5d4f286c7d2c89b0d8923c4c48556a78881b486ab1599856de056b20e1215309

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6912e62c6378d7e28ba6e416f9d22e81_JaffaCakes118.html
Size

76KB
MD5

6912e62c6378d7e28ba6e416f9d22e81
SHA1

240ee4c2c10177e6b721bf7648e99d4703f117a1
SHA256

5d4f286c7d2c89b0d8923c4c48556a78881b486ab1599856de056b20e1215309
SHA512

46898f61949c17a22e5a9f9520e3db3c9577be34b89a702bb7df936c3fd4ce6422d555e0d99db81e74e2a51e0a0f1a26bdb24d9ac7e24e08a7c6779d10c0eaa8
SSDEEP

1536:wGlfD2Sj2IXxt7AMlFOFbFGFQFKFAFA353aHVERSMDxqy/0qeBXgUF9qlTSz0W7I:nlfDUIXxt7AmFOFbFGFQFKFAFPtXdFjA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4280	msedge.exe
4280	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
2188	identity_helper.exe
2188	identity_helper.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe
5804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4700 msedge.exe
4700 msedge.exe
4700 msedge.exe
4700 msedge.exe
4700 msedge.exe
4700 msedge.exe
4700 msedge.exe
4700 msedge.exe
4700 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4700 wrote to memory of 5036	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 5036	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 1912	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 4280	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 4280	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2948	4700	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6912e62c6378d7e28ba6e416f9d22e81_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef99446f8,0x7ffef9944708,0x7ffef9944718
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,2055144237814633903,17514826443602645530,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
339B

MD5
d2c4e94b95511c870ce03ed2055edb80

SHA1
c6aa62abab28ef1b649180c787c004fa543d52e9

SHA256
a20565ade17032a11efbb1f6bbf8559f3a1e5ad289db9d05e00cf29f4634e666

SHA512
32105554989b7551ea14fd49870b9a91f6b96d6cb284b372c1e550f5181fd9a05b8e5038d6abc6b79132dd66bf669a730964ee2fcd25d594cd40d940f04eee46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20d488094420f9f5b02fafe505536131

SHA1
5242ea137d01e723863f528320f0d839f4974266

SHA256
102e679bd6728508d2e12bb3ed85b8cd81c14411bad62dbdd7ce2feae2a275d6

SHA512
997d587fffdf93da16cc8a1f18ebfce3c795f7164ee8b70b3d21018a1133ce6766b680c09510ae62612fb106a6fb09047630292fcfe9d27901b7c31e99eb62eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5433e922f5b508521782fbcc48378939

SHA1
95852afcab8bfe13dc33483bdc0d47d7d9d3f804

SHA256
43459407b98031f4db2e16c3d531a463e7aa024d7bf1750d9a6b39f1ddf7a455

SHA512
7ebdc2b87f9e956af93d34ccb1498856c7e89db909f0b559f88abf8372050c2ab1ea8514e3ceda1ba02011c58baf6ba8d218c6df5cb95b98da10e4b1511b4b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0701273adbf3b3ce872c0a9c6b910187

SHA1
97f0ba810992b747914b16d2514b3ade44cb0e1e

SHA256
1ab84144b2950e2351f182aeef5db691f165d671dc93748e7ba06895b9643004

SHA512
7d2b5003630d746b384416433368b5d15547899c6c084b9b1426eebc452fefef3889398a1d82da4012ea91a0eb65c909e3e205dfcafdd41cdd4b85719ae52d13

Download Submit
\??\pipe\LOCAL\crashpad_4700_ZCXFIHRDTUBGJXFE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit