3403bc4e213c4ee33f0d6cde698daa1454e3927cb58807049c500595a0981851

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe
Size

141KB
MD5

ac46e4a688d58b5be9a27a016ad6f56e
SHA1

0e54a9e1c1103f148c6afd0035c8835e2e4d31a2
SHA256

3403bc4e213c4ee33f0d6cde698daa1454e3927cb58807049c500595a0981851
SHA512

9b478e78e845cdd5f96536cd32600c18707ed9db394916ffb5564d44f771526e9110476d5dd038fe6f463faa06a9c22bd316e0ae6e29df13736566d6671e3881
SSDEEP

1536:bWX5quD9MYAbkMTOI9d9SJPKaVJH/u3hwRxJMBwgrL11lBnwTEuD6P3R3u3pLDlG:bWX9DObUSSZKhcMbVBwTEuOPhe9Ick3

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/memory/2584-0-0x0000000000400000-0x0000000000482000-memory.dmp	aspack_v212_v242

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	2584	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Download	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
2036	msedge.exe
2036	msedge.exe
2384	identity_helper.exe
2384	identity_helper.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4696	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2036	2584	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe	97
PID 2584 wrote to memory of 2036	2584	ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe	97
PID 2036 wrote to memory of 3428	2036	msedge.exe	98
PID 2036 wrote to memory of 3428	2036	msedge.exe	98
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 3508	2036	msedge.exe	99
PID 2036 wrote to memory of 1644	2036	msedge.exe	100
PID 2036 wrote to memory of 1644	2036	msedge.exe	100
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101
PID 2036 wrote to memory of 4212	2036	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac46e4a688d58b5be9a27a016ad6f56e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 388
  2⤵
  - Program crash
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=vsd3g0h_vs0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdba6746f8,0x7ffdba674708,0x7ffdba674718
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13880717977890121018,5113544059575567374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2584 -ip 2584
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x470
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
c2beeb7a90793faafba201a88bb72eec

SHA1
8e540e74222b8164df830503ab574e51e940de36

SHA256
43901d49330ffc65cfe3ac38e493b4c7eac59a225e609c9dd569bf67eeeeb84b

SHA512
eea75703dd14520fafa42e7be04f137b5d4aad5ca429ebfeaeb1c3d13ea3a6d3d22e2ad5b6ece35c280af23f68f85dd90ae5065e32e27fbd39a0aa9ad34fd0c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fa5f4b0b3b2396fedf9799c22b33fab0

SHA1
536c6d46ea9e7c5abf72ba79408e23b44bfd2dae

SHA256
62d7ee6bc85d90784a4f57190c42a66db77d6f97c09d94c719fbe73e8a7c8458

SHA512
4508c90307acb0ea48849fc1672b6007f6e02b500362d3a92fade6a71a797c1704478a48502dce1b8d2dedd0a33f6f66303abfd6229848f9239826e308a5839e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1640663abb0757f63c52f9c3d70ade40

SHA1
dbd7758c732b8eb7355c5b88a7ec0097be9743bd

SHA256
2dd93ff5033a13ed2ed4bf9f3bf5d5d9a4a55973761fed2683c87961de8644b8

SHA512
c145d4fe2d6e8cd2576d0321c09d33270ec799275febeaf7d42f41d19aaca56ffb6aeaf468667db527d1e883981628428673f4ca5404701b1dfc65272ad71d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2001bc4be33b5ad44764eded7e144a6

SHA1
6f8ea08f8ee8370a9c0980cf9d02125fa7b81f8c

SHA256
e1da861c5ade15aa4de5e8c0952ba11fa7cb6f1e491670499993641d6d974aa3

SHA512
6a53f96b3782f44819c36ef38ff616d0df3ab606341d7c5074a923a00a484f1b0b6f2cb6ae79309bf6aadc4a64006164319f7ce26084b240314e1b3ef3307486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6fcbf0112ea32a5fe07003ca37a47f6

SHA1
31b81abd360e06b1d8aafec01548ccb9d40c4e24

SHA256
65b20a3ed341798dd74170e7c2ffc7fc411cee7b3fd11c36eb48141f7962ba7f

SHA512
1b37b8a757ab353c7cdbc0f011095f5e7990eaf6cbf02bc0b3ccc686aac7f8ba545794fcf7308e1cc5dec7537f4bd617822f471235f1e006aa1065b414a0fe74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\96322b94-52a2-44fc-a899-19ed4db707d2\index-dir\the-real-index

