darkcomet | 41d83459aad53dd5da4346d33bd8df6648f7da7a12a0ebc5f0e8aeb1bb4ebed9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe
Size

719KB
MD5

fc7cb881cce701a7aa0e66db5343a08b
SHA1

8aabd3472aadda2df50f491d8868924fbd02400b
SHA256

41d83459aad53dd5da4346d33bd8df6648f7da7a12a0ebc5f0e8aeb1bb4ebed9
SHA512

1d2ae10224e40d3fe1c5d5848afa91898b23b1dd8df104c689d911a10a899674d6cc7620c76c35113cf7de0db5fed31fe64934b74607289d6e6ec3f2f389e749
SSDEEP

12288:5ZwHOyR7qnrIP1coEheYLpv2vlUUSNIRLNvWuWPm6NT4ITMRRLjDlCjI:LT6KJgN+GNwmVRRDkM

Score

10^/10

darkcomet guest16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

rattenjunge.zapto.org:1604

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
4cjU6YoJ5VXp
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe"	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3348 set thread context of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
1824	msedge.exe
1824	msedge.exe
3112	msedge.exe
3112	msedge.exe
3708	identity_helper.exe
3708	identity_helper.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exemsedge.exe

description	pid	Process	procid_target
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3348 wrote to memory of 3112	3348	fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe	94
PID 3112 wrote to memory of 1512	3112	msedge.exe	97
PID 3112 wrote to memory of 1512	3112	msedge.exe	97
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 4888	3112	msedge.exe	98
PID 3112 wrote to memory of 1824	3112	msedge.exe	99
PID 3112 wrote to memory of 1824	3112	msedge.exe	99
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100
PID 3112 wrote to memory of 1212	3112	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc7cb881cce701a7aa0e66db5343a08b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96b4d46f8,0x7ff96b4d4708,0x7ff96b4d4718
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,12114815435419548156,16598825475965329098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5176 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42820dccccdf266d587a73688b8b968a

SHA1
073e93edd4fc54ef6c68f4d73c831c0d0704ca55

SHA256
fccd11bd956a9056c2f76249d7caa98a3d3d4ec70983458379ded0e11b89bc9e

SHA512
71a434efcfb68eebc6384760250db1cc2c00b5180d176037571e51fe3d7a5678652a5fa84994ed6e660cd8619fcc67900098d64f5a6b964e670021a6bdc3a47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d7befa7b00db288a02351b80d650439

SHA1
e9350e181a6c2b400872e844c3d3b34a3fa2ccc2

SHA256
f4423061f1251bcea63cf8b80bd8927ea6b22e2bc33a4347e6e06d37ae1be953

SHA512
fbb1a4966c872cef5ecc8d03ef03ee8685a56b14b9055454112ceb66946b807b4421b6a6b1503f742d01762d51a17505bd261a1289242316ef109b0e30bad89b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62b6a3d65ece69ea357f88168cfd04f7

SHA1
1189f8412cd1a98b2d191745c2fac9bb6cf967ff

SHA256
4dcdb742cd4fcc12da4060f6384cded605bc09654edb2823bacb972a63b239bf

SHA512
27989622c43648b175d35cdaca08a07ab4516481c4c8edf67cc33150cb360a9787b4a2f0a0680e0a124078160e73e195829b6c8494fb712531045c72535899e7

Download Submit
\??\pipe\LOCAL\crashpad_3112_VYOTSFFOALGKXDAT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3112-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download