24bcd77d7259411646d329be33a53edec7ef1d619c4c04a8c26d7fa69fcf4412

Analysis

max time kernel
147s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe
Size

31KB
MD5

b1da08b6a47a2986dcd9b7cd56ea86f3
SHA1

bc736667ecb8c324e317a5754377ba5813ee0c37
SHA256

24bcd77d7259411646d329be33a53edec7ef1d619c4c04a8c26d7fa69fcf4412
SHA512

b31eff1b35a5e9f3255cdca335ec1e16034fd426ee437b70420a0a5eaf4e947cc38e0bcdbe81c8e62603479495ecdd195063f6786d17534e83365bc3512e50c9
SSDEEP

768:3mOhplcsHvKWzX6HJmFqda7koSJEoonbcuyD7UPF01j7eYS:WOhplcsHv1X6n0kcnouy899YS

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\WINDOWS\system32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3164-0-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral2/memory/3164-382-0x0000000000400000-0x0000000000465000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
1564	msedge.exe
1564	msedge.exe
4036	identity_helper.exe
4036	identity_helper.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1704	3164	b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe	88
PID 3164 wrote to memory of 1704	3164	b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe	88
PID 3164 wrote to memory of 1704	3164	b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe	88
PID 1704 wrote to memory of 1564	1704	cmd.exe	94
PID 1704 wrote to memory of 1564	1704	cmd.exe	94
PID 1564 wrote to memory of 4808	1564	msedge.exe	95
PID 1564 wrote to memory of 4808	1564	msedge.exe	95
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 1728	1564	msedge.exe	96
PID 1564 wrote to memory of 2708	1564	msedge.exe	97
PID 1564 wrote to memory of 2708	1564	msedge.exe	97
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98
PID 1564 wrote to memory of 2652	1564	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b1da08b6a47a2986dcd9b7cd56ea86f3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C8CE.tmp\Visualizar.bat" "
  2⤵
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcriviera.com/admin/include/total_visitas.php
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff4b4046f8,0x7fff4b404708,0x7fff4b404718
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
      4⤵
      PID:388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 /prefetch:8
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6599731539505216582,16259770672130463867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6028 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0214c6e8b989589764460b37504ebaf9

SHA1
7f39639a3815223a6e1c25103b792b42e5273d8e

SHA256
d45b79046cdd8ac93a2501e1883f1587edbcdb1111040322bde4ad0754441bdc

SHA512
653aede024b83b6bd79976e3f9936adcc8549174f3db70a0bf8ce0a131eeeae2b9c686abe2aa9a43fc03401955f5f863f4cacbb43876a0af87d5adc785ff0060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d293f491d6bb6074bbe5a94bf1770956

SHA1
a2374bbf7764e081bc1405fa95fcec49921f240f

SHA256
e50138803393e270d7254d996e765b3e9cf0225aef6d56b6f7526a18798acf4e

SHA512
3d92851cadfcd9d22648337a06ace3ebed3f6dfc296bf423eae4bc2acf1b8a4dc78c99c34aef55daa5a09026ddc577303d659b5f1ea33491be0c7467eaf508c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c9fa7f5e13f7b78ddac53b835ba1268

SHA1
57747ba11215f0f4af49e20030b90b191ebecf2f

SHA256
8c718355b43c9ad93bcba6c8f2e6edb72928f03ea749e68f349b8769dce82935

SHA512
0757fa0887dc1393dac651cd3568c36fff8fc5690c594327f41f0d510e3ad8e87fbcc1375479d72ab84fb25c66ae2c5b7ecc7e3a0bebe9770fe482343a505132

Download Submit
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp\Visualizar.bat

Filesize
322KB

MD5
789889892df2731975804d1354349133

SHA1
63652aff5008fac6e432c8678418592b723cf29c

SHA256
ba02603150e3ed50934911e38ce2b1050a4ebf651d2e0de58db42a787702d6bb

SHA512
c5b14b085826d5474a68201c9f75fa32d44cfb1f749e6c80efb243c35117ad4d206534eaf497d68a5d24fac121a413687b1f7e68724b68db2e7f61748dd3982b

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
4KB

MD5
3cd7cc2d02562ac1d15dcadd376bb8d1

SHA1
8fc2d52aa0c3b256e474920c4ff954f745d1402b

SHA256
bb79c094db02f7b66265e4b339e05177f24c1b94161829f26052dcacf8e7b2da

SHA512
456adb05b8ee5cdf9ef95bde6722ab590c57bb2cd4ed4093374d5caf0b734ae6d332c507d9a546b35020a515fdf423f324fb90315574d182fdf7558f554453fc

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
11KB

MD5
55d607135269649747a3c49176fc8c29

SHA1
f1f29076a980165c8187d7d30f6197d76ec2fd9a

SHA256
60bdf767e16c9fae8648ab25245b46278153cb37b4e44f099e07491d6901db34

SHA512
a0c2d4b976844779f3f987352268aeb297fc447a8256fb1d8e6b49e46af40e1aac35b31e7c63bdbddea596dcd4ba31252e37aaa1f0b57ec9713a0175e46b3725

Download Submit
memory/3164-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3164-382-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download