92544552800612e8ecafc427ef9b1eeefd7a0451aec3a137f75b42c57edbc73e

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

833eb851c072b4b7911efdce73c416be_JaffaCakes118.exe
Size

79KB
MD5

833eb851c072b4b7911efdce73c416be
SHA1

661a2c094680c169cb88bcee3c0b339cd2c9c59e
SHA256

92544552800612e8ecafc427ef9b1eeefd7a0451aec3a137f75b42c57edbc73e
SHA512

af0efca573def93b0226a808520c8a42dc4fd0752ea1a3e80438443a4f910ef903cbeb1d3dd8cbf2109942f7733e8fdcfbf496107302cc1973aa3907de55e20d
SSDEEP

1536:N8C0iWEpRMhmPfRSqxDyLOY4gO8J749PMkR5LipWF7X261Y6u10nouy8H8BeaLCl:F0iW18pjx3T8tkvRhipWFP17outH8BHw

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/576-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/576-7-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	833eb851c072b4b7911efdce73c416be_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
1964	msedge.exe
1964	msedge.exe
2772	identity_helper.exe
2772	identity_helper.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1964	576	833eb851c072b4b7911efdce73c416be_JaffaCakes118.exe	86
PID 576 wrote to memory of 1964	576	833eb851c072b4b7911efdce73c416be_JaffaCakes118.exe	86
PID 1964 wrote to memory of 3556	1964	msedge.exe	87
PID 1964 wrote to memory of 3556	1964	msedge.exe	87
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5020	1964	msedge.exe	88
PID 1964 wrote to memory of 5072	1964	msedge.exe	89
PID 1964 wrote to memory of 5072	1964	msedge.exe	89
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90
PID 1964 wrote to memory of 764	1964	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\833eb851c072b4b7911efdce73c416be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\833eb851c072b4b7911efdce73c416be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gotomypc.com/members/connectManual.tmpl?ConnectionKey=1335587229-ba48b93a1cef9aeff81fcf69f9e88e6b&FullDL=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4b9046f8,0x7fff4b904708,0x7fff4b904718
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11145370922750518869,17103846752888790377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3160 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
d99a601895ef10555e17172c4aa1eccf

SHA1
cc793cb3eb82c668d8f733d20bdb2592acf01086

SHA256
99dc428b4d686d6e43e8f0ee58007997d40869adbf77493ed73914f6567a378d

SHA512
63f87c1778ad4114d773943b478d448fe3020fe305d8f1c8ee4d2636b1b2e3b96c394427b525e114f134775eb52182f5efc595811aadabed240fd5db04dea820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
13c799eb1b1751f587e74e69c4dbd9ef

SHA1
47b49e1aed4c8362e2818b69ce42804070011139

SHA256
260d78f6778ca218234b65a39fdd33c2828fc925957fcb18fd0ed4774a7c39fc

SHA512
7d159f07a62030f7f586a17e0b01b86463651b8cb3049bb07f4f179753648749e993d6003132cfc5c9f9467be120bf90a0d8427328d5ed0cef80c6e254f8f430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e22c2898ac78c14a840076a8446b9d

SHA1
ff5b7cca3ff2c4e77e6330e2c5e2b62bb56e9fe6

SHA256
a5e570fc8d3a52027db48adf1301fe8dffc500a4bef04d0d6bff15fff78ade8d

SHA512
19381615be8f53ccae56a21c29c314c3247ac78fd3cf838f52ca98757b54f945f0d178cfb44ea5ad42fc68b3d3e6e7ce4e4f40eb69f791fa5132f591c62388e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8d8ccfa6a8b1b15db876b848b8fdc102

SHA1
dc7d92c35e9c84d8d78ac0aedc926214cee68135

SHA256
b48f98046030e23b843422251481c3f19cfa0cf71fb36a8ff89dfcb152761f86

SHA512
6ae61b6cf236082b9930686ad2650c3ce3fa337550363e0858062dbb399093b0ac6bbca3d4c40101e222ce764fa4fb704bfc591e6d5b0a6c165f170cd6c9d5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
1115e001b7ad64ee0fa1b184fe5009ab

SHA1
be33ca34583c19a9e98a0ca838b65c61b8e50d90

SHA256
555ed80d37d471d38440c660831d4b275b9082814cc077eed63f1661e3c361af

SHA512
0f78c6f6b5a37b8a355d0b17d830bb33df9ffac5a529c6a803b5c19844e346a0b03413ed4bf6ed481793ac625dc1967ae12d769bd6733926396928e8727ea944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
58b738d16bf50f4eedbd1658d2a059b9

SHA1
7dda037ed74ba0b4520bf5884fe6b30db87d965d

SHA256
44c93aee9a21ab524ea25770cff7ca52036dc6d7cef0ce1fc557757ad1e8ad28

SHA512
45656b37c18a665ecd8b6a0cce108b9b8060fe71c05c2c499ecb0f4212f91163ca180fc4bd90fbfd079917cc849282dc073d1373420aebd68b1923f42bff9c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a86275d4d4a533539185f75ca16c3524

SHA1
d009dc5a9297c61a17595352da957019e81bf4be

SHA256
93cf1337df46bad2fa9c6bc44ccad13cae08bf7f16d3ecaa0de2e77db4c7ec0d

SHA512
a97121b34c68a298f9637a21228b4a188c4be23ba329acd3c0f6737e5288f222a26800136ab7e1fdb78b3025d46b7e46ff5b98dacb750e3d3a9efca39e4392db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
90780ce6c5da7b77a220edc0c61f62b9

SHA1
e6c401e5b4da86fb9ac053e1885d2f6266ff4f1f

SHA256
40cbe0a3481921271e8e22344631ea17eda01d8a90809adc5b6578d05c6ac6e5

SHA512
d5aee0f5215fe0e46f341fb7ae2b1e10f7d3a9f6bce0812a7ca177ec889ab978ccb28da8546ebb7b85ff8e4324735b1e1a42de9986dc3fe1e208c734b9044c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3c24c090a6751b62f5154c8735d1ee8

SHA1
0eede2d04313ffb0930c08b946e97e03d5045440

SHA256
a625c77eebfc6f5e969e83347dc43dd9e37540bd82fbdc68bf7abac604072b36

SHA512
3ccfa6cdd048112dbb1113b4e8966fa4dfd9d7822910436e8317c0b01aba98f0441dae44b9cee5b670c05708ad7f740c70aa481511931c36e959621fac807c5b

Download Submit
memory/576-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/576-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download