Filesize
2KB

MD5
1a2c72164b408a1c233acc715001ee0f

SHA1
ff9baa1e64fd1631c505d556bd4d4fbdf512bf9b

SHA256
b1d254ad7502590d44b1bea71af38162c04ab54e402123402239030f6b4e3077

SHA512
8f9ffa4ca1eabd22a1831bf2c8babe3c18237858805c6cc294c3b8cd6a6324a4ab067cbaf8585aaa03bb935f54c576a7b3c0aa7cb4af1996eeb2016e4ebc72af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\96322b94-52a2-44fc-a899-19ed4db707d2\index-dir\the-real-index~RFe581d76.TMP

Filesize
48B

MD5
d002f1bbd17a8767716e61c89eb69fb8

SHA1
e8925572b4cd63d6ab53c352048ac7b391ba4e15

SHA256
83b3118b42e26670cfd9d34e486a3b9eadd475f5c8a9244fd1d0b6389372226f

SHA512
f7b3792959f373ad34926901de6c1e10d4244dd79efecb43b655a1967aae1d723dcf6b4d730fbe2372c25a4295aae716e146d5eac500d69a889725c57e37fb6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
18cd9ccca79f25989c35be001f7aa3b7

SHA1
f18b951f76c92766c2869619e7e9d0c29b6f8e6c

SHA256
f406a277f43abdfb87963368c10e32c4784814c030df3b0b440cfc14907d4b21

SHA512
478bb01fe2ffde89d3e49b5df70af53f5e7302c26c479adede8f5ec353d813ac672de30dc7dcd44423463188ce046ef4f6b56f6dc648fd1d35e98ed7252cb831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
70887f2c5f8d2f3d4058c7f3745295e4

SHA1
7147df1ebe586efe71c1178e5cdd07a9d1b60a89

SHA256
3e5fc8bfa8f63f7cf43d7f49ef487e5ec387a2e580bad06ca734ea73203a7032

SHA512
66eff195729bd13d8ce5bc7cc2d82cbc757552bb8e309e199a200c66f41386441621fc390f3bf12ae01a0e2f065477a9f2108cd0b560122296447ee37f8b7961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
a1de8ea11adaef9843dacf60aec3cba4

SHA1
420c9dac3a87b6e35e2da244ae1c0127986c9e0a

SHA256
726307f337c38bdf846c40f534ef1f2779a113fef7f1c6506853791c1e5f3a43

SHA512
570923a0156b2e2cbd7e5a42b6e8327a25f10ec9fb0bd7ee6f8f1502b5db8313a99de19d906afc8b825886619800437890a0e037a8cc5f03cd97993e688ff781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57c6f9.TMP

Filesize
89B

MD5
7fd57210e133c024bb7a497304b39266

SHA1
895f9bac19dbae36bc1010950a9f4f5c0cb8bb02

SHA256
87aa95c6dfbb2202e4743117253a7623c46d2958c8db473021bb17465f80fc7c

SHA512
344218d092254717b646e77d0fe2b5fa149a2bdaf84d395ccd4ac12c28670ce8150aadf7eb283ba54026caa1f9a62dc8e04408d9fab6fc732514f6e720c94b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0a4b409f8f5610c8b26fd1543e5d4828

SHA1
5e0e98178a2b92d37277bc96c3b1fc4998107d38

SHA256
5cf35f7f96491eae0f5575b14682611f504f57d8947954c3e6e3b3da4fb00815

SHA512
ac2f2bb1f535cf1df60ceab29d9cebf43b615a1e52c91b1b706cdf4d576b283c95659ed030ddb8b8752069ebf5d29f038a1cf3e2d7da4f838fcc180a9e2edde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5815e4.TMP

Filesize
48B

MD5
615a053f60917a574e2416dd107e50f0

SHA1
44b45a14daabd22a7eb7550bade1db46668b8d04

SHA256
f42103b257b39d0433c246db1df13a38324a3835f5dfd4b8478e88f5ed107669

SHA512
dbda5ef9c0b60bbbd442461141f814d9d4cdac758dd7803614cee09799d9263e90315a8d5efe15230a4ee8b20881b829c5b82d806aa08c2c535fbabe97639ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fac47b623f889e0315bcf20289c83f25

SHA1
3ab6374c4c13f23d0e9c4df723a06e666e4efa4c

SHA256
f06f30d5d559e4854867cc768c2bb242d485cff6157e91fe29338196565f101a

SHA512
65d8ed4fe7ff392c137eb2160fe8773c9ad1e36bc3a64a4eb7c90f44b5722ebcea5a1e206a16701fb3717755549f47421debc93c4216bb88654aae2ba6d4f87f

Download Submit
memory/2584-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2584-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2584-7-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download
memory/2584-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2584-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2584-2-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download
memory/2584-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download