a5d7d532b967d8be31ccaf214310790f5d021c3b47daecefdab6df6789d53615

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ec34f5b2cd554a71669facd69b18c7_JaffaCakes118.exe
Size

387KB
MD5

96ec34f5b2cd554a71669facd69b18c7
SHA1

4529d31f60a48d3c22574898ee4b0e3842b48458
SHA256

a5d7d532b967d8be31ccaf214310790f5d021c3b47daecefdab6df6789d53615
SHA512

dfaa519a34c2e8353c5bdbc73d21d6428906e6c24b3ebd394978d52e83f9f4f37def13b0babeeb07289bcd7e99bc2956af78c3f52884a0347561827b129e16a7
SSDEEP

6144:Up+r5nORSAZmddbWkBBzj/Rd+UcUft1B/UI99p8ynBbet/FWlfqy:y+9nORS+dkBBRQUFft797ndM8y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96ec34f5b2cd554a71669facd69b18c7_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
60	msedge.exe
60	msedge.exe
3060	identity_helper.exe
3060	identity_helper.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 60	4388	96ec34f5b2cd554a71669facd69b18c7_JaffaCakes118.exe	87
PID 4388 wrote to memory of 60	4388	96ec34f5b2cd554a71669facd69b18c7_JaffaCakes118.exe	87
PID 60 wrote to memory of 1932	60	msedge.exe	88
PID 60 wrote to memory of 1932	60	msedge.exe	88
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1052	60	msedge.exe	89
PID 60 wrote to memory of 1584	60	msedge.exe	90
PID 60 wrote to memory of 1584	60	msedge.exe	90
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91
PID 60 wrote to memory of 2724	60	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\96ec34f5b2cd554a71669facd69b18c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96ec34f5b2cd554a71669facd69b18c7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.hotmail.com.br/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffa855046f8,0x7ffa85504708,0x7ffa85504718
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13192744866943369304,16991227929676707503,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
ed0c76f040a0158ee04b4860f59f88b5

SHA1
1ee989ed134e7ff520d193103f7455271ba88077

SHA256
8fc27e0b8b4aa1a22da9b20ba8c0b76465ba69b081d4d4149a898fd536f2e862

SHA512
9d5203db6a8260c607d25eafd08b3676558df79c80c940516d2efb19e2e1ac2709852474f4231028777d411e57b753d874f7bf90a7fe4c26c414ecf9a94dc85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a09cb4f7fc4160e8ebaccfe31d0403c

SHA1
16583ddf0023f94f2c4e1824314be6244ebcf093

SHA256
afec38fd85b87fcc278ad73f330dd8bd1938acca14afe6247c2ef48d0cce8dca

SHA512
3f507cb8fd7959ebd56f3f63577d747df7e38aa5c4ec164f926fbb4a443940cc459f2ca4c930cdbda088812cf38d98c693cf3f3f82fcde8f37683df12d0b2df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53fae90eab0a51c14068bf91fb87568e

SHA1
20621260632a09842ff20db9e0003a7ee731abe4

SHA256
4eafdf8ec3cd1e020defb0a756edfd046009ba006a1ef763d99dbd071ee920d8

SHA512
d0300880ff53b6c10e67ddf64c23b2f0188306622992c63bcd342f9566046dd4b3fbe0f4dc855ce28ef144f1caa663c108ade9717b74edf4bb6af94593d6ad96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
542155c6231cbe777bf87f2291febd13

SHA1
522a91b0527e4b3dabe9a765587ad8930b951c38

SHA256
e6f4ff378acd83b809fd709b80286291349ddde114976649d08215dd9c97c74d

SHA512
142b12ec35d3792400e69d5eab72c1716cffd46fdadfbc2f70616182a163186f95cdff2757d161c2918a809aed301da416b846a9453facfcf24b362e07e923ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
71c699b64f2ab1853c4164202c1f260e

SHA1
fdff326c7372fadb767b26a6f24a941988d2cb4b

SHA256
c4d54401a79fa924df6199d2ceab751daaa1468ab3220a7338c4c4e5245826ac

SHA512
1275a36ba44b81227ae7568afdd05055b5141b681981ace81da266f031de0bc10767e3188bcd2643f548440979e7294e4f04cfacde94323dffaf2a36c943246c

Download Submit
memory/4388-0-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4388-23-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download