963b90dc78a63ea622db854836249fc18addc20f2edc5110d5f3496ff01283ea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe
Size

142KB
MD5

a1c2b4ca12d50db1c7d20466c5326bf2
SHA1

e999c4b27d72baf26b3ba35c0588a2ae1d07ec8e
SHA256

963b90dc78a63ea622db854836249fc18addc20f2edc5110d5f3496ff01283ea
SHA512

e3366244bd509055e5fb4789590030478a6b001810a78cf6d1c62b642445386a982f993e0ca2bae18009c87ebdf29454e7d89566cb09c53750dd469c6381a85a
SSDEEP

3072:lQVteGUz3hZ7UbyfCxD4sN4Hxc7yBJan44xulkSppGa2VZF:lQVtPUz/7Ubyf0EsgxtkxXSp87

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000400000-0x0000000000482000-memory.dmp	aspack_v212_v242

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5084	4508	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Download	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
608	msedge.exe
608	msedge.exe
1908	identity_helper.exe
1908	identity_helper.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4440	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4440	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 608	4508	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe	95
PID 4508 wrote to memory of 608	4508	a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe	95
PID 608 wrote to memory of 3448	608	msedge.exe	96
PID 608 wrote to memory of 3448	608	msedge.exe	96
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1972	608	msedge.exe	97
PID 608 wrote to memory of 1520	608	msedge.exe	98
PID 608 wrote to memory of 1520	608	msedge.exe	98
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99
PID 608 wrote to memory of 2524	608	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1c2b4ca12d50db1c7d20466c5326bf2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 392
  2⤵
  - Program crash
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=vsd3g0h_vs0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7a1246f8,0x7ffa7a124708,0x7ffa7a124718
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4044 /prefetch:8
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7728113444566013841,3837835433290339623,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4508 -ip 4508
1⤵
PID:1212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3bc 0x3c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\01bccc2b-eb9e-4dff-8a00-d2ac32aeadaa.tmp

Filesize
11KB

MD5
86076c639eb4456318002097ef775dfb

SHA1
0bd0980fc84e31410a9e2606ad7f6515193830a0

SHA256
3fe2ba452c71cea9fa9a50e5067bfec2e3a4cbbf52eaad81364af0c6421ef6a4

SHA512
46cec920d21dd1c1ecc17d07449e605a109cf367ed462fb5306344bed38b39eb5601bdfa87b35ec8c02b7ca30e2a5cc751e8e8384a89d8dd5d8aa92adf61a4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ebe18f935a60b871b361e7da4d725244

SHA1
31b64ae96dfe0b3cde198588598b6d6267fc4e79

SHA256
f38a309d1d0143d4ad13cc556d74c0092448bba1f4bf211de58643e8f2e487a3

SHA512
d5aa5929b10d918ade21c85bd6931526a12a63435212d65998cb74e089899ba18e52d9fca4e07d8cac1e2d8f6697d3471d09438342d01ed92d2341d103a758f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
01449fe20f31bcc37bf83f6e9d56b706

SHA1
77c2107e307080c8ef77a94f796f320777d540f8

SHA256
3d4dd1dfcd433c2420678e087c4d97e530580f91dd82359b3f64aa5eedeb091c

SHA512
efb128d41359d99fbc541ffbec5ea6f35fa95fc51080bbe694b40c2d2727cf111378a6418317b411c7ed4dd9485d4977504256a2803da2765aefff26b16d8d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f432dd7ed17b4a555b45e9d371bedd3c

SHA1
4d0ba5d3404fc434c1104e137d7e7f8c8657158a

SHA256
56c663ed802c40e542dac40fa5ea92b60c3c8a8450d73921d938053c7b2f3aef

SHA512
9c167ac27ecbb191dee173d0a14da462a94b6fcad0be157b8fa62a31dc419e20d919a26d21612fd3319c7188dc130032b8320bad26519c42c45d9103a415c36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c7e2ac573dca2b8dbdbeba4fe91a9e0

SHA1
c5412ea0ddb6c06b3f0f4cfcf696baf3b3dc7eff

SHA256
7e9269468eb7d9615522bb77770049b6e93175616a044741d767443d92234056

SHA512
52cc468955712e25ff875482c5718c867edb5aaeeb069330c3ed5aca9b12113883809b87dbe6cc937a51209d9fb3fac1e88c51bfcd5408fbdc8fc10562d6199b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bac66e92-0787-4463-a1ee-c00303738910\index-dir\the-real-index

