231802a265919283ad860dfe36b804cd840bae04b5695346d85887f0dd152719

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687bc1b46d1c006e5a0e0ee00efd7d48_JaffaCakes118.html
Size

128KB
MD5

687bc1b46d1c006e5a0e0ee00efd7d48
SHA1

a49fd7103527694a554b95f65f052b259c139c9a
SHA256

231802a265919283ad860dfe36b804cd840bae04b5695346d85887f0dd152719
SHA512

b9244cc44f99e8333d2a8a519177d069b1fa334afee63f1e618542b28a51af841e99120450addf17c6e56204c98f6aae031491b4e97a19f094501b30f5044cfc
SSDEEP

1536:8cdqD5rXRy0SrEk0V9avrPJVuU4JvGME8bRKgjPfS+jySCBRikh:J8tjgxarK+jUikh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3640	msedge.exe
3640	msedge.exe
4840	msedge.exe
4840	msedge.exe
4340	identity_helper.exe
4340	identity_helper.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4840 wrote to memory of 4660	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 4660	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2832	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3640	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 3640	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2120	4840	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\687bc1b46d1c006e5a0e0ee00efd7d48_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd944946f8,0x7ffd94494708,0x7ffd94494718
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,784899682802400408,4729547757217120884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
46ef961f077c818fb9c32aebae21c718

SHA1
70e73f2b2897a1f9340a1d4a78f1c487aabc0c6a

SHA256
c509cdf959bca87fcc74783f3195cb295310b43213dbe5893947605eaccf09db

SHA512
5ced735a2504e3bb0f96686383e3825fba95ad40c5eb3331b2d3d9bf8736b03145b7a57827fb328e1bdb36f39d684d704c652efeacdfe1c5c4f485ab703b8b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f662119b662af352a70b5de80f739ed7

SHA1
40d6fac3787edd2cc00b7684f232a6ad52d77590

SHA256
581978afdf44c290bd9c36bf7879c7145520406212255bfbeac3ce051c4c7518

SHA512
e1dc111dd9d7aef7f62c5d4493face3f0c142897ffa6b6bc7ab36e8bcada20adf03a8dbb924e4cc29285b1151eec624b5e19a554251161e439df6f2e7efd126a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b57d40e9352a5ca5f022de97bff38c2

SHA1
97e2df08ee9e01084d556ad58991ad26cd657e7b

SHA256
c5543b608607913c9b18d79f3b26131f0fb0acfdc70e05b677466355d11ee675

SHA512
c15b171f8fdadbb91c48bbfe8261b5d7d92ed3099144c8a148ed6b90a8233075d080ba4777114ccdbf1bf4ced5aca7e7a2358a3d4158ec2d3aa0f1621441e565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c6b6849f83ade4bbab7f6a432966891

SHA1
0754ac2b9628045c92540f5bcd1ea4cb6b7918c6

SHA256
d665f6536d83d1ac194b741546b60c74d735d47290d231f8c6438b68917bfc65

SHA512
588ccf73c74f719be188a17aaa2ed593a97836f3c1e9bb7562995aaa1de11f36c3b57bdc17cac8e99d2d792ce7e020f2142a3629e153430defe606f5b86db7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b1075ef443f0d7b44a4b39e88d8f1bc

SHA1
c6c8def16a637857a009f53a0f638783398ccbd7

SHA256
0d780278f2f3b1b5d461bf988fb9be2f0ca32b4f57c67aa88db74323e7abe36d

SHA512
fcccba90e6892a15dd189572063a94a814e1413827fe2210389886423890f44dee0c9d7e5ee6d4c7cf8c599d6edcdda31d463fcec690ea6e488bd41b2be810cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee4f337bcc921a882c3edcfbbd56df2c

SHA1
89e0fbc7e398878e68255840c0c790eb8a2b867d

SHA256
a040b146f800ce5f07b7f516b783ecd7ddafd0314939638c70dcccb364e8dc64

SHA512
8c117797479e484e83b92d8b9ef941fef42b62e000020d12993e375e57b77f7f596889d422ad7ed1e9ff2faed3af244ffcebd0ecd60991f46b7de998eb30d55e

Download Submit
\??\pipe\LOCAL\crashpad_4840_FTGXJTTDLDRMVXEC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit