f6aad7ac0bf022c1cec0036c9ffac1b1a05174eab461d7be4dc47dc6dcee33e3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe
Size

239KB
MD5

60940e500dc37c11714fc33a6f1905d1
SHA1

6b3c32fb50e4592f7cd8d64040472424d3c1a684
SHA256

f6aad7ac0bf022c1cec0036c9ffac1b1a05174eab461d7be4dc47dc6dcee33e3
SHA512

3345ccd93e3870aefededb47ca5993e4a2389f987f9a2db0d7d2de89bb183c4dba9c4d2d68913adf4996035f91e4f69bd5001418aaca381c6bfb87cccf64e623
SSDEEP

6144:ZUXAXug1hQJeftkumJb0UGy9m2H0etYnXx0e2:ZyFggolkuxJ0f22e2

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3488	www.he-collection.net.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4168-0-0x0000000000400000-0x00000000007D2000-memory.dmp	upx
behavioral2/files/0x00080000000234c4-5.dat	upx
behavioral2/memory/3488-9-0x0000000000400000-0x00000000007D2000-memory.dmp	upx
behavioral2/memory/4168-12-0x0000000000400000-0x00000000007D2000-memory.dmp	upx
behavioral2/memory/3488-65-0x0000000000400000-0x00000000007D2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
2816	msedge.exe
2816	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4168	60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe
3488	www.he-collection.net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3488	4168	60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe	86
PID 4168 wrote to memory of 3488	4168	60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe	86
PID 4168 wrote to memory of 3488	4168	60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe	86
PID 4168 wrote to memory of 2816	4168	60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe	88
PID 4168 wrote to memory of 2816	4168	60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe	88
PID 2816 wrote to memory of 4604	2816	msedge.exe	89
PID 2816 wrote to memory of 4604	2816	msedge.exe	89
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 692	2816	msedge.exe	90
PID 2816 wrote to memory of 1660	2816	msedge.exe	91
PID 2816 wrote to memory of 1660	2816	msedge.exe	91
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92
PID 2816 wrote to memory of 2188	2816	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60940e500dc37c11714fc33a6f1905d1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\www.he-collection.net.exe
  C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\www.he-collection.net.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.he-collection.net/member/exe_contact.php
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4fe846f8,0x7fff4fe84708,0x7fff4fe84718
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,2417838442005131465,234179070543876017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89060c73975ccb5c8787c23e4c28d19d

SHA1
985aef9e275647834d19a600df9793a1e6a2c473

SHA256
ce0a1daa432f8d68452dcaea29e7a7bc677d250a95202dbb818e215363bb45e2

SHA512
ece184052b5c03b573ec1043c0220135156f758642cdb5d6c0d769ffb828002129ae67b52069ddeb6ed5285db46d477179665761016614f54c82956f94c2a3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe83b9a5506e5f9ad0a6d9cb15eba47c

SHA1
43e49dc85c93f9779a4f582936a7d8e0073cd289

SHA256
16419e26eeea8e37e3084aac955d5fc0cf147f40e4644e1e2d91a07a43381005

SHA512
5943e27e473cc292a1153fd835bdbf54682a79cb136ce366aac8992e600a35d6d66a8d4fd3eaaefa5ed7b0d5abb34e3cd26330a2742b0140770c7d397104b8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0413230c554e820500ba0c5c7f86d4c3

SHA1
56c6646a048855f4d11379fae0fb24a376bedfd5

SHA256
5391a1879aa93460e84806f921a12285f6d8ff39b79ff5095d03ee29a0b17912

SHA512
62017489279d19c5f47106e8f5e9a300588b1b2a15d649296aa2130a0b95b3417afe7839d9882a059e2b4486470c93ec24e74a8ab8561800c22bbefc4a10b140

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\www.he-collection.net.exe

Filesize
239KB

MD5
60940e500dc37c11714fc33a6f1905d1

SHA1
6b3c32fb50e4592f7cd8d64040472424d3c1a684

SHA256
f6aad7ac0bf022c1cec0036c9ffac1b1a05174eab461d7be4dc47dc6dcee33e3

SHA512
3345ccd93e3870aefededb47ca5993e4a2389f987f9a2db0d7d2de89bb183c4dba9c4d2d68913adf4996035f91e4f69bd5001418aaca381c6bfb87cccf64e623

Download Submit
memory/3488-9-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/3488-65-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/4168-12-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/4168-0-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download