6a03171000dbcf2d43e9ca344f6a9bd2a821326c69d61d912e2fbd7653d637a1

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c788c614c320c4f4fcbb945bd7e2d8_JaffaCakes118.html
Size

51KB
MD5

03c788c614c320c4f4fcbb945bd7e2d8
SHA1

a03715492d0e21fd55a2ca6f703532307694a6fb
SHA256

6a03171000dbcf2d43e9ca344f6a9bd2a821326c69d61d912e2fbd7653d637a1
SHA512

9b6db466a90f673da3531f36a6e8567e34c8da5a01153688c909157248b304552cfd59cf7bd3bc6a1aacef479604e38bce3b7b9e59acc8e97ce066fefeec4326
SSDEEP

1536:2f7ir0OxxfXqiEhqoAlhgoZokpO3/9ULL0KXyiZ:zrfPqiE2lhLpE9ULL0KXyiZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3596	msedge.exe
3596	msedge.exe
2340	msedge.exe
2340	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2340 msedge.exe
2340 msedge.exe
2340 msedge.exe
2340 msedge.exe
2340 msedge.exe
2340 msedge.exe
2340 msedge.exe
2340 msedge.exe
2340 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2340 wrote to memory of 3296	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3296	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3532	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3596	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 3596	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe
PID 2340 wrote to memory of 2992	2340	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c788c614c320c4f4fcbb945bd7e2d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a3e46f8,0x7ffe5a3e4708,0x7ffe5a3e4718
2⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:2
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
2⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
2⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
2⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
2⤵
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 /prefetch:8
2⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10355672905871561354,12107727877956609044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
0ce5999a8f2a236b3cf316283f32ab89

SHA1
bc21aa5164e4db91dbc534351c47e413ebaa0336

SHA256
00fedfa3ded5a4f857801f8f6778323f265227e71d972e8005680cd5950fb1f1

SHA512
f3dca5f9d8cac4d8dfab2353cdf3cc7209a20f6764e62d2bab98ddf52022f73e34c0935fdf16b91694eb19b6fea22f7ad3296fab13a7072c029cc83025eaaa9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1011B

MD5
412069daffa492904d6bbc5be6feff1f

SHA1
89b90b5256543ca2789a68858b20b6e947f49ac8

SHA256
b7ae70be1f755e35ae294ef9e249175dadb03d813234f2f05808b0d9d44800f8

SHA512
17816a23feab5715f07a1f1a986f7063aea18384f6b52cc2685dbacd84f5552488fbee06cc5955d43956f826b150a04feccb9775f7c56de2a0643fc275cded2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
07c189952a9ff921819d1b9edc93872a

SHA1
c35b93cac4e2805dc55f6d31c24ac6c3cc45c652

SHA256
82eacfda333540e21ba005043203496b86dcba2c3ba21eabd884f920f570316d

SHA512
b5db38234f271ba9ca4c1344e3213c43a24cdf3e43637fb8eeb030a8d59240f6fdf00ab0434ef0fb7c32881d030fa9019d078774e1b49f53c0e373c0b20a11cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
621c1d396182425a93d6d96144c0b37a

SHA1
90e63790ac5413099ccfccb3af44a739e5c9a495

SHA256
db17268a0e358f2b121db88848ae30f797164209d30b1e5cd10ee4311b332e08

SHA512
4a4714930aece4a7089b7386d6286ed2c17d1d29190ef78e584d1fa6399f5907cb3a5054cbaa12d31b2e1c0b0f111f0ef891a18adba3202be61cab86db729ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8d678666d031ad459a7a436a89800689

SHA1
f4dc6b43a2fe803e6d65982066c1b26853ae3ea2

SHA256
e11880ccffc9aff60431468adf10eb01a7cf5da9fab19171ed8526baea567a05

SHA512
fced537fabdf813aaba29628523002b499e4a70b06d6e41551cdf4db03b9433d0d9e9daa9bf394c29a89cf1cbb10e7815d6c4bebe5f03a2a6ddb61114250f59e

Download Submit
\??\pipe\LOCAL\crashpad_2340_XXSYIPCNIXTVVSYB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit