4d8d3be2

SHA256
4132caa92a1257f4081581b8e6ac57786e08fb4aa8ef03d55c800ad61d3db96e

SHA512
0da2e7e45ffb22bcd2d61919a384f5a056907f8b1a4f1ef0eb19c180db44af94efc580d4401f595f1607666d9722e7d524f6d85492c2e32c4c45931a1f2646bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8203a82f1a27459c0864008c5e4da9fb

SHA1
538010874de5646a5a7d16c3fc322d16a89d89f8

SHA256
5f2531d795b15e570661b1efe6982cfcae60b1fe1eeb71340e1a966cc2dcf69e

SHA512
653fef2740b6179a8ae412be662bc659a6f12bc8b36be2a1c4776cd242715ff1ff32d928455cdc585303dc27a25dbc6012953f1191cd636457bd274e300584be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5dea3796a8eff8f567e26956ff279d3d

SHA1
57f8f1bb8945cb822e074f6207bf36b547258238

SHA256
425ff4a9a9c8e15d577ebaa06ea25f11501cbd1940c5283f13f31bafd527571d

SHA512
bd993d4c00534742a24b8a33f5977657215bdc7030573fb563997d2c67172d4dab8eb7ff07b9aa1300e3377995edf1960f15505fe5766edae12da408ef0c85a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
aa0c6cef9c2bda4eac0fc7cd98a5f7c7

SHA1
a786f09827bae7ad493589ad63dfba029c6d911f

SHA256
2b592e8bdc0dade94bbbd652c2efe73a9781eb8d91534e93c628a57e5ba4c6f9

SHA512
40f9ce4c1a8091d57f021b6f5052ab0fe0cbe3d832154f57555c2cad762fee9e136ffa37723af77895d16230334e6358581aa0bf2b38521b92d630b15ea2ba48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
eb16c6d1ed9ef2a8cd6cfe1beeabe74f

SHA1
d435f5222639f0c3cf675ca53cbf4d02ef0db8d8

SHA256
d24b051e74c43dab3a11dc57826e37b3ff2d9246d797d32158bbf5a4fd4f2102

SHA512
e8f4f1e8338a307f8f909312a3a8620c270e4c568016391125e5a4b8b318130c8b2e9edadd4efbce43350e90431529bab0e82b92a58ec2f0dc2f7f76dbc9e651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
8192cfdfa02fd4b4613c60af2ba915af

SHA1
5e9d60bf5acd7228dfdd4e598fec4d855e8cc861

SHA256
b0821301053e6e6904d77538c6c24c4ade37b4a7438f03aac54536afdbae3832

SHA512
c61df8a5167bf1370e4cd827a3205a962f6c07b8c3fe7d81908a308fcee02f151c94f3230e8eea9554228bb133b9fec75d6b97e47facbb8829d36c1e1e3e14a9

Download Submit
\??\pipe\LOCAL\crashpad_5068_BBNHOCGOFXKQVSEL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit