0f0050f1bdd1a416268c407cae4fdf7c3d4dd322c873cad4473da582f498e847

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63fd4990b2f9bed952ac5af1f05f17d2_JaffaCakes118.html
Size

8KB
MD5

63fd4990b2f9bed952ac5af1f05f17d2
SHA1

a3f00d3837aa71064e5da589ecc8575b40f9e29f
SHA256

0f0050f1bdd1a416268c407cae4fdf7c3d4dd322c873cad4473da582f498e847
SHA512

5dea3356e76cece2710ead6d2384f90bd39974560fd5e652c49afade100dd4447882c04e3625494735a66825ad65ae12c6f2548075d7a229a5d1b528f9ca0704
SSDEEP

192:99Rg7h3/7phLNCAWSJoHoC4EP8tr6LEuEnCht0VDcfc/tS+CXzmB1HMmKF+R:mjpdN5D2HNu6LEXnKt0Bt/tHLMmS+R

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3324	msedge.exe
3324	msedge.exe
4908	msedge.exe
4908	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4908 msedge.exe
4908 msedge.exe
4908 msedge.exe
4908 msedge.exe
4908 msedge.exe
4908 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4908 wrote to memory of 4204	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4204	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3284	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3324	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 3324	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe
PID 4908 wrote to memory of 4412	4908	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63fd4990b2f9bed952ac5af1f05f17d2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaf3846f8,0x7ffbaf384708,0x7ffbaf384718
2⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
2⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
2⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
2⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
2⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9355959678115100482,10423889584657522059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25dea1d2-1404-478f-9176-b805f0f5a11d.tmp

Filesize
6KB

MD5
dd3f13deb1d08993d232b1c19eee159f

SHA1
ee41b027884b72a125c0ccd79283051e5c703c0d

SHA256
6b97c4a08016affcefde86de36ffa86b3f501f0059348937f30cb4fe5c487dd1

SHA512
4ac3b0b6c2c12ad1935f8a4457c1f02f8626e1cd33b4c4944dde0f0259a1c8a345653420903c88563821d221e264322bbd3f5715e427e14cd03ac685bd638baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
703B

MD5
3217eb4419791551c7b73f3f1f46eb9c

SHA1
d81449a800fddcd191cf95d8b6930330dec43b74

SHA256
539e5bc7a642bdeaa98e81d3432d6160c7261d7edde67839d894a55ee934bde3

SHA512
a5a98ea049ee96991d87982259d5698b33da24301a44f42294efd2519c8417f7b6437c7c78143cde57f446db5f3d546b829e2fa2b43a0edfa837ae392341e668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
095b7c2345452efd6010d0dbfd63097f

SHA1
963c03c1502c645457766dba4ba00fe24ba1048b

SHA256
5a4cf6bf149a0fa683cbc7cfdec567b79384dd95c577a3d2f31258a306125239

SHA512
515a02c8fd06ecc55d21da223d7b07d83fc6798d546bfd0ae590a91b79d647e8578a420a6a2511163b74bfbfda3df3d272c00b24a274dd7bf6ba45f976c5bf85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5169652643aee603cd7b70e54d96bfd

SHA1
cb7a45f8905efb81dc5d76192f9e049ec19137f0

SHA256
922c617b26de4a6cc7875bbba701d7dca80e6a6adfeea696690c5e209b272ec1

SHA512
0e8765881533b6f05d304efee57810ad3b103624e613eded4c1438d590ee276c1a35808e7e1287890c21207592a316ac2b20b81813edd4c7b04b0ed5926c9af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
6461dea771a66546f3933711ef2eca73

SHA1
d6d0f7fbb1940828b9ee35d64b47d31a23303888

SHA256
c68f14ce83930f22119e3ac05398e7e704d14d0c6d423b1a563e448fdbef54b3

SHA512
6effba51293d2a65cf3d1ee412d4b4758ce862ca765e9a69cb571ebaff686a921eea42de10f2e9fb402f1be4c342a17f87650082f4a90b450a85ab0a4bd773bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
9ab6534b677d521799f44ebe8a8c67a4

SHA1
42f796f0314e72cbced3f781e3eab138d67dc7d2

SHA256
51f737133fc1ee51cc3f0fc1d2aa953fffba2d67e960d3c0313b7141f786f199

SHA512
e80a4bcdec15309d6bfb05f1c23746e1698839fd781432bbc92b44017f11be57b6ebcb12d4ce9ab9410207485f0a95b4dae9c7287df0d2707cf8aa06f32b19b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb6e.TMP

Filesize
372B

MD5
5a635bea6ab95cc1066700b5f564ed29

SHA1
18ebda11f9c942d7070855cc3b998016a49d02da

SHA256
5a20b74ab66ae43fbc11c3a5abb37bf66e9bba73ee34f976af3b9231690dfaf3

SHA512
18b494362cf1cfa695d626f7b39fd2f9ee00abcb5d3f819068da9b280ad8d52fd70bf82a11d679e93a534c7026a9ac61306a4c5be6100f399494f4f120fc08fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02f1d166eabf1fc527b8bccce865ad0e

SHA1
7c6beb232bc4fc81099f54f4cb3a41d44137bdd4

SHA256
d39e66c4731b0267a2eb8ea5c5b51f530d21514ca2d2d38203ab2eb94ea7a389

SHA512
33508fda853b1f73ff751173edb1b3af2ea1683bfa2622701598d9698c9f13e03017a36e6bd66f7be43034bf25ccc3b84eeaf73acc17b359597dd4ec2065ecbf

Download Submit
\??\pipe\LOCAL\crashpad_4908_OIJXJQDZHCNMLVQX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit