359d3cb2f745967a00bb0ecd52ed4b4e8099aba942f420d2869f455f97f090c9

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe
Size

500KB
MD5

d063bb502ee1c5f0f0763c9678a163a7
SHA1

f64c487703de6e7b7e5fdab3e29e29319e0b9748
SHA256

359d3cb2f745967a00bb0ecd52ed4b4e8099aba942f420d2869f455f97f090c9
SHA512

8efb857a98c5435092dcb0ea817e9b229cbe36c1ac30fd5278c7aea473aeadbb609d0e02081323905033c589b7ab690f1f34adaa80c96fce6683b02379c9a579
SSDEEP

12288:ACAkAVjE8+wAforxmhfnCyFAwqJZtpBunQCcOKB1TLSD:siHCvPB/wD

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4488 set thread context of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
4260	msedge.exe
4260	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 4488 wrote to memory of 1848	4488	d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe	84
PID 1848 wrote to memory of 4260	1848	svchost.exe	92
PID 1848 wrote to memory of 4260	1848	svchost.exe	92
PID 4260 wrote to memory of 2524	4260	msedge.exe	93
PID 4260 wrote to memory of 2524	4260	msedge.exe	93
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2688	4260	msedge.exe	94
PID 4260 wrote to memory of 2012	4260	msedge.exe	95
PID 4260 wrote to memory of 2012	4260	msedge.exe	95
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96
PID 4260 wrote to memory of 4720	4260	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d063bb502ee1c5f0f0763c9678a163a7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccb1646f8,0x7ffccb164708,0x7ffccb164718
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9135089874281782078,2597629535498409909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccb1646f8,0x7ffccb164708,0x7ffccb164718
      4⤵
      PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
034e05b5dc55af411303f2c62a7df271

SHA1
8e5fca1cd49579a6c6b6a928c6507779076bfbb1

SHA256
e1587fc9ba6e8d8275757b6e7c36d58ebbfd39f4e39cea25554514f27817dc01

SHA512
63a97d73719eb8bcb6542dbb45ccced46dea4d518e65f2878d5a8fe791172a6be0e8fb28fab32a5723e9e94402aa1416eeef82e5a247c88553d3cf093b24c8e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04c8784f6b5fa127189a9f5d4e30bef8

SHA1
10774ae1e4439846e34c704d81fbe786f2ef2765

SHA256
2b1c4f845ff7b75b1ca79aba053e431bb434bc1733a743343b52c21bc8889970

SHA512
3fb80ddd41ef41eeac3e71df869bf3cb0aad3e6e297df1c126a5e09c9dbddb0d4bdd117e2bdecd71f23244dea39739ae74842f27a0dce78cd42b798a9d4ec426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b43101a22fd7d3a4c2c69d0d23d72c3c

SHA1
2dfe51ba94c1e19cf83e8f9fcb395229d2dcf6bb

SHA256
63f9481a45a130d4353b993d39f76825c20e2bd1b4ea4b4e19f47985dc90e5a1

SHA512
e5f60a2ca43876a553130cd1ed707c50c747f552b5b149c47a247f089ad64bcc29f51041ba91a4e5307bfd7a133e829606156445a5d3bd9aff69e8a039456fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
664348e8b7bdddc98d2198ba80783278

SHA1
37faffd05ece327074890b13941b356b818de516

SHA256
d85af2c5caf460852f39588cc37ff39d233aa2dc7460665562ee2b4bf1085e99

SHA512
e75bf67daf67f1790b0ae683ad0ffbb082af4ebf817c4ddeff6523034710a9aa4330d5e8e2e110ef64dfbc4ba43d2ee01118b89275e2fb98e59f3fe4fdf5b7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0c0325b0f27a7e91e9dd2d016d4972f0

SHA1
79f4fbfbab5fb8769e7bbf892b33b0eb6db3be19

SHA256
807a6919237320286cc0726bdfb12682f76326b498a45231b14b7cc25421cdaf

SHA512
d61f44f00bc76849576a27328d2ea620c6b21842efc204ca5a1e2b8a51d6e8bbb852f0d268c2597a3d7746a494777d4bedd830855d46179718e9c397fdcbd5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58220a.TMP

Filesize
371B

MD5
cc2ad3a21dfe6fbc6d27e66702bd0ae7

SHA1
611e8882af32de29decef9ba079b18840a092e0b

SHA256
41d5f4c7db8a791e3e58abb4b9efe67a34bb086067f118cc7e30a431a9cee046

SHA512
47831201a02609759897a6c153ff5f43de554926fc7d6fef132500368c1b9106560051450126ef967cdbfced31111adb4ec01e61565c132c1bc4b310a59235d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
371429b90365f912ccddde84cbce8211

SHA1
829bfb73ddbf9f2d6a1635a5d3cdebec2f2cbac0

SHA256
9b5c81645f959884ee0cb0d1644eb6a60925a70ad557d4fc867b80b29cc6b26c

SHA512
d14d83319a0486733fcde524b23e2843ae22d4a3611d5562d90a760faf151cc221d60e4493dde3f48d83f35dae2ba7cf8b7efb128764335023e327c811cacc90

Download Submit
memory/1848-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4488-5-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4488-6-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4488-0-0x0000000074D62000-0x0000000074D63000-memory.dmp

Filesize
4KB

Download
memory/4488-2-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4488-1-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download