ab6e5f5bc2486c3e98c7d2b8b786495f3798f824a5bc199369b31d9f755b09cf

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe
Size

536KB
MD5

c9039d8f848c23aa133ba43f88c1b035
SHA1

daea13b4ca1bffc5db915e3e8ff374734887783c
SHA256

ab6e5f5bc2486c3e98c7d2b8b786495f3798f824a5bc199369b31d9f755b09cf
SHA512

3a3d24834d55feea6b32f94441b233fb35bddbfead2bdbff41ac667db32413c6f97290f5dc128ab54ef8663373ea8ed7faa657f88b18796fbf4605e6935b5b3e
SSDEEP

6144:2+UdvH/XwGC0HVluYEW0AXbmk4dK5YF3STcuMuUN4T8InHNRdn02rXgxbRV1drX:23JH8ZV

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\wmplayer.exe"	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Download	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
3844	msedge.exe
3844	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4788	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3960	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 3844	3960	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe	89
PID 3960 wrote to memory of 3844	3960	c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe	89
PID 3844 wrote to memory of 2528	3844	msedge.exe	90
PID 3844 wrote to memory of 2528	3844	msedge.exe	90
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 3348	3844	msedge.exe	93
PID 3844 wrote to memory of 384	3844	msedge.exe	94
PID 3844 wrote to memory of 384	3844	msedge.exe	94
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95
PID 3844 wrote to memory of 3648	3844	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9039d8f848c23aa133ba43f88c1b035_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=uFn_a9Zhc2A
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeae0746f8,0x7ffeae074708,0x7ffeae074718
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4112 /prefetch:8
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9868256022328736985,809499565022583581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b104985-79a9-4437-a5df-5f5bc6df8c3f.tmp

Filesize
2KB

MD5
b2901f9d0448739cbfde36aec2c61398

SHA1
3439cd91067f057733c1b381d0328e5d012a7e8e

SHA256
d3741f5492b1c358d22ccf4d4a7acb80364043ec0dd84c99d9659825d75d5165

SHA512
dc2d4e5610f6be06ada103a030ac12c7794cdfbb2f41c00047e9a21ceecc91e5b43d58e8d3148e1bcc4d3f9bc4a0b3500cb6a0bdb637243b62af409d582da21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
af511acd36ca7cbbda8150b59c8b4eb4

SHA1
1c6b4b8a0335951de924be802fe8efcba12deca2

SHA256
07226e3f22862de8740e992b4bff9862241907d3b2d5455402abdec124fa661e

SHA512
8fe57dd454b6134dcf770b0f2fb971bd31c1fbd906041af5a3da3506eb02da8e0e82790bdec13c1e65172f021706f2cb2942913460c5715e964949f4c62c9e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fe7ca2059e27992a98777649f6881b6f

SHA1
d158233f713e1d192e7a960216e4682e7bb5218c

SHA256
c31d4f4da02d7508e190bedb720a8130e356e9736ac08c8deb907a6ab58b05e1

SHA512
d722dd0362679c9163e88365f131e75ac047dcd72be1d836d97b6b52daf647b20a7e6bf50b6ac02bd1909a0670543e6b841c742f12a2bd4f64faec3d5189954b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc68cbdccc966da90f3f7783595685ae

SHA1
6a53afe445097911f03d426fd6df707ac9e28261

SHA256
a7048fdcd371f045437a8f64337ea2b93de2f7be4205779c17936c5cb9ba2de3

SHA512
847fc39ee609f52ec1d8c3201a1fde95eeca38cd1e0545e28d2255b112c049ac3438dc7038c500b5405324e0e701040f15f4df94f32f354ff1345f8156bf6ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5b223aeb153b137a21383037d3da6e9

SHA1
43c34e4773a5d37a38dd4fa4b57af9b21bb6dd97

SHA256
0f2b716cbea3206235c6be4722b7891332a8adac6674cbcbc0330ac0e0e6a298

SHA512
01fc67bbc1d917b16ee02e979a44aeab679941a7c67a2b06d0cdeca96891f7263eeac81bf865e1ddd15b9814a90547935e7887ef48b6e69cd31a089f44b3bc12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\28f98073-52bb-4631-974d-4d45243e4808\index-dir\the-real-index

