9aded2247704bca825725bc7fcf24cbb51cdf64c5a9a54c58877430afc5c4abd

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe
Size

82KB
MD5

23ba76506e50f013c702b30eba5489a7
SHA1

67bb479cba5073967cc9a28d1eb807babd220260
SHA256

9aded2247704bca825725bc7fcf24cbb51cdf64c5a9a54c58877430afc5c4abd
SHA512

66b5136d9f3ce9bd734259e64f58950adf6b21c2e699d57739fa404118b9bcf909ca45a920f7253fbb8e041a8c4ad512b6ef4c7ae1729dce981bc63f87f477ef
SSDEEP

1536:OlQjyFSD/gCGwKJG1g4wq/VMqPc8qtTFhnL1zXa71qh9bpdr:hjyFSD/gCGw2Ovwqi8IpL1Da7UH/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 936 set thread context of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
2888	msedge.exe
2888	msedge.exe
1276	identity_helper.exe
1276	identity_helper.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 936 wrote to memory of 4784	936	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	84
PID 4784 wrote to memory of 2888	4784	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	93
PID 4784 wrote to memory of 2888	4784	23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe	93
PID 2888 wrote to memory of 4480	2888	msedge.exe	94
PID 2888 wrote to memory of 4480	2888	msedge.exe	94
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 4284	2888	msedge.exe	95
PID 2888 wrote to memory of 1148	2888	msedge.exe	96
PID 2888 wrote to memory of 1148	2888	msedge.exe	96
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97
PID 2888 wrote to memory of 3856	2888	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf9b346f8,0x7ffcf9b34708,0x7ffcf9b34718
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12600025137512306698,13564879996759215076,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=23ba76506e50f013c702b30eba5489a7_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf9b346f8,0x7ffcf9b34708,0x7ffcf9b34718
      4⤵
      PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
2f2a4a81067b49199c12220af26386d8

SHA1
d7f8e74af7aa4df88c4c5fde18e50d710e19c53d

SHA256
5fad90caff81cbd2625dcc5405c649231916f8ebc4e86363f04ef3a8e113e0d2

SHA512
09fe758f4bfc67e15c29893c2464041d07f78607d27b5b6d294da49ede4182141b900f30ae28d8328abec30def3f0d9e243c90b77f490d7e8fd12647302498f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4b4fd686847b85b2b500e2350c484e53

SHA1
6c545fb604f0a1d288b2b55fba118cd6e7ada3a5

SHA256
357b0c1e637768cd625bdcd58c98347c0c6357f7e1670de39b09361faf507cd2

SHA512
44ca211485c194614fbd163837ff19e24654c6f297ad54c15d68f5ad7279e1216ef544a0334f789405a86e28432dd351b2df3e80ace59a05809f7eb26931d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
439939cfa942394c2514029af7830f61

SHA1
cc239976290513ef4fa3c142433901e7a70b5ebd

SHA256
9a272c700f0f635c14476a98577cbd9c0bad8ceef5c336a231bfd80d8b31e312

SHA512
e5e972ba548d9c1352415ed0b146b3144348e2b4ead2c5e42ac958916be3b8b1d095bfaf7139c6124e7af6b5f3e9a585c2c9afd5e36abc73c83a8be445508340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bce049cc3de59f700be5516c58102d2

SHA1
f45d1fc9b60f03476bd8d6ed51ace6d8d732b3c8

SHA256
23f8fbbb6eeed6a4c356397956c9dee1b63d180676b66f4df17994f1461858e8

SHA512
fecc65a160731752becba676275ecb5d3ed37c9c6a9891bb49125879efeed280ec0b0cb7ea4519013c7980916a745cbb69bedec9432b40a588ca248665ae46f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
5d6e7847c44425388b452137dfed98a9

SHA1
fc64275c12603f2b1ab6a20b904d4102af561f56

SHA256
93f78ae16a21533064ac210c8fd3a14195802f6f20fe53b6703d0a935f15e75f

SHA512
60db64f81076afaee422fb7338a51aa2043b0659bd1ebe77d56a0477574d31b9182abaf5fe9f25f5ebd4466e615876345aab2ae107dbb04a958adcd2121b0cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a71d.TMP

Filesize
371B

MD5
8bec425c7ef323b4e277b7392ba4c4eb

SHA1
e0a69e06f892a424e850022a08756f50f962a95b

SHA256
d74c5d32fd76e078a73775ba81c4300c798ab1c46e2ff77cb88d681c04044c8e

SHA512
52b1a9767c1a66196a765b0210121b2949b08ac30b67228b12667b17c429f96bce97eefb20eab25217c5a048c6e96772715b869b314cd24dd7b76077a3bb720a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99a9323e21c164afa4ef2302667a95fc

SHA1
7ae0aae432798c4d72eebe63cb4061c676798a58

SHA256
dcff69102a43ef50759db29f81a31e99dda21c1a1e370453fc8d46887c86106d

SHA512
20d64cd88bffd0586c52ded5e0594ecdbc2d210672a1a5e6a36d60179e3e132c6912b212f4a36efd8e0845e5be0c47486c0e122c538ecc13748f8bd63fc9c14a

Download Submit
memory/936-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/936-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4784-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download