b6bec6857a59ca483398d6117278e43ff626fa31d040b2ee0a72158846dac2cc

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe
Size

92KB
MD5

82a4aab7067b45cd96d537032344f1ce
SHA1

771c110c63747dadbfa602158caeb565a79051b0
SHA256

b6bec6857a59ca483398d6117278e43ff626fa31d040b2ee0a72158846dac2cc
SHA512

7b5fc5ec054177e93ba3eb2a8b31e12b5a4dba0d36dc9b77c07d80aa8289281dee0257ef54161a5dbd862f6eef411cc6f337a83a30b162eeb1110a8e1b7a5a5b
SSDEEP

1536:VaaafML+d3RsNESWJHHB1avM22iwMwOEQon:Vaaa0Lo3Rhp3ak22PhOE

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Office_app = "c:\\windows\\system32\\H1n1il.exe \""	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\H1n1il.exe	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\H1n1il.exe	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
848	msedge.exe
848	msedge.exe
2244	identity_helper.exe
2244	identity_helper.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
924	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 848	924	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe	86
PID 924 wrote to memory of 848	924	82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe	86
PID 848 wrote to memory of 60	848	msedge.exe	87
PID 848 wrote to memory of 60	848	msedge.exe	87
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 3496	848	msedge.exe	88
PID 848 wrote to memory of 4904	848	msedge.exe	89
PID 848 wrote to memory of 4904	848	msedge.exe	89
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90
PID 848 wrote to memory of 4112	848	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82a4aab7067b45cd96d537032344f1ce_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.danidutra.com.br/trabalho/Amizade.wmv
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa23de46f8,0x7ffa23de4708,0x7ffa23de4718
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4808019544067677804,8181719044115744445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3408 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8666ddb3-9002-4e47-8712-2835864fa0eb.tmp

Filesize
10KB

MD5
0da5558f8c2b5ac77beae2ce1ecc5af9

SHA1
3db7cd1af3bbfeba7636074eb73d1f6bd88192f1

SHA256
07016b9ea517ab85be2d386258c4a837955d096fd4aee9717438d1b75cc30b98

SHA512
1b17b0029c82a4b2170d60423f65a59071a6c5a76df3271cf2578f1e957c6eeb6aaf105662e50977e8f7ab7990a6a97561cc4260ccfcb5f6fcc622ecd4ce6d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8edf5aee848362b3fa4c7102382947c3

SHA1
0ca71672592fef3c37dbf92a155d747c927b433f

SHA256
16594552785f10884854bf38d179c9c3d26d023a089180bfe5a3ceb03c395e6d

SHA512
a8863cfcea01c05938edd34690db467f0d429f0598528f23392ca7e7233a9b2fe2eaf7b886ac965e22e8c63ee79af84654e5b2f7e94033e5f54622f7b9584893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78d53c4ecb4f237a195804abc28ebb1e

SHA1
5b036abe11431d0c164cc5427aa7eaaa2d8d1580

SHA256
b1ead24150c5c17d1e8cdfaa64b4395cb1b0872c6f4bb25eb8e024ba0e39c847

SHA512
90c1e12b736dc1a644262a44141f4bd7eb5fe935249978d1ff083e39017652ab847107add5b5fbeec6318db181cd22a728938fba7c384c8023ed8e3c03e61496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
3058e4f8046c774b4c970905968dac0c

SHA1
5104a279f2a83bfded7d928813cf6193d2050b3e

SHA256
fb69da25747dbaf4575b1114ffff6b9e03e77fdf8e4d6ee2fecd8912cd42ecf5

SHA512
0725756de256f149501d166f267f91afd5e4fdf43385addaf6f99759f1d631bf1c692fb82d58d6d4e7ad8b084b1f61a193ff82fb0bd3a42a50e8f29fb0c4aa9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a24085bafe93dfee65e4d7d900e95512

SHA1
874130b2622efe05cee6e243c55b9bddf566c885

SHA256
0fdb428483359941e296873dfa7ecbf03a333348c239b05ad35ba48d1c2aad34

SHA512
20b88fb683ef6c00b65810c4b220ef4fe4b967a1d6779b6f8511c1ba1342e7ea2a8be2b9417b6bec829149f2073953dd65ddf70856d1e855d85487f6f34edaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d997c08de6a9e02a29829c092388d489

SHA1
6da2c7cef20096f5d90b3990a02c6bd1499ed4f7

SHA256
cd5d285ac816e467e0822e8afc82e2cde4f54673a91e1e171a254f10ad672c5b

SHA512
3917278acdab03af5924f09e297608a4dc72047b9f933b3733f531179bf8844bc1f8ef97b6e9425bbca18d370cec50e1bcd7f0a49c520f8f4198f770c16a7e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
734fb262c46fc94ab4ac3321fab94cf8

SHA1
194b0a986e6cf28e3a1aae8484dda8530d03ec55

SHA256
28d2d273d87957b5b314e6039efbc05e6afd289030b499ee285549705e70003f

SHA512
26be38af2c97482d9479eb046febb811022572c7071dc71f3663e8bde11355ca5f749f53b4eb7095842493be68ec3051f753c565b0863aca80c97eaa9cf642ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
memory/924-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/924-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download