fe49a08531fd8c00bcddc400dca8f7112d03cb27cc8ddb603629384071a7898f

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe
Size

19KB
MD5

68324121dcc74a665f07ae0df41393a1
SHA1

f89e79786516fc853b6af4ddaffeeed180c7c427
SHA256

fe49a08531fd8c00bcddc400dca8f7112d03cb27cc8ddb603629384071a7898f
SHA512

3eacaffc6992f17c5ffe3a01aeb4c609f1996cdee86ebe376c955528545a4fd54546a167d0880e80310279dfc51df84c0b84c40d546ffab7c7e683e3d20325ff
SSDEEP

384:8WvWJEC/C22vD9FuGAKU187WCidc0o/BAgjW6LzGO:AECq22ZFF7WCid/oZAgjDzj

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4640	cycxfxtls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cycxfxtls.exe = "C:\\Windows\\system\\cycxfxtls.exe"	cycxfxtls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\N0TEPAD.EXE	cycxfxtls.exe
File opened for modification	C:\Windows\SysWOW64\N0TEPAD.EXE	cycxfxtls.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\cycxfxtls.exe	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe
File created	C:\Windows\system\N0TEPAD.EXE	cycxfxtls.exe
File opened for modification	C:\Windows\system\N0TEPAD.EXE	cycxfxtls.exe
File created	C:\Windows\N0TEPAD.EXE	cycxfxtls.exe
File opened for modification	C:\Windows\N0TEPAD.EXE	cycxfxtls.exe
File opened for modification	C:\Windows\system\windll.dll	cycxfxtls.exe
File created	C:\Windows\system\cycxfxtls.exe	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cycxfxtls.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "about:blank"	cycxfxtls.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "N0TEPAD.EXE %1"	cycxfxtls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
3880	msedge.exe
3880	msedge.exe
2392	identity_helper.exe
2392	identity_helper.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4640	cycxfxtls.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe
4640	cycxfxtls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3880	1376	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe	86
PID 1376 wrote to memory of 3880	1376	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe	86
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 3880 wrote to memory of 4996	3880	msedge.exe	87
PID 1376 wrote to memory of 4640	1376	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe	88
PID 1376 wrote to memory of 4640	1376	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe	88
PID 1376 wrote to memory of 4640	1376	68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe	88
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 4040	3880	msedge.exe	89
PID 3880 wrote to memory of 384	3880	msedge.exe	90
PID 3880 wrote to memory of 384	3880	msedge.exe	90
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91
PID 3880 wrote to memory of 60	3880	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68324121dcc74a665f07ae0df41393a1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.18hi.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff562346f8,0x7fff56234708,0x7fff56234718
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,83465919671429066,12734150512936324644,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
- C:\Windows\system\cycxfxtls.exe
  "C:\Windows\system\cycxfxtls.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
70000a15520d980c5ad72ce0859c1d94

SHA1
e010c6077207e66e491bcfd8b1b5a8e52484c457

SHA256
4e22167a5c5e637d20fa307c46643f237b38a322076839372a4ee218fdc38abc

SHA512
4d2f590a91f2aa999898579bed8068411d97f59c5a7f634573d7a74ea7d5df6db2396b3301f615a6b23224714f5c650f2550b3413daebc04a50595d80c390d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0dd95072f0bac9ade269454d02861f81

SHA1
70266065cfc99e2fafd8dc3a79eb8ff46ee1db90

SHA256
8f420ac2ffb396c8fc858f2c7735aca3296fe54865f4b01052a66ee442e53ae1

SHA512
f48064d2e7b9fad637087f8e5f6e7720d76b76be2587a0f3d4b160547538f1f3e4848b14f9236c0da8bdf7e350067778e2c881c37dbc521280465f200f29e154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
589B

