d8a74d0c8a4936c594e08aadfbaf94856a73a41d96d2ebd2c4a30ced6ef1043b

Analysis

max time kernel
146s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
Size

1.5MB
MD5

81d02e4ebb0b666ac89670112663d315
SHA1

d27e6988355cd6ff0a565440dfcbd12955d4864a
SHA256

d8a74d0c8a4936c594e08aadfbaf94856a73a41d96d2ebd2c4a30ced6ef1043b
SHA512

de0731af857268735e8aa75983ba2b18f5a96e1862f8720964b70c4e22a9cb4d7ed1580d52e4e85d481a39560624aaf729f20ee5a4aecba8f06003aae77cd6b9
SSDEEP

24576:Sgzpo43nHOXTy6XyKcxJDiuAImPlDz0iunFaWlYXIK5J52Rc3x9xeGwL9oWku48s:SgzpX3nHOXTyO0Zjd0DeosG1UGW9o3u3

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2540-0-0x0000000000400000-0x0000000000723000-memory.dmp	upx
behavioral2/memory/2540-1-0x0000000000400000-0x0000000000723000-memory.dmp	upx
behavioral2/memory/2540-81-0x0000000000400000-0x0000000000723000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\galex.dll	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Microsoft\Internet Explorer\IESettingSync	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
4152	msedge.exe
4152	msedge.exe
4616	identity_helper.exe
4616	identity_helper.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 4152	2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe	85
PID 2540 wrote to memory of 4152	2540	81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe	85
PID 4152 wrote to memory of 2916	4152	msedge.exe	86
PID 4152 wrote to memory of 2916	4152	msedge.exe	86
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 1076	4152	msedge.exe	87
PID 4152 wrote to memory of 3408	4152	msedge.exe	88
PID 4152 wrote to memory of 3408	4152	msedge.exe	88
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89
PID 4152 wrote to memory of 4576	4152	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dnf1100.com/down.htm
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81cf646f8,0x7ff81cf64708,0x7ff81cf64718
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9263499616950143106,1853821566947902958,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4168 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea9ef805116c4ab90b5800c7cd94ab71

SHA1
eb9c7b8922c8ef79eef1009ab7f530bb57fbbbea

SHA256
bff3e3629de76b8b8dd001c3d8fb986e841c392dfe1982081751b92f5bd567b0

SHA512
8c907d2616ce16cfe08ddeb632f93402e765c5d9430a46e90ab5ea32d4df0a854c6007b19f9b0168254ab7aadf720fed8c68d1a055704db09c1b36c201a9b3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
347755403306a2694773b0c232d3ab2c

SHA1
94d908aa90533fcaef3f1eb5aa93fee183d5f6ac

SHA256
d43f2dd4ac5b6ba779100eb8b84bc92fc8700bedcd339a801c5260b1bb3ce3bf

SHA512
98f1fb18bc34dfc224132dfa2a2e6a131b280b25fcb516fac3bb66da2a47c7a7061124881de6fa5f65602663dc0ea71357b171a3346bb1514176943438322253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c597e26a4eb099381521c18c72a09919

SHA1
5e9d9dbfbd79da032987d0d1bdf0fcba5dbb5f8d

SHA256
3ba32c718bba24ec359e89173f770004ee035544e33feac3ba9dcf0e70aed8b9

SHA512
df50399bbccdfe5cd2da41d106fe875b3e1c213ca81b9a562307ac3ef2ed041fbc94e60a51aee663ea299ec1aeb052be0f4e8170dfb3b45760fbc340c6994a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1fb31fb8352cb0adbe02560b521694b

SHA1
bd3172b608f0e8a4791a2cabcc5bfce1d891a4f2

SHA256
d01a31fe581c229defe9c57eb82538ecd617ba32198f678920c2f949bcb45f21

SHA512
d58d55310a115d43bdd78a007ad3cde05b76b5c6b6b1a78efb0536f7355091f04247b58ce4d0c6c03773d4649b6366615c84af7322c95c5c26f8e853cd7318aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a87e3db00b4d9da7f9c86a0b0bd9f88

SHA1
6d128464d01dd9663409ac130c0f06bd907c7a28

SHA256
7cebb79b8e375a2c19a8d85869c5fc062a71877539215f291d3b61863b86cffa

SHA512
79b7b86be5c190a250237a120bc405d429bcca3b2f93c786d7cae3245288dd20b70baf666200b7e37f93c7ed1b28fd9d55b43cb73fce20b4b8f02bc2fdf40c2d

Download Submit
C:\Windows\SysWOW64\galex.dll

Filesize
987KB

MD5
31089878db4b2307dd0c50389e19e023

SHA1
9113ad39fcd9e3e342eb2cb9131515e851314d1f

SHA256
29132acb8fe71d80ce0138d9eb5b40aafd2ac46100e9f016c4f9d89a3b2b9d2f

SHA512
89d43fe375d68baabd37f63577447e31b0e8f1ed9f8fef5b3aa4569a2d2ab6a91afcf3208f42f2d031f7b4ec4d22f84e87008ffc18dbf3dd7becd97fe5d8521b

Download Submit
memory/2540-14-0x0000000010000000-0x00000000100FA000-memory.dmp

Filesize
1000KB

Download
memory/2540-65-0x0000000010000000-0x00000000100FA000-memory.dmp

Filesize
1000KB

Download
memory/2540-0-0x0000000000400000-0x0000000000723000-memory.dmp

Filesize
3.1MB

Download
memory/2540-1-0x0000000000400000-0x0000000000723000-memory.dmp

Filesize
3.1MB

Download
memory/2540-81-0x0000000000400000-0x0000000000723000-memory.dmp

Filesize
3.1MB

Download