1ecbfe255a98a7743a3968d0f123279db8e72a886c21b7fd30c13bbf2942f3f6

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe
Size

28KB
MD5

25d87a9aa8e55cc20d21cbd328c70304
SHA1

2e04f614f782bad5fc675bc6d79711ef28d33e7c
SHA256

1ecbfe255a98a7743a3968d0f123279db8e72a886c21b7fd30c13bbf2942f3f6
SHA512

6172a1593d701062925283af94fe21f38879d514ddcaba218970a8b8ab25aa0df9d5f927b47d543acba303d4c8d663c34580c62a156c1f1dc739f2b501684df2
SSDEEP

192:/T95SHl8Acf8yuUN2KI1i3TKbLfjDHKQaX8YD9S+6Ew8Acf8:/TlzuuIvbrjuQaX7D9S47

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sun.exe	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msnmes.exe	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dll.exe	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\javasun.exe	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
3768	msedge.exe
3768	msedge.exe
4300	identity_helper.exe
4300	identity_helper.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3840	4840	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe	83
PID 4840 wrote to memory of 3840	4840	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe	83
PID 4840 wrote to memory of 3840	4840	25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe	83
PID 4480 wrote to memory of 3768	4480	explorer.exe	87
PID 4480 wrote to memory of 3768	4480	explorer.exe	87
PID 3768 wrote to memory of 4544	3768	msedge.exe	89
PID 3768 wrote to memory of 4544	3768	msedge.exe	89
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 3304	3768	msedge.exe	91
PID 3768 wrote to memory of 4548	3768	msedge.exe	92
PID 3768 wrote to memory of 4548	3768	msedge.exe	92
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93
PID 3768 wrote to memory of 992	3768	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25d87a9aa8e55cc20d21cbd328c70304_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://voxcards.ig.com.br/imgcartao/cartoes/13/c13_amor_inabalavel.swf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://voxcards.ig.com.br/imgcartao/cartoes/13/c13_amor_inabalavel.swf
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa24cc46f8,0x7ffa24cc4708,0x7ffa24cc4718
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7755325972750608908,3526639798859032301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
602c95d5fc27a32ba7250c47fe908e9b

SHA1
ca087085cc8443401d4faaae1c8a8c09dffdf85d

SHA256
c69a6ea5efad5c157785be39310801653baed127e20e869f541f697de3e8085e

SHA512
c03487f9d57d9b4536a761bcb596d2c8aff45194fb380e03eae0ce9d96f0761aa10a4a7bef0bc93ddc6a90de19ceba1d2f554177d1847fc044a582335290f974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
351677615fb8767682be0381f7268c2a

SHA1
14313ba9a7d25e4ca4d1a4ec12c8e0df9b380814

SHA256
533dca87d7bc9fd7b4928997e6c9d6848de79122e118a1926b7194e22782ddb8

SHA512
1bfb8c4370541b5aa64452bdac3094b658bf52e80eb5bad4ddb2ca7ec97f70d8958848b09c25efb7f89edceb33c2a8a700bc2abdca34c9b31ca59a71e17ed10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
3ef69ebb054554a5f6e190a0ff402fbb

SHA1
c180de06e9923f47c345940883a886b5e42ea67d

SHA256
6edba725c17b794be154b13c24ed10919968ed20da6d3e2ef06ad69617714073

SHA512
e320f7b80eb53da86439045ce027c7e79d81792d75ed39d3d30528e4345e7153573a523eb1f62b65da864496f23dcdd5fb460017c0369730d557bd3e4a9347aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
82646a3dc10f52274fab144cc440c536

SHA1
a74b95a8b18a9dd97da2081ed5743f1402a93ad1

SHA256
a313ea7107c32787289aefda76b7661602254cdf005b5db7b1f3dae4cbbc5ffa

SHA512
3bcf8ae951e6f918de4080ca602d4f89197246080749089a13c3cd70564ba54e9ced6dbd82da0df49b54b3d025cde6304bbbd21e2047b57721284c7bbb61806b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b96988a3f5ebbe248df495e2b8dec39d

SHA1
cfd4973f68280d6915ac7abf8d8b7ccc178ec7b5

SHA256
1a96c8273028c92686c690282e38f8f7b2a3ea3e72069cf3485469c3d11c4a74

SHA512
bec875ebc69a696a357c21554d67caa1196499e3dff4a5327eb165777fdef757d87ea6b9927a6812982ed5f644f07e767ef51d261fabf8a08e76d39e3994796c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
6b550cc81db0f298141645ac9d393425

SHA1
10eb30d657ff3abe9c01fae22fb664d95af1eeed

SHA256
1929b13ce171524e9f0f9df0f8628170eaa06904d0049e7969afd6ddadf5efdb

SHA512
f192d7e26b5739b8647d7d1a48a068c04b775241aea34e77df8d2009943ba97ac9c2f12f402c2d0d36d595ee5624d0f4da45bb3c7b16eb2dc75622e43b19f27e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b042d51ae608c31e6ee2bf49d34e6eba

SHA1
959097abd36e6490ff05fd18e47c46327272342b

SHA256
4635adf1924a575877a2db33cf3a6be54a1b8f0ae5c4802eb05f8b0629499c8b

SHA512
2d1a3c2b158e0f9c71ef073d8c5569a3a46813ab4cd152cd9e17c8991854122ac16ca810f0d65d8830961c1de0371bcdd3bd293aa10bbd427946463f062fe0a6

Download Submit
C:\Windows\SysWOW64\sun.exe

Filesize
87KB

MD5
b80d7bbdc2b4c36694d44f22e87d21ec

SHA1
366695b0ac9e8efcc8a22061a1fe9256bb23e795

SHA256
17528238769dc0659a9a0270fd0410e67eb8ba2017f5a5b7c4479af962e86739

SHA512
e00ed621d3e49dd84f94777fb7a995c2cf957104d31842d1af093b34335f699a4c82c45619e952cf8706012b1639e9a3e19de7f3bfdd45e15ccb56ada7c4cbb5

Download Submit