b93e4bdf71da62156d8d2d8706887b8cf45d2074e09826c55bc88b76aaea0b30

Analysis

max time kernel
140s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe
Size

1.6MB
MD5

f0aa403a53d8b648d846fb0d15c0a92a
SHA1

802d8bf182ea498e4eaf22313212960fc56c26f1
SHA256

b93e4bdf71da62156d8d2d8706887b8cf45d2074e09826c55bc88b76aaea0b30
SHA512

b4ffc2f4dc4a229645720371560c93d12027fcda3af736f166ae7149bf39b406845f722dc23beba96b314e477f891696301cd9450c239342da05991f9b7932fa
SSDEEP

24576:Ydg/x9eL2NLxSbt5bDptKtXb/VHoxbiQbGvK9CxPWI2:Ya0iNCTbFmXBQiYCxPWr

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002340d-5.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
5100	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-0-0x0000000000400000-0x00000000005C7000-memory.dmp	upx
behavioral2/files/0x000700000002340d-5.dat	upx
behavioral2/memory/5100-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5100-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5100-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/5100-20-0x0000000000400000-0x00000000005C7000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
3604	msedge.exe
3604	msedge.exe
888	identity_helper.exe
888	identity_helper.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5100	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe
5100	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe
5100	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3604	5100	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe	87
PID 5100 wrote to memory of 3604	5100	f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe	87
PID 3604 wrote to memory of 2028	3604	msedge.exe	88
PID 3604 wrote to memory of 2028	3604	msedge.exe	88
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 1408	3604	msedge.exe	89
PID 3604 wrote to memory of 4964	3604	msedge.exe	90
PID 3604 wrote to memory of 4964	3604	msedge.exe	90
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91
PID 3604 wrote to memory of 2992	3604	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0aa403a53d8b648d846fb0d15c0a92a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.59tou.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbdc146f8,0x7ffdbdc14708,0x7ffdbdc14718
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15125815800541588493,5752604393580975896,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5708 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b18737fffd90670b937f719898afced

SHA1
b17c42347cffe50141ad785e6af4e0d716dfffde

SHA256
42a652f9e09289ccb082443867da260c98828024fd3fe2d0dbdc0346c2531a2a

SHA512
6fc989a1448dc405d959eb49459d8da7e8341d69dae51746da831d6c7fbfbc8f5b96e4b6da7487f0d1277b8a368d6cf21301e292b27221dd74ec422534b740c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f05d055d4262319ec72d83ed7cc98ba

SHA1
79097801dfe7447ee1bdfc3f6cf536a16ce0f4b2

SHA256
0dcf6846f171c0ba153f7bd2dc241e9e94b27f07a72b288b9be4748294d173fb

SHA512
5e574ed9e676b03a49230eaffeea9bfbd20b0b8d5d7beb2b7fc0e30b8335cab82f86041bbe6cab55a8382672fa283f905649f553546f5149b380a333f3417d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3565e2bdb3844037438cd7247e597891

SHA1
3d7ca6371d61cec63053605fd9beaa6129a96823

SHA256
95b53d2dd5425dedce70f29be8e2074e0e7133c45a3e5266d5c4e6e6571475f4

SHA512
167e5f28114ee8b135bd67d6422574e41c2f78c68a6e3d325b2c905892d3be7fe336f699150404f416d23c42d71104a169b91f5a5f6372063932c5452d59e9bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.Dll

Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
memory/5100-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5100-20-0x0000000000400000-0x00000000005C7000-memory.dmp

Filesize
1.8MB

Download
memory/5100-10-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/5100-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/5100-0-0x0000000000400000-0x00000000005C7000-memory.dmp

Filesize
1.8MB

Download
memory/5100-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download