d595dc6dda67b384760d21ff0a69be5c3a5c2c4ed7a3fa031ec3672fc40ba387

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe
Size

1.3MB
MD5

34c1cc6b629a26f1f093b3924138c5c1
SHA1

6a53267265142503e50cdfd17d7bd085dbbcbf85
SHA256

d595dc6dda67b384760d21ff0a69be5c3a5c2c4ed7a3fa031ec3672fc40ba387
SHA512

bbe228f6f4a9ceea5ff9c1f883a5d6e33c967557db40648bf241834829e88c11d118abeaa5a7e8e84193f265043cc199795a35bf18079aa114d282541882cfa2
SSDEEP

12288:Ch/pCHxW4pbAOeeeZeeeeEhMEr6CX4zistf:U/eDNAuaE6tie

Score

8^/10

evasion trojan

Malware Config

Signatures

Downloads MZ/PE file

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x0003000000022927-44.dat	nsis_installer_1

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 490526.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4180	msedge.exe
4180	msedge.exe
736	identity_helper.exe
736	identity_helper.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2800	34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe
2800	34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe
2800	34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4180	2800	34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe	83
PID 2800 wrote to memory of 4180	2800	34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe	83
PID 4180 wrote to memory of 1732	4180	msedge.exe	84
PID 4180 wrote to memory of 1732	4180	msedge.exe	84
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4920	4180	msedge.exe	86
PID 4180 wrote to memory of 4668	4180	msedge.exe	87
PID 4180 wrote to memory of 4668	4180	msedge.exe	87
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88
PID 4180 wrote to memory of 2068	4180	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34c1cc6b629a26f1f093b3924138c5c1_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bigfishgames.com/download-games/1154/treasuresofthedeep/download.html?afcode=af628d3a27a2
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcda8746f8,0x7ffcda874708,0x7ffcda874718
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5489971696283985670,529368739721331843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2864 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
393B

MD5
ff7856fcdd850777d8d5aa4fa58a2198

SHA1
b94f9374e29156bbb7626e50d58b8824739bed89

SHA256
222f923af4932c04d4036e6d320258bf56582c3c496dc4ea27ee24941148b02b

SHA512
55684e756e9ec5bfbd4e14d60719b29899ec697ab03c50cb13daa9d8056a706120e6481beb339c7912834ae944ee0a412cfed1913bf38a404bfb94e007e92476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c131951fa038d82fa86fb77b073e6e80

SHA1
6c0a387c9f79acbaec55cf0326ce066b6105408f

SHA256
fc3d0cc31b20dc962349dcf3ecb4837681409ac4a587c242b31b1e22c3f4ae51

SHA512
b19c457b496a2aa1f886a4d9513578c80d6012f559ebf34ee85b6d7bddf56c8cf4b66a33b924a6f4859de4b53f6b57618c522e6d5e34e8df2cfaf43556a835bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed59ec8d6b57be781067dd90616a8df1

SHA1
3716862f8f3d6858e147eb0addff0f7e87cfe962

SHA256
d0a5dffd1f50fe5431b268377e1f7fce10f18fbe8706d12ee5b46b615c773f9f

SHA512
e6e5d0e9016da5b1f362214e0b1064a195a55969afb5381f9008376ccaf536e76ff18458b88d8cd6afe6ec88a995d5438fa1681482ed90d611ebf899c6e9ed4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b95d2adac04f1e91be68b46c9ceb27f

SHA1
a2548e650db58a0d056ffd2bc33804a914278b5d

SHA256
a12d3118d7c403ad67927ad369936ece2c2dfca884c3c0f38d5968dc712a9e98

SHA512
97eea23eb45376cde680a1c3181f5a4827cf2dade7a3bd1eaa1453d44512b2a64cd809a3adb037c2d23c5447ce795c524821f016401204bcd22ea9397d4a6c99

Download Submit
C:\Users\Admin\AppData\Local\Temp\FG.url

Filesize
192B

MD5
b32e479bd009ed83990c9673269a8679

SHA1
c90602796792d73b8e14df593d28c88639957537

SHA256
4da0710275fe2edc624ceae921dfed794450221c88daaac73467fc885cff1a3b

SHA512
d29415020d7ddc493ac36ad2351414523f9804f3031a50c6bfded58d8b9a83f13877ae73571e9dcc50eedd7014230196313dfab8618e587e118ae6ba4d94db12

Download Submit
C:\Users\Admin\Desktop\Fenomen Games.lnk

Filesize
1KB

MD5
47fa86b296c229f852c35f4dd92653de

SHA1
450ec06d84c28839226a5756e3e8f5812fb80f0e

SHA256
ed58bb31a8c65b661f5b1eed09bd1248aa642c503e077b0d111c04cfa36d65f4

SHA512
ae0ff654fcc080fd364087c29912e231f120e7951116a3a941e552659bf090392f1de3d2a109b9d408c4d2476d351075840ebda53f9b91b8d3f16bb610662243

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 490526.crdownload

Filesize
232KB

MD5
1e47566685a6d793d1df722d2ffe76ab

SHA1
f04e325b6ac258ca221791b841c3187f10b2b7b1

SHA256
7901dbe3b12f7b5e91127f957e3e6dc9fb7461d66a831c71b9bbb6385c699da9

SHA512
90dff89738b72d07025d26d3c137fe2e5ce10d7abfe5b2cc10d82dcdb3e94914ad18592121f69269c041c82dacffe856e179cb3012f4ff65fa52d44462661b35

Download Submit
memory/2800-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download