aee0723c7a9364e89e56264f77796300648b17a759502c3fb06e122643d51b01

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe
Size

120KB
MD5

951c11a541c98e6a1b9a2d5b082b7ccc
SHA1

ce6c6964aaea5759184ab9088ac9d3d898d41316
SHA256

aee0723c7a9364e89e56264f77796300648b17a759502c3fb06e122643d51b01
SHA512

f3befeb59aa8a743eee3e7c6188335af8e4bc71c0d937bb4a6fd8d963dd9d1d1352abcf378bde7f2a44f3049c221ba45cb7837f6a6e3bfbc6ac4f6719e2296c8
SSDEEP

3072:pMscqRz2ye+XTOLTJK5LYKoIxLhAfv087OTpT6baYotovPWF:pMscqRzzTOLTJEL6fc87St+Vv+F

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
3196	msedge.exe
3196	msedge.exe
5008	identity_helper.exe
5008	identity_helper.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3196	2088	951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe	92
PID 2088 wrote to memory of 3196	2088	951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe	92
PID 3196 wrote to memory of 4392	3196	msedge.exe	93
PID 3196 wrote to memory of 4392	3196	msedge.exe	93
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 2416	3196	msedge.exe	94
PID 3196 wrote to memory of 4176	3196	msedge.exe	95
PID 3196 wrote to memory of 4176	3196	msedge.exe	95
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96
PID 3196 wrote to memory of 3972	3196	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab74946f8,0x7ffab7494708,0x7ffab7494718
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,9950435421697044944,15679982502420383367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3124 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=951c11a541c98e6a1b9a2d5b082b7ccc_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab74946f8,0x7ffab7494708,0x7ffab7494718
    3⤵
    PID:3448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ea545e5fd6bb6a6a4ffa62f00b780094

SHA1
e3c2b8b0fc56d26c041b32c7cf47ceb656d615fa

SHA256
3c98c44d977b97ee9c031724ea88ff95f884a1cc07ae02a6d043cb40214c3e83

SHA512
ea564724a94f1f5f821525b3e7dda14692c82f983a4303a5d0515e5ce6e6b282f900f305cfe4830cd8c1dcc56f702c73329eaea32cb2faee7206cc9a223096c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91ee379d6310dd68ab6912023abc4740

SHA1
d178aebb8ac14f9775992e7eb161c9823e855d9c

SHA256
7317610c6e8175e3981f2f3673e96f419c5fee78d02692cdaf178aee66e2f774

SHA512
7b31f17c54f3a480916d9aa3db20c77196078f2251d108ffb070d6427aa003afb7506f39e580c38802e7c6f1d67629227feb32dc1e8008617c258837a9d3f222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d4167e00dad6c96896fe00994ae0f42

SHA1
c47ee05485f9a83fa10ce520f616e76c70725e9d

SHA256
5cb607b8b3e809339fdb89ff6ef590243850bdefdae7c0da7903f00b78129542

SHA512
1aaeaaeaae83e9dc74d168d03602fba7cfe192c18f9d1aeb139a30222f9b9bcac93d9f7291294438cd716bab10b0805a7b049ee8a9de3f1877313cb19dd20eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b8a4886ad7c231f365eb3c7fca770ef

SHA1
676b3fbf3ee692487ab31e559b8d52939b301222

SHA256
b2e2da5989359df3fbaf8489c8d0486007d015878af286987dad8396571fdf00

SHA512
812f088cc42c93a766ad2d489c8d46ea187ef968343840541e79ad2ff6dda6089337ac1b13f2b10c0c165384f0e892a5e7b5bda3edb1f3170f622dc48e9605f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4ef2226e6d4ac58691e1235b24819e41

SHA1
b2580ed71c508368678c9abcd890db9e237d8f90

SHA256
effa27ff1541062dd7151b287404957a14dc22e2ee2c89ec60813ff6860d3b54

SHA512
682731d3000495d84dce6f82b8784b63deaefd9b2ff9408d4a12f35526bc0bf8b91cff65bf3711618557751dc58cef866dca30de1bff6800193369ab0ac95d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5828e0.TMP

Filesize
369B

MD5
38349e70d90c3ef2545ba0482828058c

SHA1
ac7543b89e26684662de4610e2d8a5cb32ecebed

SHA256
86bf6c7705e35204538689130fe442790a74eb534714f46b11b770d3a885a195

SHA512
5439f2836d2608fd15d5b430cb4f911bbb701d74853020c373cb3c71b92e126310f107497b0114e978115d2587a1cdcff86ff7d97f15e8bf7648e1345766aa5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2337608ff8b198f4e81e5207ce432add

SHA1
138278e33c441cf06a6c12c0a7f93a19da11c59a

SHA256
63308e56c5060747fcd7ad882cfd29f7ac99158add6cec43794ea59fa573dac3

SHA512
7e0bfbcbf973245b4f9f3405fcb32f822182b7a933a4033ea2e766786711dd927c6246dfb95066f65a60e09aff85f0d76bcb1be6f1abe4ef4a1ff2e1350a8867

Download Submit
memory/2088-81-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2088-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2088-1-0x0000000000402000-0x0000000000411000-memory.dmp

Filesize
60KB

Download