4e76131805d7ae778ebeacf1fdf7a7643e0fad47bded2f3e8efa22fee7796f29

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe
Size

452KB
MD5

e996196622df2aec8e87e4ba6331e829
SHA1

8169ead2f79ae8d3069e90249159b304009cf73e
SHA256

4e76131805d7ae778ebeacf1fdf7a7643e0fad47bded2f3e8efa22fee7796f29
SHA512

3e4181a7192186045ce84bdf682189a71b3db8f5c3d10baefea1a88d3517dab59a4ff4cd20fa0bf0225b03019bda7b291f4262f95badda1bae4eef0639d1627f
SSDEEP

12288:/4PUOAxGiXn6WyUt3Js6mhrc/ynfDcuMYt:/YA9gUt3Js7h4anrBt

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
2692	msedge.exe
2692	msedge.exe
3404	identity_helper.exe
3404	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1668 wrote to memory of 1256	1668	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	86
PID 1256 wrote to memory of 2692	1256	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	94
PID 1256 wrote to memory of 2692	1256	e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe	94
PID 2692 wrote to memory of 2204	2692	msedge.exe	95
PID 2692 wrote to memory of 2204	2692	msedge.exe	95
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 4364	2692	msedge.exe	97
PID 2692 wrote to memory of 5004	2692	msedge.exe	98
PID 2692 wrote to memory of 5004	2692	msedge.exe	98
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99
PID 2692 wrote to memory of 3556	2692	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff8496e46f8,0x7ff8496e4708,0x7ff8496e4718
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11683474390141537788,6440248682950208436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e996196622df2aec8e87e4ba6331e829_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8496e46f8,0x7ff8496e4708,0x7ff8496e4718
      4⤵
      PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
4925c77c50bdeb4b81fc38067109cb57

SHA1
e757fb6713d7f3bafd46a119d598520f0886571a

SHA256
8c00b5f6bf78216577967f8a5bcf454ee2d7cd7fc3da13fd99d2f77b1e388a32

SHA512
50ef8687cee8cb9d6cd3eb086ed8b701acbb466ca5ba06c74cd8bf30938a107ad09247e7d2deee1421f7fb308934c6ba11975decd34e868dd58a21ede6050477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0751458e32f1a49b152fb632c86b298c

SHA1
76c1a19060522048838c247f75879070427811a2

SHA256
92fafbfafa336cb5730ef4a4663cff46a50a4f7e6c746b1b3232dcafe2f2907d

SHA512
6f7c7df42afdd34cb532f5811d27832458b324e8af254b3c20d10ae13f0b0a5698498070f4d480f3d7a5d2680bd0ac45f6a76276e7fe94aebbcb42e5f2932a58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43659a81129ef7efd40b1de364c63f31

SHA1
0a0d76bf9c4d66b7570dd7ebb00dbfab7afdaf36

SHA256
8f20f1d3006aa676d6f64d6a84a3f1c0832f2ff67a6f76f4153009e00eb3df04

SHA512
5342dd67a9cc86e42f57e28b33a4792a8da123bc12b7f31c058e9b9d7fba9b9552906b57a16837ddeaff450dedeee51cdc95c78a0fc90208d8a9871a933ef125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e497feefa25696bb037aa45e09e6a8f

SHA1
703147d5ad5e5af6df2a715134f51cd750dd3a84

SHA256
eabdb4b4292bd347464fc434b91ff6f9c2cd3b96b9130200e4c8d388b4964bb0

SHA512
e271582ae76943f0e98c081d409fafe40fcd75b3022b63191ac6b5d826849b2eb57367041403d65955a58a60e6542dbbb613b024aba6acdc4c82b53a5adecf07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
17613b3008994d91dd3bdd0e9f5b518e

SHA1
8f479253cd88a18788ad18b6b2192ecf179936d7

SHA256
b54c6516a78b5e1132c6d647e7228be9cca4bd46566581ffd01106a294c0db91

SHA512
0f6860c1d137f259b45741d062812650a352b5b87243d20d6a50e6924221fe0257a4ddc6d08403371690a8df9704e7171027535d146627a2feac5e4a33891383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a950.TMP

Filesize
371B

MD5
fe8dc48693639f29ea66a9fe4786b370

SHA1
dd9e5f3e7b9f5276133f784f9ca9f9b7f5b04bbb

SHA256
3c9e9c3440d2f07493e54c4efac7d8ae4d4bc43a75a76a74e0a70de914ae19e2

SHA512
0198300aab8a94099af9af795c650ff94210050b19ec2d1425b68462caee92bfb4d04af017c878485edb3d6328f416c55255fb9874116f9832621e401b815e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48f9cc985015739943595a7535692fd5

SHA1
08ac255d9f1b984011aa5ece90f3abdc2131daa6

SHA256
e31669072f79f50bd50e663bf99a065796d68927c0e992e5886ca77700728b88

SHA512
ce5a58df2c1dd3b14259ce4cc408f8c474b92e821b7d4af71a6a7873f9c2c22384b48adb82036090c161036395b13f04c126d5b0aca893c0c417ba26eb132eb3

Download Submit
memory/1256-3-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1668-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download