992018f9f59f4ea68c887a65ee28e17d25c8ef9d4e9875f1f4e03b646cc5e0d5

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f0ca59ac21cb605e6239439c6e4638d_JaffaCakes118.html
Size

8KB
MD5

9f0ca59ac21cb605e6239439c6e4638d
SHA1

cf1c581ac8f00c6b83101e6cb1c421f98a293b86
SHA256

992018f9f59f4ea68c887a65ee28e17d25c8ef9d4e9875f1f4e03b646cc5e0d5
SHA512

560228fe817dfc93713b3f11be3046cb9459e343c8fb8bac67947d1377df71f31795d8d70bb59f976194cfc24418470eac6aee8729720dfe17de715eb098ae57
SSDEEP

192:q6AFr0Su5SoSM3B0YsoiAURXHj7hc7jHhSjLlj+jlxjt3iJoaf:QFr0Su5SoSM3fBi3RT7hgHh2Ld6vfm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4360	msedge.exe
4360	msedge.exe
3088	msedge.exe
3088	msedge.exe
1232	identity_helper.exe
1232	identity_helper.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3088 wrote to memory of 868	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 868	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4824	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4360	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4360	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2716	3088	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\9f0ca59ac21cb605e6239439c6e4638d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe814946f8,0x7ffe81494708,0x7ffe81494718
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2066829584307443319,4338433385211640221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b341e2b5ffea13d4d79b7d095c5139dc

SHA1
186e54ca4d3ff77cee82c35459ecc5f824bf8755

SHA256
e2a4507ed34f9e8f6675c457c754e2917ad5c8524e767b450dabd3cbb61ae381

SHA512
dd046a0d09c6d5347b09349c2cda7d4e11f12d92a43b3dfa33d30c2f106b009388785a5ddc48c2d30b1e60c92740245c862b7dd670fb824b01f8bced2b7ea49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
615B

MD5
4eead6f543a37a94b77425d328a10c49

SHA1
086490e1ebace175b9378fd817977af77220481a

SHA256
c8ef946b431e0e1a2bf9b1891ef36ba1ab727f28a1dfa9c202ed2984c0022f51

SHA512
d84b6248db62fea65447a13e20333fb46c200cc4d988a8acc3f2cc3c51c0c89f1147abba3e4595a63cb3fd6224b87bb2d1fe7c5295cbcf8bf5435f37d980a098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0abfe35b0b4cab942b33faae0e08391

SHA1
cae7c8114cbe6e6e4b6ab2f9f8967e9bd7eb69fa

SHA256
a1178910c385c7f55163858bd409449f9905fd27b72e65f6632f00d1068b19a3

SHA512
d9052ada462d6b5c9bdf15beb1c39e5871191a67fa2e92b9cfefbf644ac6079180fb668aee54d84dbcd161418578e626ba3c9373f9612fc11963f9c045c205fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f957cc64cc4f55af3d4af6cdfb6eade5

SHA1
b2df71072df4082c4a2462ed7eff5bb3714f9b8b

SHA256
13a46f19a00939d7d9111e1db9f21780ef982626bf85eeb41827fbc5314e3f67

SHA512
518abeb14dda4100fb45be27e7c2cb9d81f85075295c1bc51168a11132ef11b589bb2392a70246655d3509e13f143eb1230dee5dc4cee87ddc5924cccdfd81ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f04a44dc5bff65b78039d44f49660d40

SHA1
8e76f1433aa790eb6e55b2de06508a96f9288554

SHA256
8776705a325e479ed484a37b216477df1a334cc2a3a4bd0d3cc0faa7aff54b1f

SHA512
4ada28cd1b8a0231da8757c6edeb12a18e364845147397f4fe3e70c7ecb932a458a08a1e55fa19fcb39f1a1265f73b318f7040d1ebf6e277806e29d489b09809

Download Submit
\??\pipe\LOCAL\crashpad_3088_WNVZMHRTZGQHVVTE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit