hxxps://mega[.]nz/file/TbgSkbaT#yxxG_P8_vobX2kyCm4IF5ymQFMUN2bBY8WILGbGvlKc

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
29-05-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/TbgSkbaT#yxxG_P8_vobX2kyCm4IF5ymQFMUN2bBY8WILGbGvlKc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4608	msedge.exe
4608	msedge.exe
2528	msedge.exe
2528	msedge.exe
1348	msedge.exe
1348	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2528 msedge.exe
2528 msedge.exe
2528 msedge.exe
2528 msedge.exe
2528 msedge.exe
2528 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2528 wrote to memory of 3028	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3028	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 3148	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 4608	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 4608	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe
PID 2528 wrote to memory of 5032	2528	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/TbgSkbaT#yxxG_P8_vobX2kyCm4IF5ymQFMUN2bBY8WILGbGvlKc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf4323cb8,0x7ffcf4323cc8,0x7ffcf4323cd8
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,3866472796637887649,15443016300436643386,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5732 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ab66978987777b7675f9101f691cc0c8

SHA1
9264f8f052eb085dc14dc2e18821dafce1ac01c2

SHA256
5c5ca375885b195a0a6f044f8facf3bf887a5cf5c03cdffd0a6e57797e630d00

SHA512
be36d42be2b0c6863da40aa19aa61cc0f2496d8bcb17b8f638c57ce462481b33d27361791f9f0c909c789b6bb1b4cd303d91464a376e1ef65fed8c16fa51873e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6408068feca17dd454bd03d0c45d4b70

SHA1
7063dca3a7168474e424551af5494f57403c0d4e

SHA256
2ce808684863f4f904f725ad0aa0d701aa9e916a8b160b67f1d29a33007dfe57

SHA512
0775bf7534555af2031c28276b9936e3a6d284bd590e1042f456b6c3c79b5fa608735998e8ed4c11582773cc87715a84336792c8a3600c38778541fc13a48c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42a6b56187b1aa2e6bb7eded27daf422

SHA1
cce533b4512fd7246bad967ad2afafc64c4f4e55

SHA256
d45d378dc9e47c302bb42c658fa4fb402f58d15a4e294adb5a161e39eac3ebca

SHA512
18fd0fbe79b68b96455350cd6e063cb68c9e14370ba3ec36589d7e6d5cf174d4dd57d53d7c1f56ed4fb7c6b5d9cf6eaa6cb6cf984b551df0374406b80e5a58b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6faba15a2887abc77ab7dfae835a5136

SHA1
e7fe1c850d54e63ddc656986743954be708da80e

SHA256
2ef68bceeef906e0d425b3a93725553eaea1a179ad7643b84437b9e0a599e7c9

SHA512
cdc4d4290392b78f4e708774d59ab233349760ed5451516f64e356814ffdd5bc61ad79b601ea57c4b3d627492a295c2052223a6ae9751edeede798aee293c372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57da43.TMP

Filesize
48B

MD5
c11b39408a529b91559c0bfb4fa2fc7f

SHA1
63dfca64358bbd78425ce817488261125000bbeb

SHA256
6115a5be1c1fa458df13445ceb5b3e07bb515b941dcddd2a3ea6e9acd9cfc915

SHA512
dc71a54c876dc14aa9ff234ece35da35cb846e56c86d0076c28e4f674a5e7aa3873ab9680c887de4722d92da310cff818e8c666291c7712300d0c9307f7f8eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
172cb6a473f70a6b6ff907dbedec01c8

SHA1
aa18171e18a6664d6a73b4eb75a103a14e293772

SHA256
a829d00fa5d59988bab5a65443d6e54038bd4f8f91f0024c8dda642da7e576fb

SHA512
c4430a077f59da2298c43e3db11cdefeb96871ecedcc638985544a917a4263bfc6d822cff3dff907af505937294cc8a3120d2663b8c58a8cabb64aab40d02432

Download Submit
\??\pipe\LOCAL\crashpad_2528_ZFPQSMQBBZQJPVIW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit