expiro | e012e66d9a494b58b9b318ef8aaf498cbc6015dc1d70f42da7b1c65dd9475692

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2025 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1e7e067e8c6295acbcdb2d02f8abfb50.exe
Size

572KB
MD5

1e7e067e8c6295acbcdb2d02f8abfb50
SHA1

1eab57b41229282041ae683ab9879301cdc216da
SHA256

e012e66d9a494b58b9b318ef8aaf498cbc6015dc1d70f42da7b1c65dd9475692
SHA512

d1b59baa7b79f1e8c4778a82459c725d07f9eabb38a23e636959eeab12bea79e0488cdd9582e32a32ce443e93dfe5228f04d627a573ec89d21c564a81d051e5e
SSDEEP

12288:TIiNeva/l8GAN7es5kwZ1fZBFnhQRgqfdKek8wMBBpgk2asHBTttBRS8aQH8v8si:d9iBWnpB3lS7BE86e

Score

10^/10

expiro backdoor discovery

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/memory/1980-2-0x0000000001000000-0x00000000011B8000-memory.dmp	family_expiro1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1e7e067e8c6295acbcdb2d02f8abfb50.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
3808	msedge.exe
3808	msedge.exe
4280	identity_helper.exe
4280	identity_helper.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3808	1980	JaffaCakes118_1e7e067e8c6295acbcdb2d02f8abfb50.exe	88
PID 1980 wrote to memory of 3808	1980	JaffaCakes118_1e7e067e8c6295acbcdb2d02f8abfb50.exe	88
PID 3808 wrote to memory of 4028	3808	msedge.exe	89
PID 3808 wrote to memory of 4028	3808	msedge.exe	89
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 708	3808	msedge.exe	90
PID 3808 wrote to memory of 4052	3808	msedge.exe	91
PID 3808 wrote to memory of 4052	3808	msedge.exe	91
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92
PID 3808 wrote to memory of 1300	3808	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e7e067e8c6295acbcdb2d02f8abfb50.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e7e067e8c6295acbcdb2d02f8abfb50.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?LinkId=9996
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcacea46f8,0x7ffcacea4708,0x7ffcacea4718
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,5016797524998446183,12514835666288885217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab283f88362e9716dd5c324319272528

SHA1
84cebc7951a84d497b2c1017095c2c572e3648c4

SHA256
61e4aa4614e645255c6db977ea7da1c7997f9676d8b8c3aaab616710d9186ab2

SHA512
66dff3b6c654c91b05f92b7661985391f29763cf757cc4b869bce5d1047af9fb29bbe37c4097ddcfa021331c16dd7e96321d7c5236729be29f74853818ec1484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fffde59525dd5af902ac449748484b15

SHA1
243968c68b819f03d15b48fc92029bf11e21bedc

SHA256
26bc5e85dd325466a27394e860cac7bef264e287e5a75a20ea54eec96abd0762

SHA512
f246854e8ed0f88ca43f89cf497b90383e05ffa107496b4c346f070f6e9bbf1d9dc1bdcc28cad6b5c7810e3ba39f27d549061b3b413a7c0dd49faacae68cd645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
7c10028df1c7b98446886adc5fd55fd9

SHA1
9655ba6c8c949174243612c883a42eea0746aa2d

SHA256
dfd98a89c87a49c22a07cfb5e89f4d1b2f3db8fc43676818d18a7340694fc030

SHA512
3e6da8454cb72d1e4d7ad2be63860e0522016f75117a8263e1677235a495e01ab4f0941b647ca267437077c8969c5b6a53b9220270ab777386a9f3c15ad8b95d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ba62ed747b14e76486c326031615a8aa

SHA1
e90c7f57c07a83b8f28f370f8c26617b58591a1e

SHA256
4f7e3e286faaa56156dd4492672c35e913a60f95c72152021845f607293d5b72

SHA512
45c3895406d7f1f338660bed3ea5bd4f986c90743aaedc409decce061574c2e94f878056ac42924feb88729126ed542e2dac08933081cb54a52cad49cdfbadb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c62123ac7e2d77937ea29c17344af37

SHA1
3fcd29865de019ef018c047bb06558ad236b9eaf

SHA256
0922b22bd6760e12062119e4b54389e5fa176c8106939f3af8727a498b9255b2

SHA512
7a697b2757e06fdc210700f5d58c974ca73412f7df1f5c311d30ca4977ad180dcb97bfd282da13e5cdde3ffaf5db81c4dcef51090831ac957d978ce27d9336d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
378370300be1fe70f11e857746e0d492

SHA1
ee227a65ab7819412af44a98a0084bc9f7077274

SHA256
d3c9150596ccf6a7f05a6df3cde2400998b4c738719d4c452b1bf2e45b623127

SHA512
8fbac45ff08964079411c3060e27aa27042ebf4b227f31c106c71612a7981396a480e2577af692ada10b6fef1205c7e268a165ee4c40936f78006cd8c2fd8c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
556109421e07750af4267f49931e9566

SHA1
560eb05425f2e215aeef6cc7e4d963f0beec91fa

SHA256
5e12c7f89bb7ce49fc9a27e5346d1dfd3e015df99d21ffb97f1bb18369a6e877

SHA512
d51b838c686d36d112096f581c84ad9aadfe852a5f3f0d4b8436e037da5723b1a903036f09677974b3e9870f934d85d77d9c2f13c7443c95ec1d502af6e0e425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583822.TMP

Filesize
1KB

MD5
6fda7134db8fbffc49a993246aba6d47

SHA1
a03f5fdcba4492e359227f6addd100fd141bebe5

SHA256
56d052609562ececb2a362c98d5193a97804b6af1ec3bdd08af518bc08a7e521

SHA512
111b8d752b2bc9e7b8f9ff144178ac10559262555d55e3de49c8a7d1b44206cf49257fcf7e07f616dca54c158ee11f872a8470ab70912207b04e0dfc3f8db1c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3dd6d130ad2b8712ed1a5a5c7b7e8cb1

SHA1
0888fdbe94002a3fd27fdb415540f1a573547ba9

SHA256
e7ff204e70a748848cbc072990e2db0c1cf3bf63c82318611531c6fed37b70ee

SHA512
13b45681d6eca7f684b11c9f54ab4adcc879a8e40859cab7e5c34367c9240c687a5d0ddcc9c31f8c824aa5d6d27549e3956d3fd04d3898bf07b7152a7a7ff13d

Download Submit
memory/1980-0-0x0000000001000000-0x00000000011B8000-memory.dmp

Filesize
1.7MB

Download
memory/1980-2-0x0000000001000000-0x00000000011B8000-memory.dmp

Filesize
1.7MB

Download
memory/1980-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download