Filesize
2KB

MD5
e679b56b1b0b2ad78ef4db9ae10be5f8

SHA1
610e29f15c979eca49b1d667da0b5956cc1fd17b

SHA256
d6f639bc2e8eaffface436e691893f9d2a2f030737765bc842745e04ff27e520

SHA512
6807d9c47a797ae50b36721b5325ae8d6951e12c062dabf7f6578fdbc36f30507e08e5d6b8d98624e7478672e1de0010426dd09115e8296a90ed78085e0a44f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\28f98073-52bb-4631-974d-4d45243e4808\index-dir\the-real-index~RFe5812c8.TMP

Filesize
48B

MD5
948f8c61110c1ddee18db1d21310bf54

SHA1
92f1a334f28a55285af0736d00324a974b4c9e34

SHA256
948efbf5fcc3b7828dcc91a4fba44ed835c766bf191c4d914a578ed7ed478570

SHA512
b0fcdd58b4151b2213aca0831d708338d6393c3c0641783f0351ba805c424f9f76c7d55fe428949d451d5ab0608ba8abd72dc62a5cc207e7319ea21ba399e24d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
8751df9e03ab3cf5bd7c0f9c06a779bc

SHA1
33f356733b3664a71bde7808bf2603d69ca672d5

SHA256
13d1ce9b1fd4e79e5981196b6144cbf9171ffe7c2ebf4bf6cb7e9f847fda8b08

SHA512
64044e7c9479fee22846b9232dbbcb686f1b07d17a49d6e8aab30ec348cc1c4da5170202f2850bc067af7273082fcdf4270cd981d9bd6c9e79d4a58815eaad8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
b94d95de265cf5594889e7420d2ec30d

SHA1
19c36c4c24bbdc442206a244bd069ba97c39f62d

SHA256
7962bd35b6874fdcf5c4da84721761c5f505218577cc1deabd8f29c990382694

SHA512
a5eda062f0faf440cc6ceb38e29dfd25e6484ed1a7df772b4deb9d2d8f7240fc95e101e54f9dd57bef80c1d569ccb28e86c9ca66868177cd3cc836ed9d0fce4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
246fb02deb53c3ef621415eb5a5c33ec

SHA1
b3d3bfdc91113c3078a4810db747c3ea19fb28fa

SHA256
ef3f468796a801f6d1fa0f61fcd594926b5a4cf3e0bde723fb3f64c573d24535

SHA512
699b0360e54d8c4c87570e75883a8522fa9c36eb1b4b58c1ac95f6dcedba95387c9822ffc0174a3a192161fc590a0bb417a445c851562fa2957c33d9cc033d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57bb41.TMP

Filesize
89B

MD5
99c8ff52afeaf2cd338c65bf66be54f0

SHA1
e13f2f02b9e8fca5a0a93812105c715335463763

SHA256
1ed632c45d46b61437c736b7da426b54c5283ae77e6804bafa36a6fb3abd5f32

SHA512
da68d16217e8652ec47cacc9536c80d6101c1c8d3a63c61af849ea90f0f38b8b06b1a94cf8cd7533b9babc3951c2c196ce86439065c47c672724e20887ca380b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ee46e3f1028886eb16b751253c97fc89

SHA1
08d09b042e792d05346cf49c359b4b08cb780ab6

SHA256
c1676d5334e3b41d26abe1e2124627e7ea936a7ea312e67297b40e897b782de3

SHA512
2a0c1488902e275496e444d215ced8dd745bc62e6a8fd5b2cc845598a69410a7cc766c77028e28b9bc44222f0938d8c974f974368e87ea599757fceba8725d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580a5b.TMP

Filesize
48B

MD5
ce7376569a20e2bacb672e8d048254f5

SHA1
459cf972a5d8d17a647b84a266cbf36ec0e0957a

SHA256
dacb65da9608e470137f408afc9766ac34b31bcd5d32d19e7275b5dbf2d676b3

SHA512
ccfdd636e6817840cb755d02ecd375fb7935736f69d3997ec69781985636761af9590b1bafbb99cc2e982cc93bdef9a804e887818fe63586510bd0cd1bc5a57c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9d862f5c37c9b38eaea26f2ba90f0bd

SHA1
331a70840b95803552e68c79b0e75c6e3c11a332

SHA256
49e388c97d094a31a432c7caa6bfdcb2c13188653a2aa089dd37b2d25fd2c428

SHA512
c36cf83445ae4b467e0194a633e826917f2915d7443ef69b06f28422dcae3ffd5f837c0aa6e09f7d9acc7e90c563734c76575c8e2123c83c1b9ab90fa250a0b6

Download Submit
memory/3960-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3960-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download