9b20e2acc9c94108b111bfccb0e85b27c22a2dfc080554d13f4e50ff6a75532c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe
Size

210KB
MD5

bbae5428f764e210a080d7babf76195d
SHA1

5ac3de651702c4d736e0efb9d5a4fa6b8dc4993f
SHA256

9b20e2acc9c94108b111bfccb0e85b27c22a2dfc080554d13f4e50ff6a75532c
SHA512

73466bb966669722ebcb98fc5289c8c336d2d37d1b345a0ae177b7ff6e17d9c159e6e26b67a01d8ef9cef7952963755d07a225d24a80eec793d3fde6a297173f
SSDEEP

6144:V1VKW5UQv5BrXq9pDIcutytn4XXKbct2e:VCWaGrXq9pDIc3n4XgO2e

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
3996	msedge.exe
3996	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 1232 wrote to memory of 2964	1232	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	87
PID 2964 wrote to memory of 3996	2964	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	92
PID 2964 wrote to memory of 3996	2964	bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe	92
PID 3996 wrote to memory of 3536	3996	msedge.exe	93
PID 3996 wrote to memory of 3536	3996	msedge.exe	93
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 2888	3996	msedge.exe	94
PID 3996 wrote to memory of 220	3996	msedge.exe	95
PID 3996 wrote to memory of 220	3996	msedge.exe	95
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96
PID 3996 wrote to memory of 4412	3996	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa83b746f8,0x7ffa83b74708,0x7ffa83b74718
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18019882990892923933,9580739044586496322,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4204 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bbae5428f764e210a080d7babf76195d_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa83b746f8,0x7ffa83b74708,0x7ffa83b74718
      4⤵
      PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6075e0812c1de3f2dea96678fc016515

SHA1
8c6ab5860540df7d3f828c26dcc1cb1f380bcd92

SHA256
c75fde2347e336ece11a1b7f4fd6dd6baafadca49aab5400c594bcc57fc9d789

SHA512
0c1c5369fab2601896bb4f7fc071d39fa9558a445778fa60309f7c4ed952448b732bc5158d93ce53ac5a92c137d8540620b311d58cf444f7afcae70037f0d5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2f1458a51db166aebcf4e999bb2c2ac

SHA1
0beccfc8b43d8e6eab5f467866abd18b6adb1d76

SHA256
4e446c42eeb975bfff349d29ab5051cb9868aa9aeaed12e1b3139daad34be6fb

SHA512
1b2ba7eadc6439162d4db4c7b4e21864c9a6b2bc7525fde9778e921857e7b8736f1468b795dce587643cb236dc8dcb48205c4d029cf0860dd095a88ba73bca8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
775faa2869c25ed3ef63b13b25e7acac

SHA1
04d600526763d6f08bc92baa59af346316286faf

SHA256
c0edcd08025fff95079bed831135eee20e93c0c332370515305c33007c710b06

SHA512
d56703db642386d196289109b5502aa24a1551c047bed8ab493050071a0e87702d97f87b9c3b1a0739be09a07fcdc5f53faf3a30c19321c70867c698b44861b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06524e7533d19773e18d03eb06e03392

SHA1
5be7f9ba782e517860add8d674960e0d73ca612b

SHA256
e02075a557660bebbb4b46dc19ed0d0787f43b58632c22b9e8152a9d935a16df

SHA512
daac64e5b47f4e80883a788781f95b3a33669468a5e9f79a75c55519e815544071b73acdcb6c2342445c64c772541d6e5ef59fa825b0ac4b21a9e67d56b77636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3190f3ab53afa99d6e0b8cf3bfc5ea93

SHA1
03702e60d1870b212dc603dcee8787557f73032c

SHA256
be21bbba19937c528704bfe4f6012798332ed56d00619ce359e88024acd5d1e6

SHA512
db24b40acc0046302f33d12ecaa01262242e77f15f4b58bf882b27a5135de2a624228531aea9dd6d57a9cb53df7b7b024d8bf5f9f69a5af3f40489e7577b44f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f80c.TMP

Filesize
369B

MD5
f09b4bedee64a87c7054b0344f136142

SHA1
f800cadc1ac47bacd3752a51bdb1de5a02fe4b2f

SHA256
0cd9fb7098967102574c3eb65fd61f8282ba22ee6282ecbf22cc7d0e95f3ecb8

SHA512
15df28c4c9c723bffe31e64a8130f60ec7da20b218d5daa85670b78d12b51931a0bc5beceb2118aa05204a15f4607edf84072b623b7b7ea9924285957e444773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa0fd1f67fe8b23c61a0627620081689

SHA1
7ed45195067dfc6faaba1480d69ea3100cc72004

SHA256
305f4bd33d4fdfd79d7aa560fe6a7b58910c2f0311d0623256fd26d3b0e91491

SHA512
370bd1f15959a6f7e90ac00d8db1b9b113796bee95fa356ecc408c60b5de056e64061bb8730c4b75473722bc2e9710bc3541e845ff468d10dedaaa474e463d01

Download Submit
memory/1232-5-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/1232-11-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/1232-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1232-7-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/1232-6-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/1232-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1232-4-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/1232-3-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/1232-2-0x00000000754B2000-0x00000000754B3000-memory.dmp

Filesize
4KB

Download
memory/1232-1-0x00000000006C0000-0x00000000006C2000-memory.dmp

Filesize
8KB

Download
memory/2964-8-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download