121e66c2bf0fc6c8880d0c6550fc1d245afa9223195153df9d6bff718db9dec7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6559f7b5c2e023e8f3243e618ce7a12c_JaffaCakes118.html
Size

73KB
MD5

6559f7b5c2e023e8f3243e618ce7a12c
SHA1

d9e7b035c310596fbc77945dbd58f1e7b8cd50c8
SHA256

121e66c2bf0fc6c8880d0c6550fc1d245afa9223195153df9d6bff718db9dec7
SHA512

f2dc8a9981bb5ecddba079eb09a784da655141b5e79338063e41617ca195c778b598256074910facb4dd056733e36b1f1ae8319af1857dd8ab06fbe87d7e6461
SSDEEP

768:agGtpDJTOIJuAT6cPVJToTVqn1jBUL5bVw6i34Q1F7wFC09kaWiDNspvwXLtiwDg:a9DVnrc1NZsx0tiwtzxUginx9uPYhtyC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1164	msedge.exe
1164	msedge.exe
3376	msedge.exe
3376	msedge.exe
4648	identity_helper.exe
4648	identity_helper.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3376 wrote to memory of 3084	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3084	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 216	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1164	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1164	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 540	3376	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6559f7b5c2e023e8f3243e618ce7a12c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b894718
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
2⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:8
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1669436888318865717,1165760671760388100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c61f6237e9bb13d6a123304582d69d02

SHA1
c9810da103270a980cc4da6443570d050ab69785

SHA256
f21e4f70a839a23712505508257f9c00ca71a312403e3c8e1931e9bd812bce94

SHA512
cc3635068ed4465d4acdbe1a9fbe6db694298f4ce16b2eefbdf1161457e98eae59d05972a8c2c7a54af6cd063afadb2df59eaabfac5584f4adb53fb75ddf67b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0a5755dfe637b9602dc5844a057eea69

SHA1
ca0cbf41efcd06f53201fa36392524b87bfe9819

SHA256
a90c505f842e83f67816cbbd0a8e5a14b7febbbeb37fe777bd0a6cece4d8e578

SHA512
88c375032fb9ee835437d77c42caf5a38d8020fdccb4cf4124382cc8ac41df0b146e9761d51172d3ee300be1070737bed23f8d871784bc4d8b60c07a7b3ff0f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d736eb8f9b8ce459a02a39cca053bad5

SHA1
f16c7e141c877efc1dfb326ddeae7fd725e40597

SHA256
2dee87ed4403e76a0cbbe3b5c6a54ec7a64b86c09e170683ec20a7be76a18df0

SHA512
da4c0c508c89d426c4badceed0ad018616f21f9cc0aea259cd2a6ab6d0a379a8427b6a22ab1463aed490ca495cda6a6c3f0a883e567137370f3080829ce89f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33681176cc28e49510d1129bf9d917c4

SHA1
5deaa453848b9699df20a4a473ce1bb714e1e479

SHA256
021090ff2feca781f6789cd6b264c8e38eaf5eba73e8644fa001707db636d62f

SHA512
ae6fadce76bb9d647108b45048680573404b75e7373415a645eb50268bb21d1ecb3d1fe8037cca824627c056ba55f7203af3e647c65f94a05fb03962b941090f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0bc41fefd2ecfbd235420e362b0679db

SHA1
2744fdb08d5f2689f9051de9ec9e4322419f1801

SHA256
7f2d23816c17b2a0311f1dface0db3b99b5dce52edbc765f00b3e84dee3bc41c

SHA512
51bbd2763401270045a0d7c00111c863c419eb9df6073965e46260ecb2ddfc83f1e681d79f4600a8c7a628394338d3079db1e92673535cf26eac409050297f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2740b8476cef0addea7634d5378042e5

SHA1
9ce99ce6e56d92b5ec4b444dd0a6631376db8357

SHA256
6928dd53874f8209cd5111ed3fbc4c8da118f32e4fbbe764a04ad58334412583

SHA512
d4f73457e487bb079674b7791f0dd428eb1a4e046e8e277828471d5224d45a7fd149bb684f404ff58c731ec6a180e4c869412724f212dbf461c25b581d7a7032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8002442bfb09c6e75ba7c29ab08339e3

SHA1
1a831beda742cd1f3133bbfcb35e55c708a07dc1

SHA256
f855db24467c2a4012aaa8dc83a56d4e0ff267606ea12dd2c456bf54bff82d62

SHA512
dcebb0bfffa70db65487e30bc92b6c0d63dbd137d9d9c394f10bb44902d6ad58f517945579505849643a536f715938fc023e20432151c9281e1933d5a712b662

Download Submit
\??\pipe\LOCAL\crashpad_3376_THDKXKBMNBLWKEJT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit