837dfe9a26acb4fc6453c3d14b79264fc7c8e6bc352b137de2af1b5c72ff3e97

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608ddc28a62db173e6c991254ce41a3a_JaffaCakes118.exe
Size

336KB
MD5

608ddc28a62db173e6c991254ce41a3a
SHA1

9ebe5f9421b3f02c4be1875a5315783519d1195b
SHA256

837dfe9a26acb4fc6453c3d14b79264fc7c8e6bc352b137de2af1b5c72ff3e97
SHA512

6b39c35417dc16859c3ed30dcaaf9e685138018225529c042995bf2080cc6c2fae813b456d7003737c16dd6f1a42b9209cf9db8d4d9ddf7ba546bbf13d8f374f
SSDEEP

6144:uaI1aO1Uxrvh0y/KyEIu+jaeoLZtPZeYuxG3YM13XnVZVb9bOpvcBxrs5U:RI0O10rv1KyE1+anPZcxG3Ye3XVnIKB2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
2228	msedge.exe
2228	msedge.exe
8	identity_helper.exe
8	identity_helper.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1852	608ddc28a62db173e6c991254ce41a3a_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2228	1852	608ddc28a62db173e6c991254ce41a3a_JaffaCakes118.exe	87
PID 1852 wrote to memory of 2228	1852	608ddc28a62db173e6c991254ce41a3a_JaffaCakes118.exe	87
PID 2228 wrote to memory of 1924	2228	msedge.exe	88
PID 2228 wrote to memory of 1924	2228	msedge.exe	88
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4348	2228	msedge.exe	89
PID 2228 wrote to memory of 4184	2228	msedge.exe	90
PID 2228 wrote to memory of 4184	2228	msedge.exe	90
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91
PID 2228 wrote to memory of 2464	2228	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\608ddc28a62db173e6c991254ce41a3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\608ddc28a62db173e6c991254ce41a3a_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://img206.imageshack.us/img206/2763/churras20xix2020galerahw5.jpg
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8917546f8,0x7ff891754708,0x7ff891754718
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,9992908207532805940,17227974072819883144,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
429a4aaf4151909cb247cf9afde11a54

SHA1
f59524f88ff9b54dd79111600b13b417fc774cff

SHA256
e18cc3145eb0606e7da11f4f547c668e5d3f1498b0aa8b26add84f99fba6b524

SHA512
b0cfa999455e536b8f18e26c6d9d7b0427f8b4009eac7c487c83a9da3ca51b0a6a11edc88b8359b5c94b0bf01b2408aa93a6eace7c38e2c8173db22df1613b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
df1559e1813c0d55f7cffd06177b7938

SHA1
b6897f39ad686c0bfac79f0cf77298cb296a1f9c

SHA256
ee7a123294fb9263868700fc2995cabc8c8b12103c562792b33bcbce5cb1436f

SHA512
4c9b8978798c472b2e0e533e5365446183fa38817e20b8ca0a7af54f68450e80ef3d2cc8de488e878037d6504e2e4e8276786d84d0c27b3052c118afc126058f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad79066eff1d76967af2c252472458a8

SHA1
958ea4235dedab8ea97aef96e09334110f592bb2

SHA256
1d95aa38a934b9d12b753cc7dffa8e2e55531d3c26dc39a879ae7c3b12c44a9a

SHA512
e0677d838b2f11594a484db063625dfb3c8177793f8ed5f9278f9152a7ed1cd1ec7e752f47872eaedd1e469563ceda5b637e90a199d8da12ea097db678b21b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2fee251444e7d3f3aecb0a10f15268e

SHA1
246b119e718c6ab7a7593ec5c450691096e7cee8

SHA256
01f0ac2fe1c268f64de692b801dab3354ee2c3a36ca2ea5684e7257404916b3a

SHA512
c65864685285a61e5cbb468d8d630c8675d96294f3fbad7ad2f65dd8eff54d28f1adb69a9f5dc0c2536e535f8e0c428d2bf2f0b05afb87c7a4263b081f51b5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
09969b470b2b14ba6f7a6ba55852ab76

SHA1
537e7070767f8ee1e6e4f4378129583222ee2be5

SHA256
5f31452d992bf8a3704925e5327bb80fe588de03cd9725af213bf1e3d3eeb9e3

SHA512
336e8900f707057c37529cbfc8125a34f0e133302a02aee2852190485ab592126b8fcd2e3cfa46e2d210d43b2d12512dabf9d9324d40cae389e051f464bd738e

Download Submit
memory/1852-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1852-25-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1852-2-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1852-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download