df025ee4f4f9799147635e233ff8e1bc8c9b9875e17b59e0c38bbe9bf0614a4a

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe
Size

242KB
MD5

3f2fe97d0084c9c47ef2b2be1b660e90
SHA1

33dbffee76fb8ce467e0c12fc821fa02f9b2465d
SHA256

df025ee4f4f9799147635e233ff8e1bc8c9b9875e17b59e0c38bbe9bf0614a4a
SHA512

17321d320428820f65dad2ec39c659e25c203323eec342b440f6b55de0875301205d1df5a695bf8f9b2aeac65343de5adbb0bb01adf8e70a5f4424d2f9c117e4
SSDEEP

6144:/Xhkxuh9CKsODe1qPFTTWmW/AioewaRM:vhuUBsOERmUM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
4468	msedge.exe
4468	msedge.exe
1584	identity_helper.exe
1584	identity_helper.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4468	1332	3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe	86
PID 1332 wrote to memory of 4468	1332	3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe	86
PID 4468 wrote to memory of 908	4468	msedge.exe	87
PID 4468 wrote to memory of 908	4468	msedge.exe	87
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 2908	4468	msedge.exe	88
PID 4468 wrote to memory of 3588	4468	msedge.exe	89
PID 4468 wrote to memory of 3588	4468	msedge.exe	89
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90
PID 4468 wrote to memory of 2504	4468	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb29d246f8,0x7ffb29d24708,0x7ffb29d24718
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12460170062869146022,14510614333843714687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3444 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3f2fe97d0084c9c47ef2b2be1b660e90_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb29d246f8,0x7ffb29d24708,0x7ffb29d24718
    3⤵
    PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
bcd058d93de9b563ac1adb79cbcd9c69

SHA1
f384a5c253c22509efb87aee53634952f873e987

SHA256
37895ba9c2e7a18c2d575ffebc12d81b4098cf3d29ee04446f0758d806847f4b

SHA512
163f523bb34b06140d1aeb1cdbe93de3177582a1f5ac0608ee05b865917a16033f62a0b9800ea0aed2cc828722fe46ac6db3c4813f0ecf9f54f284974dd05791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
247149bdcc388e2fe02f133f0e02dba2

SHA1
d37156edd6830c09de46b1bd50b3e87cfa541a75

SHA256
bb8c3c3cd8dcaa455882a00a245ef96f0e6bb2c998273ef84860155c79d7c804

SHA512
f3b30221231da02d5e7a306f1272eb0c6d9db3a687567153bf42120b26eddb88c99ba27e6513374bc0efd9113fc752906bb7fab6e265381bfde15d1517333f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4059f04cf2506ebf33296184087f013

SHA1
bf2cdf195d7076f3f7837c2a1472c68ac7778a17

SHA256
e17990663461f95312fdb49fddd1007c9b90444a7aaddc406b2ca9edf0109c76

SHA512
dbd7646a38f3d9db4c7f4caae43e1fefa4a3be54ca5bff2eb9ecc93d07da10dbbad33089a9ebeb04706a43ee348a337e27c57a306929bb28801607ebcc4fca8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfb85c0191bcfa9db1b43a6891f10ab7

SHA1
76031ec8efa4848d62ed44b6709d616b9ae24826

SHA256
d403e43d00e41b30838538fb9f9de6c966d0565ed3b6fa4d397b3a606c581ae4

SHA512
16fecf25bcdcf42c2248e17c2a58226975cb724b49760e3db422f06807c56ac5272305ac8236f3745c71e46658a6a80aecd2df4b72a0709109c194cc2b75296b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e306eae9969b309f9350705b5d9463a7

SHA1
615c9e3683b79d8ef82aa437d134beb7c67d7623

SHA256
4dd800e7d213e05ed366f052d13b6e84766c9464572bf62f903aae7e260bf836

SHA512
da4a7c0c0c89d57478ddba0968b64c526a0098e25a103e01873f4a034b9b5649367cd26286ada43fa62ec317b1a3a4c3708332baeebaa7ce32370131833a833e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f702.TMP

Filesize
371B

MD5
664ebd714d6065bdaf4b697391835333

SHA1
24bc9d8bc1782310b772ef16a57addcb5bfa4565

SHA256
c482c4ced5a85f3b9cbab3330b2e09a44965e3ece6ffaf7f5098e709727223e8

SHA512
e41fc682ecd5ad5d422a967140a94e2429ddb52f39ea8beddbc2a3acdcc171e0e18485b75e1ec5c26912729304c608e79fe355649bee58f0e6ade09663f5f1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba27bb2809d8e154beb9516108c2eab6

SHA1
259111bad2f9d9277ef4b9abe43753fc7cf692be

SHA256
b992f1777a62e3c1430299679a5c49d8cfad819d7a6b21534129605a7116104c

SHA512
8fb9141642af109679742035ff8388fa76842c60ea893249f524b613a313ae494ec06dcf349cbf195c442885fedbc39fb7c77fcf656264e0b75e383cf6551b1b

Download Submit
memory/1332-90-0x00000000002B0000-0x00000000002F2000-memory.dmp

Filesize
264KB

Download
memory/1332-0-0x00000000002B0000-0x00000000002F2000-memory.dmp

Filesize
264KB

Download