81f75bb3f4ac08287b1bcfdb5cd5083d85404b7200b5ea16df5c6d0670ea1ce2

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe
Size

48KB
MD5

941a189684d6d404f107e81d53b7d298
SHA1

411b17df4e6ed79cc9da21ef9cd3e87101fe4719
SHA256

81f75bb3f4ac08287b1bcfdb5cd5083d85404b7200b5ea16df5c6d0670ea1ce2
SHA512

10c9c6a911fc527cf2e37a9a77ad6f8a1db66716392eca6c7ca1496b9fa49bb794ce49ef3cf8ceacaa7a0119cbe34b1732f419b13ef74c144d3dd9289bbd0ef9
SSDEEP

768:Y1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJLX5ApzngCQKAto35I47hviHL:2QpQ5EP0ijnRTXJLX5ozgCctk2+viHL

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe
3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe
3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe
3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe
3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1128	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
4544	msedge.exe
4544	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4544	3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe	84
PID 3116 wrote to memory of 4544	3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe	84
PID 3116 wrote to memory of 1128	3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe	85
PID 3116 wrote to memory of 1128	3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe	85
PID 3116 wrote to memory of 1128	3116	941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe	85
PID 4544 wrote to memory of 652	4544	msedge.exe	87
PID 4544 wrote to memory of 652	4544	msedge.exe	87
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2628	4544	msedge.exe	89
PID 4544 wrote to memory of 2000	4544	msedge.exe	90
PID 4544 wrote to memory of 2000	4544	msedge.exe	90
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91
PID 4544 wrote to memory of 2720	4544	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\941a189684d6d404f107e81d53b7d298_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://myredir.net/K_E2D1qKpZooy8LVPaufEriI
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff467446f8,0x7fff46744708,0x7fff46744718
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1974789461030734132,13589245867729357651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5604 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -f -im E2D1qKpZooy8LVPaufEriI_has.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
745ba3236fbfddb8ad0cbd767f442781

SHA1
023ebb32ec78eba9d6efd83a418638955b58a129

SHA256
494887685fb8b4b51b381de123b99d214f68be6beb2ce13b7aed703128a62199

SHA512
05be397c3f2a6f006096c74218b384dc41b5c754c268d274f48fa1d98a0320f6ca5836305ddc22e1ec6eb36bf51c7429d6b8b27eaf1173416497c83f97b274ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6b85668cc023a072a30d603600086c37

SHA1
94e15cc3457ae2dd009d37652e0a74b181572897

SHA256
55bf995fb48040ee36e130a8e613b1506c05e88e2c5c7d4086edbb146a679cad

SHA512
8adf9be838e81a1368e102be9903f8adbfa2b46d3151d950a110e1db800b0ee566c520fb9da48504dd526369a58796bf69ac88411e6dea6463545b9add97f98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8247b006e7bc246387223a0f4e77d7e6

SHA1
c74a0bf8cdb442d370d5a72c44a4dd47ca999908

SHA256
3ed7050dc07f9c765b8f4ef5d9480b6997c48b65b5c00cbbfa493e54d92823b3

SHA512
611f41d34aebd0548bc8fc9b08a65dbc696a97204bd57f10244c444e90be2cf9037fc7ee2503bf7605b0526556b5bd67eafc6a6d7dac0a96ce5d5f1b42e87f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9e2be9cfb29ec3ee375a4566dda5a11

SHA1
ef91f76696c8889d144afd7b1633883a33b0b725

SHA256
caa6442078c87d792ce47fe20eeacd2f456f20f7a788ad767a8467205920d711

SHA512
73e2a6d63442cbb43d4b6ec5c67c61ff1ba97c93f0844d8e5e5d2421ceba59e12f29423bce1569f590827f72cd7ee52e72b1cdd0eaa12d51b14971f45420b92a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3db04ba0fdd937a5f5a99915bf04e47f

SHA1
f69d7459d58c214eb3004792068f228e1904a3e9

SHA256
af0a3edfd4eb2f7982ed36439d589567e0f2bf5bbdcc185fd41d91d8978c6441

SHA512
71e4195533d3255817e72218aaaed7a2857a4d95d31b10a048f425b2ed6d62835d6cf83754d49d535d4c3168761aaf0ecb9b26ab1e18a4d0f05f9be09503232b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn33A5.tmp\inetc.dll

Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit