3bff9c35d3a7e44ca0c1f875db3535a94fa827bf7a0f10075f981e7ce1f52d21

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

765faae175f3bfd1afe24de004015564_JaffaCakes118.exe
Size

170KB
MD5

765faae175f3bfd1afe24de004015564
SHA1

b3a4dd93029ce7b12d093754e189248230c04544
SHA256

3bff9c35d3a7e44ca0c1f875db3535a94fa827bf7a0f10075f981e7ce1f52d21
SHA512

ea0541b05a0fe6bfa5a5b8d22cd6a02997740341ce9427172540b8c7ac1f1a130a9f23c3a7c23e878dff86a449fe3a2f6f4049e7865ec2cb7a9a83a1d5a11349
SSDEEP

1536:nq5ETFGhVHiOecgHdy2zY1YX7o2asZE4gHGwe0hG49PdeWklluiIPOuaxrgJeu4r:nkwHd1Yjnd4gmpDXuDt4NF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	765faae175f3bfd1afe24de004015564_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
3500	identity_helper.exe
3500	identity_helper.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4840	4560	765faae175f3bfd1afe24de004015564_JaffaCakes118.exe	93
PID 4560 wrote to memory of 4840	4560	765faae175f3bfd1afe24de004015564_JaffaCakes118.exe	93
PID 4840 wrote to memory of 4084	4840	msedge.exe	94
PID 4840 wrote to memory of 4084	4840	msedge.exe	94
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2128	4840	msedge.exe	95
PID 4840 wrote to memory of 2840	4840	msedge.exe	96
PID 4840 wrote to memory of 2840	4840	msedge.exe	96
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97
PID 4840 wrote to memory of 388	4840	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\765faae175f3bfd1afe24de004015564_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\765faae175f3bfd1afe24de004015564_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=765faae175f3bfd1afe24de004015564_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa909746f8,0x7ffa90974708,0x7ffa90974718
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3294665333643146982,4976022346003867324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=765faae175f3bfd1afe24de004015564_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa909746f8,0x7ffa90974708,0x7ffa90974718
    3⤵
    PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ee473ab8bd0a0093a7806b61f5a6c94f

SHA1
a2c58c56203c53e72d5bb109366b5b9e8b000ccf

SHA256
30c2cb967b39b2c33784d089add741626b0d5601ad45f3c38df5c3da0b622449

SHA512
813d95134c9061af76f27f15da331ab9756db7e685a0235151610088d381648f82bfcf2d61d5a6c83954f5d071f33db46c6d8bc4bcd377369b3e970471ec08f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
081afaa2056d148269298c0d3d145222

SHA1
3ba92461de42718cd0e27d0b73fc9cb537e07d49

SHA256
207414709cf98783584aadf6b30e2b21c2b0d3d7365ecaaf8fd1ecd97fb052f4

SHA512
7ea19214ae5a7a7511819f5d63f22938ef641263bac5062012127766a481bf7f4fb04bb60b5628bf8749c0bebe2def580818394a3e342e7bc411c8d9f255a4d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f478952085c9688e761ba4078e9032b

SHA1
2c27544aed5513bef516bf5c8ea3390a9946263f

SHA256
65f8cf9f6cce7a4ea5563cede7dbb9c3e72175c9ac59ac10b0d72bc65991d9bd

SHA512
d80a48f101e40434099d2bca00113829b5fe4084b95bfd38a2306354b60fd48f772933ee7a9ea5ed31c09863fc2def0f80ffbf74a868c37b389a6522c391d6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97fea0e5f3a65a948886775e26994a39

SHA1
48d566b3b88d7f499a30f001506625d67fd1b492

SHA256
2e8a7d1a683c4e18842d86dc9dccd0fffce52c0f0844d5ef0deb0d75d4157693

SHA512
b4ba32d8c11a48c72ce3ec2beb1a8e18e4aa17523dbd61a10e0104db2d8f5a43daf77c809b8d73e4b994d5c4d5a8a075e18eae3d01366e0824d90564a430f857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a58060b9782ac54dd3fd1ea4e9d3226d

SHA1
aebfc5cace0021f160880bfe52d0b3c10e59d1d0

SHA256
b695f8aaf858fbec0a20738bd1b11404f37e4c1a40c575acf3e77785d9596bd6

SHA512
ec390f84c2d142c3aaaa7498985f270c7c0c09f06383deac97231c22b995dc08d342ceb4f4622196449bbb4411fc2bac7013aff83cf72bd202c8288f8a0edc9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58174c.TMP

Filesize
371B

MD5
4db5a10d897f18dc14463cba2f2b9737

SHA1
cbb22c116826762650f0bf53c9a4991f91ef7660

SHA256
363d450eb913755d0587c7d0d55f5571a33fabf21cf8d6bb73f7becb8d342f10

SHA512
815555e0925af77c3d57ab62007d8e25354ac3ab8bf37ee5ba21b8815f8210b185082951d08c170b6f74a8dcc3e20bf0024b4e7ae30cef25aba962bea6947024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8eac616a49fd159d4924e4ffe6eafc89

SHA1
b5114fda385c938cb4b563d17fcd18aab515a960

SHA256
94785ec5e60e9823fcbae120251458ad34fdd5630ac6dbc67e5c40b789d9b4c5

SHA512
b06f5a27bd603b973eb6e446eb9b02121cb526ccb6e37685e8eea7b66fb1fbfe6923b2453c399abd11659bb500f0fbc339c1b07e7e2dca5b9aaae126b5f148ab

Download Submit
memory/4560-68-0x0000000000C40000-0x0000000000C70000-memory.dmp

Filesize
192KB

Download
memory/4560-0-0x0000000000C40000-0x0000000000C70000-memory.dmp

Filesize
192KB

Download