MD5
6c6be064abbfee9ed7425de9c6ec352f

SHA1
ea9229a201babd65551832a51634578c609e9f76

SHA256
04bb5777e5f65b447f956327e2c777ac0542a51ae89f9823f534225ca68e1586

SHA512
8d53a6d74291b808a54cd1dc9ad1d718da0d80bc3e8622f112ab83081d8f2a4b780787f4b3637291bcda869833972aa41dea9baef1c98cc54192c1c88dd02500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb84e2556544922f83a6ea57f55696fb

SHA1
1ea8c7cd05104c848cd375c656c72ae17b290d96

SHA256
d02476c7fd618cbf5be698c29c9938d256c05d18bfdd5df45015faaecdb173bb

SHA512
ccd0231dc3764116bd20e2e074408a32c2342b65a1d5cd4ccdadc6c926efee0633e395bcfebacda6c94bbe1db1218e4a7de891e87066230f539fbd2fe03bc5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de16158fd89536870918bd1e22d2ff5e

SHA1
7679b97eb1f7f48172385bee8b65f73be3ce5f92

SHA256
7346e07a0832ce6c3eeb7db92266ce29004346d01a39c540045ab155ed39205a

SHA512
211a4cca3fb0d83f5538084c1e61f7465469b49684d799044e137b4bea185f7342fa956eea7786faa831e4daba145ff80612dea18624e6035ad71467de71d7d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56204781c0250c747f0bdf0c10b45a29

SHA1
21b9de2dbabdb36a1312ae7d07573a3c420cd176

SHA256
60225c5b73a70297af65611d3f80a7c8ba697dce93d3407b116bf8f922e9a370

SHA512
65c452ca675c2258860facfc6e1e78994eb932ad040a823db2a7e87e3003a73c991b93bdb76e6fb67cd2ce2750459366165a40b32880c8afd6f38f37d42d0caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
521c6979c7f9d8895ed36a57d5621a00

SHA1
36fb172115ab835eabbb1aa1783e6012cbb5609d

SHA256
a10dd5a9d53423234406d994f56df6d42337494b183e3276ef6d65ef379dd7e4

SHA512
3280edd1cacd7ad3e79066032a2d5805bfc84d3243189e8ccc15bcbd4891baa2b7fbab1b65d40ac6ad36dcc376d60e140f9251c13ff88f65860c8144755b7327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5853f7.TMP

Filesize
540B

MD5
b0a538fd2a1633c0d0d52bc3431316ed

SHA1
be23a31b5d93a2f37c11108f028732899de9ed25

SHA256
8087c48cbc628830cea475739608d654eb06201cf4bdc69cd35d48dfe36de3b2

SHA512
bd7004d58e3126308d07e77adef4af0f407bced0404fe0a4eb302f99b3f262535721b06520507554f72834252cc894f51092c92f0f839f33b2397ae17ed8c6ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eeba4f7c5edc570d0a3306ac2b5bc604

SHA1
25730b42d05e73cf46e43a16da4381a80a523490

SHA256
e5809c74517bab11633f0bff4d57c319e7e53710f4cef4cc6e1f8c1e2ac148b5

SHA512
246e386dba83984039f90b31376825fab674c6e49998b72079897fdd6eecc879bcd20f16debbb88118fc335f79150076980285d77b60de023a35aac2c720f67f

Download Submit
C:\Windows\System\cycxfxtls.exe

Filesize
19KB

MD5
68324121dcc74a665f07ae0df41393a1

SHA1
f89e79786516fc853b6af4ddaffeeed180c7c427

SHA256
fe49a08531fd8c00bcddc400dca8f7112d03cb27cc8ddb603629384071a7898f

SHA512
3eacaffc6992f17c5ffe3a01aeb4c609f1996cdee86ebe376c955528545a4fd54546a167d0880e80310279dfc51df84c0b84c40d546ffab7c7e683e3d20325ff

Download Submit
memory/1376-74-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1376-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1376-1-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/4640-72-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/4640-139-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/4640-133-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4640-71-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download