hxxps://pub-386574dc51114476911e60d1ef1a2e6f[.]r2[.]dev/CHAMELEO[.]html#jsaxton@balconesresources[.]com

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-386574dc51114476911e60d1ef1a2e6f.r2.dev/CHAMELEO.html#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1512	msedge.exe
1512	msedge.exe
2468	msedge.exe
2468	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2468 msedge.exe
2468 msedge.exe
2468 msedge.exe
2468 msedge.exe
2468 msedge.exe
2468 msedge.exe
2468 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2468 wrote to memory of 1480	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 1480	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4648	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 1512	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 1512	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe
PID 2468 wrote to memory of 4280	2468	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-386574dc51114476911e60d1ef1a2e6f.r2.dev/CHAMELEO.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7bf346f8,0x7ffa7bf34708,0x7ffa7bf34718
2⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2364 /prefetch:2
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
2⤵
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
2⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
2⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5864 /prefetch:8
2⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2360,8147018021348232263,16797897462316790729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
a71ef95ebfa029d20d0513f14c110d23

SHA1
90874f34b420dfbf9a27c64bb55fd3fdfe31cee5

SHA256
d41af834193902c7b09916e73c93dc5b8455bdb2821339a3b6f83a68cfd688d4

SHA512
3171c44002b10a9fd0896e0c50aba30247c2e700ac1d0e3d8fa577235e92ae9c74a51e89d1be0ccfc648b63f520cfa5fc38f006644246f6747bc7c58b5746d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9f0dc5d178a830146abf09091e7f5f0a

SHA1
cd0482fae0a60aa88468c250987ec2e841e1ae34

SHA256
bc65fcad5fad17824a52264340b1cc872806fb75bd0dec8eda130fb97679d5a5

SHA512
775314c47169144767b10e26edc22a5bf09a72329d2e7d84ae1ed2a8ffb835f693009772473911b72959ddf6d69d06a134a587df4b08ba9d5ebdbff0480664b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59c50994a8297b3cab4c96ed794ded6a

SHA1
42c6e6dfc220f9f2a1c747901f3bbd74b57d8b1d

SHA256
71a75384ebd8a69ab37d86de137000f76843d7ee28cfe51b49cc21aed8dd2191

SHA512
4ca72dfd856b366e77f57ef251e947ef03240d66af0d21a3256ae564470ff2ee531f15a5c02c9f32f4454786771a717887bb838a01e4b7d725131cae4a9d9227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fc9531234c2b613e0ef4e6620be2b83

SHA1
ec32f87cb0b0300791275873cdd1ecf89aa7b7e6

SHA256
438b2a2cc8f9e7d3102e1132a8c8eccf09ca6a89b826a3cb24f432f296f62ce9

SHA512
60bc448b745af7ebbb48123ca88db9159ab7bfcb3f4dddc68635140bc1d80b3b946d5e04e370a55f5146c71cd56fb6ffa7f86e9b525ceebbda248641a6ae2a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebca63701b4c44514a36e16350ed3e35

SHA1
ac912dfb65c0c8f8da1ad513c66483e2d8dbd87d

SHA256
c83595e0664a53222b5643a70e3fa335cc30b2979a52ac75c0d4e0022884189c

SHA512
c51dd1cae056d37b354e1b2c4bfd4a724aa503712ec025af4995788fa5fb267c05afda9c8eccb0b0bbcdefe342552d5a65e111af33eedf288037ce53574d76ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
838040315c257ee60f1ec0865378b26c

SHA1
6c44dec447582b82f5ba86771e32574b0b5b664d

SHA256
d733249abf4b13d5f234554a8481832be2fc3647d323dcfc3a9c02681ca41ae8

SHA512
05ca22245b67d2d844ff556e8d631bcc6bf591b8d24ab8b146cccb7585154562c7520c59050fab611ff11704740e7c0c38d210a0d81ce44eab20982ca2021c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f58c24ac6b2bd76b06014f38b6988ff

SHA1
6d63e301832dfec919b837edeedef9485e420244

SHA256
1e7115d3dd85dbcdb0f87d1105edd22f42c6613811aa556897a526f058fd54a3

SHA512
78aaed5b1247e70e48e2c2c5444b3b5126b49fffae2d64e497400bb2a90ecec7fab5768c35b08c9b8404e4576710824af238404f165cc010bfb2477ced4e91cd

Download Submit
\??\pipe\LOCAL\crashpad_2468_VZCRKCUXFRSDZNBO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit