hxxp://gandcrabmfe6mnef[.]onion/8b9c14fe8b0c1d15

Resubmissions

12-03-2024 10:08

240312-l6fbysgc74 8

06-03-2024 15:27

240306-sv2t5scb5x 1

11-05-2021 18:11

210511-h2atgnftpe 1

Analysis

max time kernel
1800s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3012	msedge.exe
3012	msedge.exe
3236	msedge.exe
3236	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3236 msedge.exe
3236 msedge.exe
3236 msedge.exe
3236 msedge.exe
3236 msedge.exe
3236 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4556 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4556	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3236 wrote to memory of 2308	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 2308	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4912	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 3012	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 3012	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe
PID 3236 wrote to memory of 4328	3236	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98d8746f8,0x7ff98d874708,0x7ff98d874718
2⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,16598050128816590002,17434439348343810801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5320 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:6132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Filesize
16KB

MD5
33cf1631cd4e57d98f1093a1cd4c8ca9

SHA1
c74d989e8d9297ba46756767f7b367d1990f4101

SHA256
1f7a677fb7f5aae6f7665f6cf539507f777961d039f611c63afeaf17a6a82226

SHA512
d175cd3bfc58657d87603a0ed403af880a28440a1f1c304da7ffba115d5516851a39ca293717c5eaa26d74c918f44b2d8200983b3659d8c8fae010c77a35c094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
fc86fb8b617e35e9d799dbbc276f336d

SHA1
3feea1164f0540f38b437ea14bb25a3745aa622b

SHA256
9d1e0ad9217e0a5779e06d4a14620d99fb538f32f05cb9a2fbf1d7fc64e22c3a

SHA512
d9a4915eacd3061fbf27a3c0f6cc0cbc8280e8afb8923a1f09ea9999dbd5dc2a72dd02e1506c606ac15e64017ecc168f0d0a1a5ef54d88e0121e2904be1dde78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0ae3fbc8d987ab04fbbc9757a170781b

SHA1
4430b21988de8a3a9d453f186ed43c83385da724

SHA256
613152d8d0fd01c59c39f4bb2099ecee1fd9b7c2fa805d7a9c8258a95e311bcd

SHA512
ded1dfeffcecc9c016bdee5870be661093792fa333c080693a8f583838abff126b6d325e132429d25093ea041e66b96b4d3d24cddc12437757cbb875b8ff7097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5c5a0033421ee4a222c90257c0e7b8b4

SHA1
1f54cf1c94e4a340a5be49ae1e7b9348a0351f30

SHA256
f3c9c2a4044338a3e5b1f6a27aa09a91999391f4d3052e0a80e8ba25af96740f

SHA512
3f8cba8cbea56ba5bbca0bfeed65385526958711538bde2069b7d505a8231faaa5ccf57ae66d9a18ea7225a395e29096fac282c67271006938893a27f0a7c999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8418049ddddfdc25cf735dedf6aca7dd

SHA1
43acaca057ab917d5a3971c2e40448c9f8149d1e

SHA256
f8a8001c68a8fa2a05c0d5cd4e2a3e57f6c39c818928dde0f7b939dc8d370d6d

SHA512
35f67a44ff1f2c9424c245688a41380f455d1955cb053d098c33eddfc94d9fbbc292bc5bc23369de2269d802cf8d906168a3151200481f52c5d765e862444996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9cc05c27cd593f56620aee78d76071c8

SHA1
0597f78909d3a7a1d23f7b366209a30134783911

SHA256
2a69af73cc155f98b50bd3636cbdb7186cf6a949d3fe0327c5f9239d0f403afd

SHA512
fa137dee18c14fb8fbb71a622012bf38d436705230a959817ac07e978f7dec5aa6f01c0a841444ad9c3bce027bbc5ee4befc2b5c5c6e7753e5c7729ab64d2838

Download Submit
\??\pipe\LOCAL\crashpad_3236_EDZEMLVNXUJKIHGQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4556-155-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-161-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-152-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-153-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-154-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-135-0x000001AEFF640000-0x000001AEFF650000-memory.dmp

Filesize
64KB

Download
memory/4556-156-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-157-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-158-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-159-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-160-0x000001AEFFC50000-0x000001AEFFC51000-memory.dmp

Filesize
4KB

Download
memory/4556-151-0x000001AEFFC20000-0x000001AEFFC21000-memory.dmp

Filesize
4KB

Download
memory/4556-162-0x000001AEFF870000-0x000001AEFF871000-memory.dmp

Filesize
4KB

Download
memory/4556-163-0x000001AEFF860000-0x000001AEFF861000-memory.dmp

Filesize
4KB

Download
memory/4556-165-0x000001AEFF870000-0x000001AEFF871000-memory.dmp

Filesize
4KB

Download
memory/4556-168-0x000001AEFF860000-0x000001AEFF861000-memory.dmp

Filesize
4KB

Download
memory/4556-171-0x000001AEFF7A0000-0x000001AEFF7A1000-memory.dmp

Filesize
4KB

Download
memory/4556-119-0x000001AEFF540000-0x000001AEFF550000-memory.dmp

Filesize
64KB

Download
memory/4556-183-0x000001AEFF9A0000-0x000001AEFF9A1000-memory.dmp

Filesize
4KB

Download
memory/4556-185-0x000001AEFF9B0000-0x000001AEFF9B1000-memory.dmp

Filesize
4KB

Download
memory/4556-186-0x000001AEFF9B0000-0x000001AEFF9B1000-memory.dmp

Filesize
4KB

Download
memory/4556-187-0x000001AEFFAC0000-0x000001AEFFAC1000-memory.dmp

Filesize
4KB

Download