64d5d27a592a66910904edd3652ee37bdb417dca979472da4f83280bbfbb6895

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3244b4c9c672fc16b4af591d2eed7544_JaffaCakes118.html
Size

17KB
MD5

3244b4c9c672fc16b4af591d2eed7544
SHA1

fd65a4a22640f808adb491d30fdafe4ac0e8f021
SHA256

64d5d27a592a66910904edd3652ee37bdb417dca979472da4f83280bbfbb6895
SHA512

4a994462ffa04249a628c8e5a4ae9aa5fec529edfa61b6bbde0b9de846c3b6586c41b43e26d9ffdb51fb21f638152c6a5bcea8d2b5843c0cbfdd74b63827372e
SSDEEP

384:SIHwk6z88Wz6OrVFFUjBQVxkHudBGVlDDYC/YjX:SWyz8806OXX

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 45 IoCs

phishing motw

Processes:

flow	ioc
49	https://hi98.cc/gg.html
50	https://hi98.cc/gg.html
65	https://hi98.cc/gg.html
69	https://hi98.cc/gg.html
19	https://hi98.cc/gg.html
48	https://hi98.cc/gg.html
56	https://hi98.cc/gg.html
64	https://hi98.cc/gg.html
53	https://hi98.cc/gg.html
67	https://hi98.cc/gg.html
71	https://hi98.cc/gg.html
42	https://hi98.cc/gg.html
32	https://hi98.cc/gg.html
39	https://hi98.cc/gg.html
47	https://hi98.cc/gg.html
21	https://hi98.cc/gg.html
36	https://hi98.cc/gg.html
41	https://hi98.cc/gg.html
16	https://hi98.cc/gg.html
55	https://hi98.cc/gg.html
66	https://hi98.cc/gg.html
70	https://hi98.cc/gg.html
14	https://hi98.cc/gg.html
30	https://hi98.cc/gg.html
31	https://hi98.cc/gg.html
46	https://hi98.cc/gg.html
57	https://hi98.cc/gg.html
17	https://hi98.cc/gg.html
33	https://hi98.cc/gg.html
40	https://hi98.cc/gg.html
29	https://hi98.cc/gg.html
54	https://hi98.cc/gg.html
63	https://hi98.cc/gg.html
44	https://hi98.cc/gg.html
18	https://hi98.cc/gg.html
20	https://hi98.cc/gg.html
52	https://hi98.cc/gg.html
28	https://hi98.cc/gg.html
22	https://hi98.cc/gg.html
43	https://hi98.cc/gg.html
51	https://hi98.cc/gg.html
15	https://hi98.cc/gg.html
62	https://hi98.cc/gg.html
68	https://hi98.cc/gg.html
34	https://hi98.cc/gg.html

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1788	msedge.exe
1788	msedge.exe
2896	msedge.exe
2896	msedge.exe
3440	identity_helper.exe
3440	identity_helper.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2896 msedge.exe
2896 msedge.exe
2896 msedge.exe
2896 msedge.exe
2896 msedge.exe
2896 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2896 wrote to memory of 736	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 736	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 4880	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 1788	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 1788	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe
PID 2896 wrote to memory of 3324	2896	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3244b4c9c672fc16b4af591d2eed7544_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9da146f8,0x7ffb9da14708,0x7ffb9da14718
2⤵
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
2⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
2⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
2⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
2⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
2⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
979f5067a5abf72d85418f4446c910fd

SHA1
29381f33e4709fbff6355e62f6079d24189bd951

SHA256
961af11726f0e3d1c9584cfc9f49fc24a16b2d1c99326f354cfa3c58a61a13b4

SHA512
74738284f9ec3b73521f49691a162ea3ec04449055df65f3e95cce0d5684bef14183b521badc998f8083d546a654b355c9be82a978f0208dd69d7884a1224941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c4c756299ea959a7c7c8c8707fd1e3e8

SHA1
a54428a8d4f5863d49f6c86129022d5bb6db5ff5

SHA256
b80810a9f6051dce43ce7b4ba3173b2748810ce3dfbe1a20c964e6dcf4e842cd

SHA512
e93a826cb7ee7c74f49c33cc41b38f0d9de16255794328c1e722ee16ef58d697bf200279196f34ab94c269f5430a4facd1078f9b5fe98c58f5f231ca60c55491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7077fa62637663783f4c212cb611eba9

SHA1
1f3a63f046488c6288d0b30f2f7df99c8bcae9ec

SHA256
e7c65b4cbb8a3b75b2d56da9855e8f22cac48589386c6e38f0051ce5805269c6

SHA512
ec78b0ed438c8ed5621f6534abf850bd7b1f674747865feff8a6c1e3a2b34b151e6f30625e0c0681109d2bd72fea66baa69d17f3f9ee66969c2f012cdf527ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
13cc1878d4582fc839183c1cca3486ef

SHA1
413080a6b816e65539899bbda34e8144de37aa7b

SHA256
e1122c10107d05051aaafe292324f59ce4ab6c9f8debc03327249f447719267d

SHA512
03eaa2e1f81c8fd48d56e11e15df8fb6b3b9ecc1d5118358d217b0e3c9218bba90f73fef48db33b275cbfd84f5328b09012611bb98d80c2b6ff9f31defd092b7

Download Submit
\??\pipe\LOCAL\crashpad_2896_CWXERINBZVIFQMQB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit