2471d933b7ac44f37bdfba0ba167167594801820f344f2261741411a3b2d9c76

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe
Size

142KB
MD5

6eeaa00a79dea047d28705412373a778
SHA1

f322bdeaa070f950de13bc0c0a28e022863e2f7f
SHA256

2471d933b7ac44f37bdfba0ba167167594801820f344f2261741411a3b2d9c76
SHA512

23bfa6d9d13c69ec9d893602334d79284afb3f5dc4376c5008960521b3742b969c8deba5baee69ebe718bf725a33f13b684f91e9fabca9a978215caf0f70bda0
SSDEEP

3072:gdcgV9+GQSMaJqOgwQiIY3GW1IASKvoWPqRyZm/r81:9gVQGtj2SImbuAKKwyUI

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/memory/824-0-0x0000000000400000-0x0000000000483000-memory.dmp	aspack_v212_v242

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	824	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Software\Microsoft\Internet Explorer\Download	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
1244	msedge.exe
1244	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2696	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1244	824	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe	97
PID 824 wrote to memory of 1244	824	6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe	97
PID 1244 wrote to memory of 1072	1244	msedge.exe	98
PID 1244 wrote to memory of 1072	1244	msedge.exe	98
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 2496	1244	msedge.exe	99
PID 1244 wrote to memory of 3212	1244	msedge.exe	100
PID 1244 wrote to memory of 3212	1244	msedge.exe	100
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101
PID 1244 wrote to memory of 1172	1244	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6eeaa00a79dea047d28705412373a778_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 388
  2⤵
  - Program crash
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=vsd3g0h_vs0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2fed46f8,0x7ffa2fed4708,0x7ffa2fed4718
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6547258820641499739,2109548182115453697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 824 -ip 824
1⤵
PID:396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x380 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
7bfe78e26f9e8b78a9edc34ff449da73

SHA1
07e89dc568141aeccde92ffea1ca51ac1477195f

SHA256
50c8f771da8963c2811c3323b52ecb83d63df3bc4b423df56c08b05b322f27f4

SHA512
208edb3a5855d5a3369e65ded53d8988c4bd275754f9c994278915774a69f279fad885b4b7ef1088089f476602e1de3d3d4ad58a3fbed3b99a58c5c5ffd672ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
048012b38ed0956fc2663ec04365b711

SHA1
e3b7936eaf349cfd3eb47365ae8771bf9a6183c3

SHA256
331707a3d8d766b840cdc8411eeb987d0f4f8614238c1e1178f2851477c413c7

SHA512
03e4b0e9c27bf2c21d5e48af31c808e20385cba777ac391e95103ccd0434d9378cc096bf757116f7c898f65e3550972da34cbc61c6a9133eee242a236b097e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a204477fff956b682fd48dfeb3633702

SHA1
92d08c6786e26c6ca31e834c86b963fcd8d99b4b

SHA256
04eb45f80ec6c4bc4b662ed2b720ff1761baa89de54a135af807b15d514a0001

SHA512
872f93968360202ed64d0070374306fb1f0c970ac46285a8c5b409a427e7fb8e9a4243c8c768de50e8818222fc643f612849776d75dbc1a42210ec9c2433caa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7320379446f8cad4d49af7852ac42ec

SHA1
55929147248e5fffebf511ea858a706d9caab6c8

SHA256
86943652ad10665a9560df252edacd6afc0f4db11a64d4f19fede2b90a0e4ddc

SHA512
81aa633a9574ef2ab1270ac8a1994e6b0edcec5933c77c5acbf137f734bc17844c4d695081ea95475411193c167c946e850591db66d06dc0e35fa62652ed70ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29f7bc746a44cd62e8a03e304395e04e

SHA1
1a564cdc61e0b5bbe839bd49329d727b3ddaa91e

SHA256
11e5f1a6d7afd2321eb413b13c1cc79bd07abce9010b23dba1cf956fc5be8bf2

SHA512
0f237b58da736e1fc6518b0b9c40b8bdfd871b3a2b434bca8f3770f2b9993268e17628f96608fa1ee79d926bda690c30ac46124e81fdbdb6317489bd00682034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7dba9126-86fe-47ef-afd9-40a93f238235\index-dir\the-real-index

Filesize
2KB

MD5
c52fafdcf5e5fc5f34d3b269b369f037

SHA1
d4a0468cebe2a13ab85a32d8b0e00e9873ecaf64

SHA256
1c69ce17dd6181de854d038c137c46aeaf0d15476bad47a8f057cfb6638dae4a

SHA512
65687b764039432f5b9c60f32680006f911f4fb9f60f78f5f763305493b4689d487de1ec354c65c6429505816110d4be96d8063c3cb13f77f267618cb9a8ceb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7dba9126-86fe-47ef-afd9-40a93f238235\index-dir\the-real-index~RFe585b98.TMP

Filesize
48B

MD5
8473ca14e681074c4d83309f7f11881d

SHA1
c148384643bab69ed1351e304f167fb2a4f62904

SHA256
6700ba04a045ec8ee717027e4a21a713dc743b3554e9cec1ecd859226c45b69b

SHA512
226059d4054c52d0bae932f366665d52db9ac11a2a3e92ebde782055d81a8c01dadd9e0e6eaf33d13f611cfc62cd79c9435926c82b9fc50d0f6ebfd5f813d416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
5671805d85005bb4a1eaeaff11d0a233

SHA1
5d8909a85b6e5d9d04802c8e0152c90c19e67520

SHA256
20349e8c021e89bfe3323561459dac7708ac9fa7cc16fae0bc5757f1b969be96

SHA512
0f391563b03033cd99af67caac7bd6d32929320b0389985891ff7fe3393652b764b70b99a1838e02c4e6c5d6b4cbe3198a8c1b7335ae4ae05a0ced3e9ebfe281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
fb3a565cebacc3a962f6c688e32a0044

SHA1
25518a1a15d197526532a0cc8ceba7c402161b28

SHA256
9527506acfc8577ad8aaf6eac472bd19b682dd2cb514fba79f4c36c19df169dd

SHA512
cca92549604742ad16193fda240f72209c90bbe5de70e026cc570a2477859c53bfc006492d885c583a0e11f9e168fa68556002a99fd3e99327b47f228a7a4136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
1939753212eb5d3234b641a1f3269a86

SHA1
3b8b1cd84251418346ff4a813f50ac3a30682acf

SHA256
3c89667e00ac564795cc70617cd660b5387a2aa7eddb71fc5bf8102496ebd855

SHA512
40f9610314efdf6f86fc363cf545cc630589fb9cce994791ea8959291403d45108dfb8597ffd668fc7c2faece2ad0228680ecdd7df64369d66d95ed82b1aeaae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe580402.TMP

Filesize
89B

MD5
e860ad01bc3f29056aad182fca8a6d2b

SHA1
4fbbad5d7b609d3364d0b51d793a5d97e6d25025

SHA256
2bca1c7d062d784710ed23103bad810ccc1f5e6f946dfc36215408905c91013a

SHA512
06668d8afc40e6cab9af6dee4670a45bbc787f8d7aa8a9edcbc8ee69de212d4dc358a817c9c7d93418704aa65924f3a07a161bc5eb227d72537a71cffc88e10f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
863dd73f34418654adf96d36d22d72e5

SHA1
8e276192a4911d62913a3d203e8b2c14215e5762

SHA256
7e07e423b30576cde6a8f9a428c9255727fcbffbc0bfd90348261352db6e03bb

SHA512
fbad76c2be3feedb116fbd46e0f2d883322bba7ff0b43d52384e1d2826d39b891fe49687b9d6572ea85f0ab86de8ac5488d55a259a83c6ea24ed7ab7bda20517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58531c.TMP

Filesize
48B

MD5
4ae5c83d28632302796acbb1c6939695

SHA1
790ff1c32ca85a5e9ab98294f86facd7565d5da4

SHA256
71f20b768b877b636ad86775fa1084c5bbe8979cb4dcc399679bca7f5605172b

SHA512
cb8e637e0a5af2c676ae9149f3e8af9059249bc65bbd530e32ecf531d8f680c0a72ca23ce4ba6821fb5f76b1c176ffc1ffe828f0911ea742dbb0679aefa050fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9840a349721a9456ffb324043c2af327

SHA1
47dbdf692edd5ca49e62fce4bbf6c36dc274f53b

SHA256
9b50cf437e3758fb14993e0523c462e82211bea6ea78a91f8691381ee70fe8b1

SHA512
95d0ae267ec7f808b59df2e67db08015181f56bf2348bb891d8ae3f328cde7958ef9adbb5b1096bda7670ffaa883eb4c442f4fb945f78629afeb5df7a5d410c6

Download Submit
memory/824-8-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/824-9-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download
memory/824-6-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/824-3-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/824-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/824-2-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download
memory/824-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download