09f8f3c7598c0b95d4e3f05ff762769c3330d4f4ca6621dda2d954f685b80795

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68301cd8719f486f39d248376fa95fea_JaffaCakes118.exe
Size

57KB
MD5

68301cd8719f486f39d248376fa95fea
SHA1

1fbb3bc9e3cb7ec7b17516ebb04a6bed6b7566f5
SHA256

09f8f3c7598c0b95d4e3f05ff762769c3330d4f4ca6621dda2d954f685b80795
SHA512

f2aeb6d0545b40474a6456f2fd4235ff892d8b252d0784d16217544760bbd083218f1844c7fb3d364de8286ec8e1b6139364cd4126511398879b52b1f1bedc55
SSDEEP

1536:NCQFWmlXAYOJ79dAGXUDhRp4YVEzLupgTa+bM1O6tgtUx5pZgLad/gW:ZWmXu796GEblcupWa+A1Rt+SZgOV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68301cd8719f486f39d248376fa95fea_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
2128	msedge.exe
2128	msedge.exe
5604	identity_helper.exe
5604	identity_helper.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2128	4032	68301cd8719f486f39d248376fa95fea_JaffaCakes118.exe	85
PID 4032 wrote to memory of 2128	4032	68301cd8719f486f39d248376fa95fea_JaffaCakes118.exe	85
PID 2128 wrote to memory of 364	2128	msedge.exe	86
PID 2128 wrote to memory of 364	2128	msedge.exe	86
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3880	2128	msedge.exe	87
PID 2128 wrote to memory of 3908	2128	msedge.exe	88
PID 2128 wrote to memory of 3908	2128	msedge.exe	88
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89
PID 2128 wrote to memory of 2896	2128	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\68301cd8719f486f39d248376fa95fea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68301cd8719f486f39d248376fa95fea_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.rederecord.com.br/hotsites/concursonovela/default.html#
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa75d146f8,0x7ffa75d14708,0x7ffa75d14718
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12624277027066970553,6376725807570062765,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3904 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
fcb7066934758513e2904b8e5f957de9

SHA1
17cff0e902e502fa67b9792a0b360fcf5ab574c5

SHA256
06813c6d83cddc63535082f6009dd75069abd53cfe4bebb72e82afa5149a0035

SHA512
fda55d8c49b87143a32db98b573d2c4c444be1bccdbd22f7c67e3a443001a12da11330bff98c66338c9d546bbd38acd1a1f822bb3db091b6534bbf968406a9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
74KB

MD5
41bb538e5ab3f0b1609241f31f5c5f04

SHA1
202bda48564683eed7b7a7a2a7ca913df281fc27

SHA256
cd6638233ea944405ac5d9959d2fcd85fe5730ff2e2f5aa1879934077aeb05bd

SHA512
0334f0ed01df729aaa34030fbefd1c2ba12ec4c9354203d189e352e44f669676edee3cca089b79a35921cf33c13c95fca373189219a6dbbdd4789f52049702fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9c388d66d6353e8b876e9ef74b21def7

SHA1
f83396664551f8934e28bd54d6e8b3aa210008e2

SHA256
95132c4573b90d595b29e65a91edac10ad30e2ca2a59aa3506f51bf22552b560

SHA512
2e366302cb54bf052524f5ab7d2f4c38d346b4f9cb828c7865cdeb886754313be6e03e705f4d02e8c50546ee709bc8661797bcc38a0b4bd745c631786060fa7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
f9617e019d1014898d25321913a16366

SHA1
ac192e34dc3b393d6a9547d58fe058a671fbad94

SHA256
31031182810adf7dedf67e516d5a23feea3436c6c41c78ab42d79d02be6b9957

SHA512
623a062a04ec0d773959cfe18846200e206f5e3fa1f1024cebfb3a1b17a086bc57291bf8feb73619d620b733dec6d49bbc505c831c7e559ad6d4bfa6f22aff13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26b4f8c350cacfc523e71fc68a950fde

SHA1
4522bbe79902688edeba161375fdfce74f721f03

SHA256
dd51a68e3c969d205adbc71d5f9ec8b2c5afd8ca9c23d077a46ca2346d5bcb29

SHA512
1f20f5aaa8a52ef9ab68460b514dd6b87e2a028d671d66c3144279aa1200688bffe3aa27d092882c4097e9fa13a47eec3178c10febd74eb75e739b9f5c7b652a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
efcd83f70732dc526e1d5c5075f9d2b3

SHA1
054ce6b560f0f7fe00f0eccdc37b0519379a0c54

SHA256
fa0c7f9b22f8ee8eac8201a4c2c0879e6080a09657f15337a4c191be5bd85bfc

SHA512
102ef6a574f39c19ac226df17ef577bdc3a5fe675be61bd8451a964708ac858c030ec9bc4fdca005beee0418b71da00cd9cedc8696f84e164aa7fc7e2900fa89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
91c40658b7a8025fd3d113a6c2353136

SHA1
8ad3e75e0423e5b68317997d883b2b11c482348f

SHA256
13013daad331b0a5643f01dcbf4103321778c5a429792ca2e5708e0629b2aefd

SHA512
d992d6167bd73482ecd3018d4c9a999f7b0e0d36f6201902aaa0e73f14714d9056d69b70a3061f6b57e63d4e217eb086868a27be51bb3b3fdc96d3ab3ffd5678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d4bbf2db0101eb4befac89a13e9ea815

SHA1
075d3d943dedfd06a3000a5c9b6d549eaf5bdf23

SHA256
7d8dc519f8af3b932f7b96ec9ccafb5cb7eef059f79a02008131207ee41b7550

SHA512
dbe464d3b53a0f693f88cfced085a666ceb4257539ec66c5fedaccdcd6098fa332b4b34d9b2946eb0de67d9dceab0584819c77408985b3c60b53ba1d42e4851e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e966.TMP

Filesize
1KB

MD5
520019e13ad73a21ed8229ef4628ad03

SHA1
8bda5d9fd0d71812502b7efced8a009550e50c55

SHA256
8bf6824fd078020d34ba846e9648a6fbc689314f3692811126abcbe20fecf1ba

SHA512
0ad8fa49b5e0eb6fbb3fb8e2d62120781467698ac6b50136d917de406741da2e526fd0272f9bcfdbe64feb45468bd86812844ce5fe7148f52cf0cc21c27cf544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5edc9b9eec347d598717a4bc7592ef38

SHA1
a244817817e7fd9791c07a036c186ec88f2b6ebb

SHA256
83db8c12f6fba491ad2d583078028fa463fc26b08e1e57ab41838da47583b57e

SHA512
e823063e168e19479b329a6560121f71e06898b85be0e7e168cbcabc76b1f072f06c9dedc11eaf30e2623a045ec586327556f044f59882819ab9b22fe5f24852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e919a5fe2cc1f7289a46c41e5f76a87

SHA1
e6b7f44dc78746e648bce6d34ccf0cf54f955ff9

SHA256
c051801af69ea568ca6323191b721b9e5a917cd05bae88bd7d243fe4884ef22c

SHA512
f36e00d14ae8735b39b33641a6639d40b6f126d6fdfc7d312d59467d7b1d63191da6ae72bb6c918168c327b6b9de6da38dd73e5c428c0fe2e200df8ef7017e63

Download Submit
memory/4032-323-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-173-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-314-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-289-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-324-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-247-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-348-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-349-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-350-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-351-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-354-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-355-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4032-356-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download