7fb56d781403e7c2984314092d5132c7ba80585f02b14d78443370ee8749fb98

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84de2b56f37a029c60a2a19e8e22f852_JaffaCakes118.html
Size

71KB
MD5

84de2b56f37a029c60a2a19e8e22f852
SHA1

d779aef9710b514618c7eaf888aa7582f6eb24f0
SHA256

7fb56d781403e7c2984314092d5132c7ba80585f02b14d78443370ee8749fb98
SHA512

84ba8514bf4f5c27c43ad37ec343ec0d5f98df175e4dd095f2c1ada7baf4b39923db2656e75c6f8157dd5dd0c44dc980f2dfe0c00c437bf5368dfe0805b3bc8d
SSDEEP

768:SI0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/V3:S8Ik/mtnwO8abuc5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
556	msedge.exe
556	msedge.exe
3932	msedge.exe
3932	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe
3932 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3932 wrote to memory of 1060	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 1060	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2012	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 556	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 556	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe
PID 3932 wrote to memory of 2776	3932	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\84de2b56f37a029c60a2a19e8e22f852_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f81e46f8,0x7ff8f81e4708,0x7ff8f81e4718
2⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
2⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
2⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
2⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
2⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
2⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,12656341702646115281,4664447143737225781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\017c16d7-bc7d-4b5a-adb9-f28754f346a7.tmp

Filesize
401B

MD5
e7da6dfec6580bb8d730969fb7a3837d

SHA1
3288fbedbef0f04180b7162cb13517f346c04522

SHA256
50d65e52cae8f1aeb3dc125b743101f3eead6e88ac3d564d37ef98ebd01424a0

SHA512
04cb3a8ea666d6e1781e756d61229d9802d4bb0c65a16f4ccc2afe66cd5321463531b03b2a64c4c66e1081a8d0e9aa72a24e6309d6286aa2df5dfe73ef40324d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1070d7cca646d782ad65a5ba56be96a7

SHA1
e724b096103081b3f6e47642a05d97426cd76335

SHA256
6ff827a6c07edab79b1202b2494fe0ecb5bcb9c037894cc248edbdc450e5d954

SHA512
3687de8ff145fce44313c2d7ecf1ecd2c396963cf8aa469654322be1f67727fc2e192fc05bef6924523c61233d06193f640b57b6dbb71689875a45a65e7028ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5831eef21d5a953fd5de2c783281125

SHA1
c93ef9707b55667b82ebdc156fbb355aa1fe20ec

SHA256
2fbbe26f06a21536960f177de01d34e23ae7a39401e0ccee61223b93629c27f9

SHA512
a172c34bbdfc1e57cc7f62050a0cb24159f17a8fcbce4ad244fd2d5793f87c56bf91f880db4dc3a51378e25a2c1652a61ff4ff7040eeaac000643d61dc23f62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f9148bcb718fef1f9ec69903f4a818f

SHA1
f60a8d9f32f0ae2ad00d17f835ef65cd363e856c

SHA256
056e39971cdbbaf82226a31dd0e9e0a14e90f4aa7911191d17c25a63365e7bdb

SHA512
6246d8b8fd9b8a14e4b494c3b25f76084adb7b5c1408277e56b442443a814b1a29f0591a225feb23a68c9192377be62e176349393ad392b68a160ab6a9f607c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae8b37a7ce2a6c57b3abdf0e94526ebe

SHA1
55634d1f429fadc27d98a863898f78975e212984

SHA256
957156220a694e4ee2683a846996619a4b51e16edeec74caee03ba772328264c

SHA512
9db660b9e4334c3d54654b51bc36160a12f83ef684508ccb0aa0daa803eb0a5be5800dcf712d884a2615f539023108626db12a2faf6438a8736de87adf680d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
96a99595a0e00b85c0de6beaaace8100

SHA1
5b65f225c3b6fca24d23d71814dd581d9f6c05e1

SHA256
08a9c84d047bf9f540bad4bb845a37b35b6136d1b157a454ed7e46e11c868b5d

SHA512
75e35f8c2679be0d984eb7e6db1faa696b85994507bc97306107dbba7fea1d354cd306848100897477f2853a7c576e3fdd0b6d0527665d97baf039fe095d0ca2

Download Submit
\??\pipe\LOCAL\crashpad_3932_DYHXXXETKANUQNCS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit