e446864f9ffb83623f7dd325bf270dc4ffe2b4964b434f62fe4eb2fd05ecc6f9

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe
Size

30KB
MD5

0d4a1803916c563acfcb401dfa15ead8
SHA1

d81a0b491b84914ddb06adbfed1365d55516e0ef
SHA256

e446864f9ffb83623f7dd325bf270dc4ffe2b4964b434f62fe4eb2fd05ecc6f9
SHA512

1f67ec26047142499a96e2763beea287c0cdc18608a24cbc509b07460bc495653ab262c4664307b295f25e665cc340964a28ef1c66fe9f8b9185b62b21519cc8
SSDEEP

768:7n8X4mHeK7pL51sCtthtRtMtPtHVTsZ/AeLk1HWuQlKy/Zej/:7n8Im+KzJYMuQhej/

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
3924	msedge.exe
3924	msedge.exe
2312	identity_helper.exe
2312	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4416	3948	0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe	82
PID 3948 wrote to memory of 4416	3948	0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe	82
PID 3948 wrote to memory of 4416	3948	0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe	82
PID 4736 wrote to memory of 3924	4736	explorer.exe	86
PID 4736 wrote to memory of 3924	4736	explorer.exe	86
PID 3924 wrote to memory of 1672	3924	msedge.exe	88
PID 3924 wrote to memory of 1672	3924	msedge.exe	88
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4244	3924	msedge.exe	89
PID 3924 wrote to memory of 4832	3924	msedge.exe	90
PID 3924 wrote to memory of 4832	3924	msedge.exe	90
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91
PID 3924 wrote to memory of 3660	3924	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d4a1803916c563acfcb401dfa15ead8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" http://67.15.70.15/~black/fuckporn.html
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://67.15.70.15/~black/fuckporn.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff12ea46f8,0x7fff12ea4708,0x7fff12ea4718
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1148022955636347301,5943394645561852473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4044 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e016fb7066588c765e32271e4e09ba9

SHA1
cb80bf0f759b818cd804516971aa519bd334099e

SHA256
72ef6c00ded1b548ec62052d60279ff4bd7aaf732e6b33dc55ba63526547781e

SHA512
05e965c6cd7d9d6886b3d9e48ca61624c62fcba138a312e752f967071fbd91c109fd492affe52d08346d71adf4e0b293aa4e0d7fdd96399d9e618f711c296228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18d6dc22eef35629387d4cb3e3c903ad

SHA1
56edec43eae305c6cb7102f9844e8a73d3ea8f36

SHA256
aee462cb3b08951af2f6490959c734eb89b6003996412782994b81539b25e748

SHA512
84173fcb2451bdb7ec40d1aea16fddbc023eae3a71de584c9125a276650ec90508fb8a5a1b0aaa56461d3b909724388cbba0fc4d95aef6a4078130a8c80d9cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b57887dd9af0895b51acb0c5f053a3d3

SHA1
f016d944e3db8536a929904ff1ba25f4c5a12f10

SHA256
788a8af96dda79d51d1b7f05e8dd35c321fc8aca0b25a52cbbecfc29160be527

SHA512
5ae4f2e5126194c7a5f8f45b424771608c0fbc7d57246d334bdeddfe07b7939115ba5c7c23689fa7bcf748b60001150256f533441873ba70475b88b2b28432e2

Download Submit
memory/3948-24-0x0000000000400000-0x0000000000400D00-memory.dmp

Filesize
3KB

Download