Filesize
2KB

MD5
1cb73831e16d9f85ce17baeca2dd81ae

SHA1
842ad3d461f3cdb4a36535e10a4cce6653675f0f

SHA256
60e1043177a56d692efa05583bdc4db9149bef62687abf21da6cf014bf06fdcb

SHA512
a4ad7214732b555237b95fe0a87de073f73f92c57faecfbe65c532f7a1ecd773e5e64840b7ab017c2ab81f634fccd542177488419a2d9558aa3f1270198a472e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bac66e92-0787-4463-a1ee-c00303738910\index-dir\the-real-index~RFe57fc32.TMP

Filesize
48B

MD5
31b9117fb1d5d75053b93f0b2386dbe5

SHA1
8fe0362c001e10702ac1eef21eb8b8de184a6e4d

SHA256
d31b05a5468b99b2972bb528c23a85613069ee0d69eda2965c26daeeed1540ff

SHA512
f17b37ebd93b5930b0992f6941bcf05fd4bac918b5247b503fcdc73c4c0fabcf9b379f5b0cff5941cf48ef35ac0c7d749c46262baa0c2b0c2d3d016a414cb3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
f276535d2b866aafd25c348976944deb

SHA1
ca23e99277ae17fa5f012805226eeec0df912de6

SHA256
b83bda8969fd6d91c70eb525cf1238bc30b2cc477dfc3b277c5e27668fbe7e1e

SHA512
2abcb55bf365925cc599f4364c42e3761dd3bd3a485638aeb8618085972b51def7929187c3b7be769c2d27befa6075b6364facb91535efa0865e2a9c335fe6ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
346347cb17f15485cf0e89546c1b2fe8

SHA1
c46c893a32a72356c8b967a6c0a8b48e2bc8829b

SHA256
bb25a8f16ce70fc0859b49bcf0eb04bd07bceeb5c11f057272afb3182b2893af

SHA512
ed67f0e7ab227b47ec9682d42915d7a55bddb8cdf066d7f57a477d921bd761d4ddcc93cca8d00e69d065367588a36ee39b34ff349547e0356845e3ae4173f636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
00f96a22feed1ec9618b2a3f54328c41

SHA1
ae3b02e3ac2a920ecaeb5e4e3a33c339df8e136a

SHA256
452f9e9a9c687d1d0823aef97ff70e12d3925bdd054e384046c3e4c1dd60f7f5

SHA512
8bde4693c3ab024981986813899fe550cc5018e470ead4991011eb590a57f41d402b3f03f24f810926ca75404a1b6c0919b57770df181fe1fedd1b9b5de9de08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57a50a.TMP

Filesize
89B

MD5
5f69493bfedfed04f9a9b91fc80d941b

SHA1
91e3c315be7b08f685d1d3c71d946b4cc1bc93ec

SHA256
32b30dbba02600142fe97ed12ed74b277bd332dcc7394722716caff80b38e031

SHA512
090d1bd5d6b66a3dee49d0dbbdb4e81f6973081122edea93d2c55ed69fb048f81e8b9458b5e4986255ab6bda4cdbb7f6919f11a65a01531bfd2689cb3cd47a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5e1351acae14c79898d86e3e660c5617

SHA1
745f891aede44acd0bc9d975697a37e3dea5b1e9

SHA256
9be82bd1e0065ea10417af768be7f4ae24628a090e1130652940a76da382f5ba

SHA512
66ef714824664bf06c20e8f5e798ff257db1d93f24d022ec498100c39308982b593182cb641ce79a7b422592aae58a4a8b2132de1412d4dc9ab6122c2e923e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f3f5.TMP

Filesize
48B

MD5
2796789ca0651ac9acf6afb681c7e76a

SHA1
ebb0bf77f4807b02f0bfcc02b3c4275694844fa9

SHA256
d3a6136d5177a7cc5c0ba49d22c1bd3e19847ab3cf67990b4170da854c05a1aa

SHA512
b1dea59ba80f48f093a6feef1d927229cdf5acb0dfddbb07f0584bbf23240f3d480ce64ade698ea22c11043d6798767ae4daaf93acb757443dbe816eb5127c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
memory/4508-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4508-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4508-8-0x00000000005F0000-0x0000000000636000-memory.dmp

Filesize
280KB

Download
memory/4508-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4508-2-0x00000000005F0000-0x0000000000636000-memory.dmp

Filesize
280KB

Download
memory/4508-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download