hxxps://alexwebagency[.]com/bo/?em=serueda@airfrance[.]fr&fn=SEBASTIAN&ln=RUEDA&tl=33787512730

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://alexwebagency.com/bo/[email protected]&fn=SEBASTIAN&ln=RUEDA&tl=33787512730

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

228 msedge.exe
228 msedge.exe
1556 msedge.exe
1556 msedge.exe
2480 identity_helper.exe
2480 identity_helper.exe
5812 msedge.exe
5812 msedge.exe
5812 msedge.exe
5812 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1556 msedge.exe
1556 msedge.exe
1556 msedge.exe
1556 msedge.exe
1556 msedge.exe
1556 msedge.exe
1556 msedge.exe

pid	process
228	msedge.exe
228	msedge.exe
1556	msedge.exe
1556	msedge.exe
2480	identity_helper.exe
2480	identity_helper.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1556 wrote to memory of 2384	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 2384	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 3612	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 228	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 228	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe
PID 1556 wrote to memory of 1576	1556	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://alexwebagency.com/bo/[email protected]&fn=SEBASTIAN&ln=RUEDA&tl=33787512730
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdabb846f8,0x7ffdabb84708,0x7ffdabb84718
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
2⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2300066497283265433,8230912827575185348,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
648B

MD5
5346f26fd14c9e6a38de15b9c46ef977

SHA1
3991a2969977caa7e4b75d2e066aabd4d23c3fd3

SHA256
cc25ce5cb6adb054a9fab71c807dddf66c605a9309862b6a5aba6a194826ec3c

SHA512
39603050975482597e497a00702e3cb5c6b506a9a544fb4b8967259f8cf3230fad6a72ba43b76d4b4bfb0986db33857df4ed2538fdfc3c122c9cfa5c68bebfc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
7bf0363f83869366bc84f96d448efe5d

SHA1
bdcac06f75d3693d517989dac2031eb58fd356c5

SHA256
c472a93ea0219e617d2fc1e28eef4f3019bb26a23edc57fc0de45def287a23e1

SHA512
9c99092e4863f03a2c66f37822eec8947a2018e4e81f98cdb9b334251343e3d01f8b3763a48438244972418085c2eb9cbaff121a779686b1ed5ecf5b4278f894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7d58c16cd064ea2754cd6a78e0e79bd5

SHA1
ac5fb4d35f5848edb2a5cb52c6435a5c953ffddd

SHA256
a11bccbf6c357aae4d971800f41335387f90b9ba8b7b7b8b751b64cef4c1259f

SHA512
f287a05437808edec9be4a29b109bb274d166c899ced02385683d73cfbeef88102a0258c9e7e3bdee528e58dfd60942968641b8f403c35c0e64753bd089d1520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9543662fc6ee05d0d8b6f509358dd48b

SHA1
58bb938b7df420240ed1791f4a19f4722f09b613

SHA256
f0e72689d767db1739a78f62f1f5f6ce81f814de020ad84c51dea6a0fcb2d080

SHA512
11e5154da234fdb94deb537fe156df69301146279eca9cc9daeda2534f1edb8b23d9395b40d2f0670b11d3c3dcd2ecfe37b7209b8c6e647112aef18f320a3ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ef4283f3be3e3bb6bda0241e8eff54e0

SHA1
166ca5995042b76e13e544131a55d7b3c207881f

SHA256
1a24e1161045b6fbb23af5db46f848bfd4253d11362dea0e6d59aeb6097e4afd

SHA512
059705f851e03aebc4daef04472b352b411421e445dc3881c019374441398df9324ae7f3c3465d9bf7eafa76684a04dba0bcdb145de2f4666771388a0d77c843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eadd.TMP
Filesize
872B

MD5
533440993efaa2a3da81323d1165343b

SHA1
64ac6622bcffc4e0f5a2dc8e27c46eab7a3121dd

SHA256
970e20a08f9161bb0e9f43a8a8f050ecebea564f2aa10444b5bcf3119f90b5e0

SHA512
dbe9ed545cfbe99e6d3f2ecf2a17142fbfe04f673441bdaea5c6913837ea364abb5aac4cabbd42f81495cb30bd79b6d7f52830f387c1f46f2a68cbeb0726fec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
f840310dd4200de3ef94221e1312a64c

SHA1
ada27978b2f3c69798023df20c755396e6349748

SHA256
8a967f88e6e7632f00d18a633afb7a6f933f6fb08c2207e5ae5a1e71340560a4

SHA512
260915d32d8995f4bc169ed6c8c53902a396c8c51d3f6450cb71cafc49b5a94cf175fc95d61b8ea0c6497d0d3aab6aa397bb9f53539a57c7c60674af9c0eff51

Download Submit
\??\pipe\LOCAL\crashpad_1556_CHEGQNTGPSZDGMTA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit