031ff86e367864d7ac9da0e244e4a50c388090ec0a4872c8854f29af07a04def

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b2b1fc84c9e11661fe2de55adc1fc59_JaffaCakes118.exe
Size

381KB
MD5

8b2b1fc84c9e11661fe2de55adc1fc59
SHA1

06949d7726f2e69a70d087943a684bdbb9c2c580
SHA256

031ff86e367864d7ac9da0e244e4a50c388090ec0a4872c8854f29af07a04def
SHA512

8c4f753825a7e7fb89d2648de6a352da38945e82132dea24446fa4715c948c4aa6b7ba40305b5a4ddd31a713fdf41b8818a7335499ffe805c84a284dd0ea865d
SSDEEP

6144:d7zJVF4Obrxqph4s8stCLJi3xTFdQ/dmd6lyhc4NOwMWIT6YIkaulAq4vul5:VJ/4ObrApys7RhT3ydm/ODWIT6YBBAqr

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b2b1fc84c9e11661fe2de55adc1fc59_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
4752	msedge.exe
4752	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4752	2360	8b2b1fc84c9e11661fe2de55adc1fc59_JaffaCakes118.exe	93
PID 2360 wrote to memory of 4752	2360	8b2b1fc84c9e11661fe2de55adc1fc59_JaffaCakes118.exe	93
PID 4752 wrote to memory of 4736	4752	msedge.exe	94
PID 4752 wrote to memory of 4736	4752	msedge.exe	94
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 2040	4752	msedge.exe	95
PID 4752 wrote to memory of 3104	4752	msedge.exe	96
PID 4752 wrote to memory of 3104	4752	msedge.exe	96
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97
PID 4752 wrote to memory of 3932	4752	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\8b2b1fc84c9e11661fe2de55adc1fc59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8b2b1fc84c9e11661fe2de55adc1fc59_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://phoenix-13.ucoz.com/publ/adguard/1-1-0-2
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87b4346f8,0x7ff87b434708,0x7ff87b434718
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,859918236564631964,11735285669086630349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2908 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a5ec20950fc3a45ef47fa4504d2b771f

SHA1
a8f0ad89893d4306b609538d6b4a4be261588824

SHA256
1781982078dffc15d99e296411ce2fc4f72ac348c91db27455ff8befe442c6a7

SHA512
dbba33d4843d6731b48a764b206412f5755f2c9dd38ad80ce5c5b31c7df7e7a01df8fca6a0cd313bae24cf0042be97e901a1e29906c47f18104c794d0b2153b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
378B

MD5
f45322d6c530713e6a260b83fdc7cb73

SHA1
834cd6b2878e6d223e65e21ae36f32d3fb185ad4

SHA256
d1a65051b9c88ca7680a2037306d40453ef0af0f36dba7fbc6aba7415f92446d

SHA512
608ca6d0dcef581b3e390154eb68aaf9e9f43007f6ff4ca9e98b24efc61a5b958504a2434566ea791f096d5f65d406ef9ca05749ffe8be5e592032423935a731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
559674b1d0d7433f8cf193a6eb81c548

SHA1
edea626cc0824a521d722c9a5936975f9fb80fe3

SHA256
0d5a7361166c29cb9f11b70d67b032f4b20bba1d73857d0102b877b6407772d2

SHA512
6f0267a60f3bce557d281028f4041e8b1253291e4a7cb1bd85498c44dd089d2089cb2fa644295ff555d4ca8b597930d2ac1bac77bf03aa8080ce5d190b6c5937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
603c6960d74863bef4675cd57eb85859

SHA1
ed1e63670c8159e4e61d853acffcd4215699951a

SHA256
99e4c77f2e9c4a3ed713bba7df739c8cde7e2653acb2343a331bfc646db2ff86

SHA512
73df40413c2dd41aaa08e35e0ca627e98463774e30013f7a0335c56e91304df8507b4fd3d1a1ab7913a467e2a563de811bc8171693cd5b02ecb16009fdd8d39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
e957dcbdfe2fa7034495bc55d20b57da

SHA1
16212ab10fbba8ff18c62fdd62ac52984d852998

SHA256
987875d86d7d26250998764601bf8c8e46368fa2896a9a26dfd900fc30226212

SHA512
29ba9625c11323b3eb7b215162de8e5947b32877ea44724e3e76309922b74bc6dc0ea55e342a18436917feb84d4a8cb0c6f8443fa175aaab5128f688c00e7b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5822c5.TMP

Filesize
372B

MD5
b58196700ba11d46f88bcf183de2a60d

SHA1
b042002a818086fdf1a746f43503a8aeac05e25d

SHA256
75022cffd955b9ee2cb7b086b9b3ddc7d9192f47c1cc060cc339a3f59ac1fab3

SHA512
038552a3e55d356a2c38ad47ea4348f0193b4060a7f14302b1324d7ea9d798033a15a5cb77c6b73a87fc6731cb38f3ebe84e1ce100642f3c0f33e2b624463050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
483c8e51d774b792bdeae52cf397e010

SHA1
c4a50af09e7743482faff34d4b0dd03bda3859ff

SHA256
a775e8321814a7b8bb4ce5db6065413d5349fa262f336bc5a09d0c4da1b5bc6f

SHA512
95cfaacb100f91006c2be3ea35220aa315703b9a2be581cc1fef6e7b47f9814ba06effad0a6c056fcb2e02e4c1e1e0e5d9d13bf28c30f778147d275b8ec68f86

Download Submit
memory/2360-32-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2360-0-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download