1711d6ff7858f7aeec95b6ecca7090cf08ea7529e4264942a6f4b0fb6d56d57b

Analysis

max time kernel
146s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe
Size

160KB
MD5

d459b4b6d7cf97cf4f5008eafc1d9407
SHA1

a03b6554427e222228754700cb44a3fb1f5ddf58
SHA256

1711d6ff7858f7aeec95b6ecca7090cf08ea7529e4264942a6f4b0fb6d56d57b
SHA512

750ae3fc6bcaddc8df8582ba099a1ac3370000d46fb44aba1471673af617d4ad3a1bbf67b38d27fd1571f9a74ed07ba206f52150e4ed9d9630a82150ae5cad3b
SSDEEP

3072:rRcaChNCqOCmpLPchc/Oa2lqMGNf4RcaCMEH:aThNCqOCmpLPchc/Oa2lQNnTl

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fc39oi.exe	d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fc39oi.exe	d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
5028	msedge.exe
5028	msedge.exe
3092	identity_helper.exe
3092	identity_helper.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 5028	4968	d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe	86
PID 4968 wrote to memory of 5028	4968	d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe	86
PID 5028 wrote to memory of 4112	5028	msedge.exe	87
PID 5028 wrote to memory of 4112	5028	msedge.exe	87
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 2196	5028	msedge.exe	88
PID 5028 wrote to memory of 1140	5028	msedge.exe	89
PID 5028 wrote to memory of 1140	5028	msedge.exe	89
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90
PID 5028 wrote to memory of 1488	5028	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d459b4b6d7cf97cf4f5008eafc1d9407_JaffaCakes118.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mabeltoledo.com.br/original/Loirinha.wmv
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f6b346f8,0x7ff8f6b34708,0x7ff8f6b34718
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4344551247875152968,12921804840604450797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2732 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbf73b31f776fa8b7f02ca592c391f46

SHA1
d50a91d01fc4212c1813e761d8ccdbc56dbf38aa

SHA256
15a80ea947b0d9c6fb7a966e14ed76899a21d9b44ae43bc28bef608a96758be5

SHA512
d30690fc9242daa15ef3693523309a80327929ee4222c170ebfa55fe845be634ec949d608f63076288b8dd43a388ea7612d20d3f4a48da8300348d24a53eb51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d441031138b954c783b5f4b22416226

SHA1
a49145ad0808320e13b189a55b4ddf967ed3ea67

SHA256
30e803d5a77852cdb801040777d0c253a6512498af973574555a14753a4ebe68

SHA512
c4b4cb7dcfb6365236dcc8cfa57f5865bb5137198747d9b8e511da2f4f22d79a0c4ff41b92cdc1686d9047d1eaf43c1044043c9aa4948960470fcbf9285f6bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
155e359108fae0fe89ffdd07f0161164

SHA1
1e28fc6799b4f3a47231d9d994b17f77e7f30518

SHA256
244914e45dfad4c6bc3a5644a71cafb13ebd91419dccd79acc118615e1402b4a

SHA512
4e9d51f60416929a850719a27af6148b438daa9b7f689c6fc4b7653e361159e8ca6d6444c0302d49f0e1df82c9980d95017a64817c1f9054d0f7949fd8a3f347

Download Submit
memory/4968-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4968-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download