4733036cdd33710c38fe9a7df00272662f230d48235d5e0ecdd2c927b15a0ec3

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe
Size

200KB
MD5

88c0ba0634194cd38299cc769b940395
SHA1

b7a4eb549a50bad99f7b21c66793609edbd72017
SHA256

4733036cdd33710c38fe9a7df00272662f230d48235d5e0ecdd2c927b15a0ec3
SHA512

a9dfbd3448ffadc77dd9d0aa46e770647cd71cfa53d778a3da1b28b8af8c1ec9af3652ebf0ad365e1dc9b48c1e32e40d751df3a3678d7ff423aa8c48f0789941
SSDEEP

3072:IYNxSSMFa643Ad4xLPctJO12f4PLjmNDtiY5fCKjlfX1fRZtJO:Z3AOy4jjHcfvjl/1vO

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
2908	msedge.exe
2908	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 520 wrote to memory of 4688	520	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	84
PID 4688 wrote to memory of 2908	4688	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	93
PID 4688 wrote to memory of 2908	4688	88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe	93
PID 2908 wrote to memory of 2628	2908	msedge.exe	94
PID 2908 wrote to memory of 2628	2908	msedge.exe	94
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 5084	2908	msedge.exe	95
PID 2908 wrote to memory of 4332	2908	msedge.exe	96
PID 2908 wrote to memory of 4332	2908	msedge.exe	96
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97
PID 2908 wrote to memory of 4968	2908	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90f6a46f8,0x7ff90f6a4708,0x7ff90f6a4718
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14399577878006046889,17937910681994026033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=88c0ba0634194cd38299cc769b940395_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90f6a46f8,0x7ff90f6a4708,0x7ff90f6a4718
      4⤵
      PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
acca1b8981413e738e9a525e78985fc0

SHA1
4eb83330750435cc15f602739e0d07726413ad1d

SHA256
c7bf2efdfbffc6cca0d89b615c93580b9a6618d717862f8f636c8741897069f2

SHA512
cc834209a483979d52020c77a77e45452fc3d0e470ca588599c7ae3b6ad48736d58d59f72c861c6f8cabd1db78ea3b607b499b8dc3c8f5a00c6f51a91c99db2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6491ffca0a36696133912d55a11b0a9c

SHA1
226dd388bbee2c5cf362d3a26a610e37a975d431

SHA256
53ffc61f7f6527c9942d82a024169396caa2579c1ba1abe0a207c936a915d0b1

SHA512
4a6e18775132106cfec7b9e3d6c0223eecc4e5af305f3a939dbd6d5734233af643572ce662e843b9a517da3c78abc7d6864bc6d39e169fa7245d0aff9d94d05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
689f4e0644c70b1391bc775aa90dab7a

SHA1
71763e6e827e57dd938ce2859347eab2e5abd559

SHA256
5d8fef52a73148697fa3944ac0d5a8a6c8747cf2a88bc2e28ae7c9e154e73905

SHA512
8a1077c880451ee7e7202183fdd8fd7c92e35eb39dacc940c1b975d41e239d7ea29f708dd373d7b260e0028a8a59b79b510c381304470e811091aa872381e8f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22e8048bc6fcfc1cd7d64f3d736ecf92

SHA1
4022a12892b63d5394fef1f342960025bd7f7715

SHA256
fe6cdcc4b4919d2e96aefd4a0542dc556cd1d2504f5243c9e2764848ccb68903

SHA512
47905e773b728d82bdf1e31b43c44aa5d448da4c72d3f20808fca0f838ca7638fcb0c5255608977556a06eb14c7142aa97f4b0db5c4deacfa8692584e5c4ed84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
90669594c53fbfa36251c89ab165c005

SHA1
e43f94d85b8a86b57315dac43d378c510175ed4a

SHA256
1a4d8ad4a8389f71ae73afdd1df997d9587e2df676bfc2b713c84aa81a2bf522

SHA512
60865e0290281d7318df025729546aa391794ca071b749ae5fd7304cd9455412e4b701d5bd9c2b998f26d9f1a64c09bb84344d4133bba182346f16912d3c8e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5824f8.TMP

Filesize
369B

MD5
c927ddd8cdcd498625410901ea22eacf

SHA1
98d41527060e8bab7909fb82d0ed049eebe1d926

SHA256
07ac775b5707ca946fa1e282a514503b27b7b58accf3f263c6da90e36173f6f9

SHA512
e65c990ad08af9bc9268727ebd5db0d5e78c87606869aca29216ca6194eca9adc6172e327d845b7cf5a4ac4dd1552f28f3994ae712a966f6a8ee52217ba54f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
185ccc4397b85d02479c951e479b249a

SHA1
f5e38683336dc923f2032abd08ddeeef76f9925c

SHA256
05ba7d16af050f925508ed316b3b85867de1ee4452ad99570a5e334204036546

SHA512
1de1ba05e5a81bcb62900a1ff93fed2b5a9eb28645945df9427fc44756b007e6ffc3cc98b753f91d9efa89215481e82cfc6eb41af078356f4c49191a75cb2225

Download Submit
memory/4688-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download