b417aaa43bfa9e0a8031f79f415d80c589d5a86b01cf7b98922d57f5d504a7f3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b38a64f647cabaa60e436933ab9e6d_JaffaCakes118.html
Size

110KB
MD5

68b38a64f647cabaa60e436933ab9e6d
SHA1

9e1193fd757ae2a3b013896979fbdb1fe489cc51
SHA256

b417aaa43bfa9e0a8031f79f415d80c589d5a86b01cf7b98922d57f5d504a7f3
SHA512

88a2fb4ac2c29b9eda6a823089dd876ba54db80f4671ff4c310187f8f4e29e367eebd0295037a86e7af021f7e883ee7e77c186933976eccea4bd4500a2c12905
SSDEEP

1536:xdk5/aZ6C17T+MvLwFVhx95c7otalq3Y9jk0DLlRvdC1:xW1QcFVhx95c7ota3q0DJRvdy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3544	msedge.exe
3544	msedge.exe
4628	msedge.exe
4628	msedge.exe
2648	identity_helper.exe
2648	identity_helper.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4628 msedge.exe
4628 msedge.exe
4628 msedge.exe
4628 msedge.exe
4628 msedge.exe
4628 msedge.exe
4628 msedge.exe
4628 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4628 wrote to memory of 1232	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1232	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 4204	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 3544	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 3544	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe
PID 4628 wrote to memory of 1520	4628	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68b38a64f647cabaa60e436933ab9e6d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12546116052857810689,1970068341140512061,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
87f55934e388a30e4b008e9871935c5e

SHA1
5a252e3ca70a46321eef1c1f8e266915efc7fe43

SHA256
1dccd782fff36fd046e7b59ab6b5664c381b98e84a9063c93b3644a127680c0c

SHA512
21f268e08b63088abd0fe00a8ff711ed78febfbfacac93845f9f2d9e568ee7c29c5621c7056b63d659bb7913858d6b44e23930691200d20647d286a1d2a56011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f510c3a3a2b52201eaf36cc189d636ac

SHA1
1ab9c8e32d8a8638687752394dc7bc02829308c8

SHA256
3439f0de2e0f48120da27b5c7b9e5c0e46799cc7451b6ea8d1b3e54ad8dd902e

SHA512
7ee2e73cda2084bd1526ec485b7f86c260e7fbe8806d4e7aebdbd7564ed640929021dbe7e60f86a897140c234a5329979562a24d5956102bfa38289992b30dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
472a972fd070e90b3baaa4799d3ad343

SHA1
649ea2a34bbecdd1bbac140fe777300ee7c8abce

SHA256
4e9b5fd7f241deaa69d037b472659aa66a64bf479f51ada085592132ea04049e

SHA512
f07c4adbf13bfd054cc9207eea122c81e933281fa67caa497bf1fdef4893f907563ec5092b5c7c5ada018c2584c8259ba5268c544eee120ae1d5910a933502bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f111f5db394b8ca43948c25ac0ea3864

SHA1
4771b8f88062a57756278fd0f820d78abd6b5511

SHA256
097458e01cbef7b0149a629913dcfb58e8f4c0c43f716640955984fb9cf9192f

SHA512
c312fa5116c193db49c78e10a6e8a569efad60489496aa44747aaad1a7d8d5bdcd91c7a0949e84de89678350ed12103c2b1d91da2a02eb140e68db5d6f66c55c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d63b0918eb8f6f4c3e3808c27a42ab94

SHA1
97eb23232dc253fac4ca9f1549f677486e98fbaf

SHA256
3c1277391c321e2a9fef6cbdc91fc5e655460f0f61081b0704109362f87ea01a

SHA512
8a304e1ff4bb83eb2c3d385c1fbfeaa99f6287f254211c803b8d53da23f283316c638c6a996fe36bab004e0c604be0b08bd3dc39caf15e3b594774530250ad5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dec8b78f3b73e3b3de07f845c420a338

SHA1
edb966aab2ab67e0b306d7dee8adf1d8abb496a8

SHA256
4c01077b1b0bbf5e3842b0200b4e0d367aa9799ed4ae9c96ee0c23dd35b9a0c9

SHA512
b65a09c45c7fa2681b6346258c07a9877d69d2321b836a8ff5a6691fedc84ffd93c01cec8417d7f4afea8a8a37f493b2a3cdc1d1bafe6886525706c391e04660

Download Submit
\??\pipe\LOCAL\crashpad_4628_MBKCPXZJHSCAGXPU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit