5e894d0c79e2fc4f9363ffdcbaeed337c8d9bbed1fded4714b58a6f16b295b30

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
Size

153KB
MD5

d0f5ad9449ecad7d1a3f3f8850d2e6d9
SHA1

fba5b6ac92ad1adbba299fe19c0b0f89c6ec19cf
SHA256

5e894d0c79e2fc4f9363ffdcbaeed337c8d9bbed1fded4714b58a6f16b295b30
SHA512

7d8227cf6f09635b5239d079e1fbd6e740b8a7fc048bc3a290e9005c306c0c43234ee329d52a54164effe3bd5c78a8b0cab90da17cd279dbaf99dd55dd2d3300
SSDEEP

3072:kfJNVAthYInlmX+mS3STOOWAHGhc6CdRah4g:ONVAthvQS3GOOWAHU3C/ay

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\c:\svchost.exe = "pppppppp"	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sys.exe = "C:\\Windows\\system32\\svchoslt.exe"	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\lsass = "C:\\Windows\\system\\lsass.exe"	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\c:\svchost.exe = "pppppp"	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\key2l.dll	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
File created	C:\Windows\armoon.dll	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
File opened for modification	C:\Windows\system\lsass.exe	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
File created	C:\Windows\drivers\svchost.exe	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
File created	C:\Windows\napishell.dll	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
File created	C:\Windows\noctam13.dll	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4312	msedge.exe
4312	msedge.exe
2100	identity_helper.exe
2100	identity_helper.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4312	2616	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe	85
PID 2616 wrote to memory of 4312	2616	d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe	85
PID 4312 wrote to memory of 4592	4312	msedge.exe	86
PID 4312 wrote to memory of 4592	4312	msedge.exe	86
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 2404	4312	msedge.exe	88
PID 4312 wrote to memory of 4584	4312	msedge.exe	89
PID 4312 wrote to memory of 4584	4312	msedge.exe	89
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90
PID 4312 wrote to memory of 3752	4312	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0f5ad9449ecad7d1a3f3f8850d2e6d9_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://noctambulaar.my-place.us/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe58146f8,0x7fffe5814708,0x7fffe5814718
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4255087020922138525,13758599688628298936,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2956
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe -send
  2⤵
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5b57a608e983c92133dc37b2bdda87a0

SHA1
4275f055f3408015c2ffbdc11a1eba329e1e63c3

SHA256
49b4a2f201d8cd5bc158fad4c8dd71a7a9693d11f761f5e3c6859044b77e1be3

SHA512
89a4597eabdce4eb7b68841cd714f35b6028d2db03f4f66dab18aa1896c48e717ba5b81f46a036454e79a34bdbb7a567bb740a0354ab802af83543f2d480cb39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45656867574b331b85db131de0bca56c

SHA1
b069e5f416630d5356a0110b85f309e57061881a

SHA256
4ee7d0c36d1144c235faaa4c3545369bf2810711eb08646d63e08ff121b6608a

SHA512
89c6598d83da6065a0bcd418d5698b2c8f0ad0a363d6164246136dc5b29018096293de084f2841aa92b6d8a5c02897439c4716ea73fd2d6c70a4e8472309bd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
173b6eadfc969bdb337527ed556f2b8f

SHA1
3a50923dd099f69fcdd2f85274dfb8b13bdf4fe3

SHA256
21612e68539973df6cc138be3670f24d945c00ae241b7454a24bed16ba478b17

SHA512
b0305f2cc615cbfe5e8ed8dab33ca856cda195ecdd25cb5535dfb3c8b2d7e30b77af32243ce994fabe21d9b8444e751ae2b2c2c0203ad2497e23732c34b84cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3991b78c6ef98c491989da0dcd6aa688

SHA1
988a632589300817f0dea2c6c97dc405d119992a

SHA256
e3e04b793cb4f40315176fcfebae6df3d100feb83e2d2867123acb594149ed24

SHA512
2eb072a22c8032b40cd060c7c7db32fd0cb0c2c319a50b2f60b16913a9bf3a27c22c307553e817c8ad3c08ea0a0d83d64045142380596b3b76da6997a4a84a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
90da0b85129354cf7506a95aceef8d81

SHA1
eca73abbe7ff3b24998550c8c374f3d45a82e497

SHA256
e6a36ad5ee36dedb90534be8e36b266e5f632777d1ab642da600ed7ab33ecb52

SHA512
891d31f40d7e38bc2292a3765050cdba8b1ef6a06cd196583434a3b38f0e65f7f69af96be187f3c0089db30209a4bb43417682049e30e7010a6d2b858b923a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
13KB

MD5
68e912ca335a8fb536c15b48576d9ef2

SHA1
e7cb659f9038feb5c52b081f1a00c8e4ea33da30

SHA256
815a7e6a847c871620ed1c6a5e38c51b4fac5953d46b64f6862c32e830b8bf9e

SHA512
46334b3ab3cb57483df4b1c6d702802916a010448de09354aa01e6e26264dc4c1997fe056338c4343515b9197d5136af4b967261f7858402ed2f86bb8f6f712f

Download Submit
memory/2616-86-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download