23de378c8e1955e676a9b9d6956acc912589052a711b05585f6140967224c4cd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
Size

461KB
MD5

3019efe3698037d402a5f74d7db30aef
SHA1

48ae2456c500b294f7bc2b85cc1bd576953ce226
SHA256

23de378c8e1955e676a9b9d6956acc912589052a711b05585f6140967224c4cd
SHA512

2a3c7c6f46b1114c85063cfe5eded2f24fa6da256a86cf62854234b347dab6f7252e9ce19c48487c052051277ec6b65c5113f5621d0d20b3e0d4a833f77f9d7a
SSDEEP

12288:iPptoY05ee6U1gx/ewbQTSoKZjdpjpcPbd:U4ee6U2/XbQYpjped

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3704	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
3704	3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
2648	msedge.exe
2648	msedge.exe
2960	msedge.exe
2960	msedge.exe
2924	identity_helper.exe
2924	identity_helper.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2532	2960	msedge.exe	100
PID 2960 wrote to memory of 2532	2960	msedge.exe	100
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 3856	2960	msedge.exe	101
PID 2960 wrote to memory of 2648	2960	msedge.exe	102
PID 2960 wrote to memory of 2648	2960	msedge.exe	102
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103
PID 2960 wrote to memory of 3200	2960	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3019efe3698037d402a5f74d7db30aef_JaffaCakes118.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://crusharcade.com/ca/thankyou?s=6%2B7C0da2sLG6t7HAy%2B7H0vLAwc7%2FxrawwMa1sLK7wrLBtbXGu%2F%2FFwsrPxsc%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb232b46f8,0x7ffb232b4708,0x7ffb232b4718
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17504966864011605068,17598246355717051482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
30ba39f0d9dfc242bcf5a13148c65714

SHA1
f35a36a5dd87eec68ee6d1e621224995838f30f2

SHA256
6cb7722d1559158bb31024e172b224988f0963e043cb8f60065c94c0e9f5b0a8

SHA512
bf732a235af263d14562f0f10495e910f18affdf4dd1f1f0507c470de7e9cc0d3f122f4e114962ab3342c434d71b20e97ee78dde7339a42300cb5a394f500a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9c4594452a033f677f9c138bde9b7e3a

SHA1
c8ef288edd5864ed944e729ada75096b40809eea

SHA256
4342e00cef2b4510d53f0d95066b0ca004dadeb3169642b5ada4b4d0ec4cef57

SHA512
83072a27ed171576c1d461809363676a34bbad45bd58bef3c7ecfed2ccf1e4d7b8290883ff2b4f4b0458834ff638da0c71f819b43465c6fe2c9ff4f2729648fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
84fa3935b64734888946d0adfbcb4a8d

SHA1
874b2e4050cfb1911330bf347a2d3d16888073f4

SHA256
446dee56c5b0b030331e717b5b6f6fea8a4a98c417c85def1d0856eb0a71e505

SHA512
85de1bb24ecdb6142fb5a5b1bdb3aedf50769db8544d232657abd1c0b514d865bb4d30da75e6e6a671f5133afd240fa282324264bc1985cea829a6a8fd773d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5110f7e22d5e2a1e99da872490f74add

SHA1
1d11522fd832d9521e35ac117995880c7fa52570

SHA256
540657baa321ee81b8809d8c704679a73129a94274a3cdf6dc862ec40f0ba308

SHA512
111d3c458a54f4e40b27600ffbc42c30bea53ddbad14a059b13da67a0e67a74acea2844632226a93b7a437dadcef5f9d171290087986baad50809e68fcae8362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
920B

MD5
f5b59f7887fc603b424ec82d2f577b9c

SHA1
377c87df6e9e6b78d2fea1608e10e750a966c657

SHA256
d42de6f1d21991fb477431ce60ee37382dc67cba00f2e225887508672152aa2c

SHA512
d72f9a3a24fc1469e50ac555b4612779afc63bbb4456fc8b07e81d7b4ebfdcdfe52ed30d3ea25881ffdb65b1dce03f306d091fb499a414c7932a7392322d6dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa7a7e8fc13321266e19638bc1ea17d4

SHA1
ff821732e72c7b2e25b4cf244aa05bf988c2be87

SHA256
00b0c301c2e798c5115999f182131112fd8afb9c8e8319fa3fb1477ec129379d

SHA512
95900504f29d2caf7d1d7780ebe651296f5cff4ef02c91342a67307a40d950b7e5494977ff70dac4b05ea5885994c8fc976199f8c7e17f9ddfb616fd349b97a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
efeaa7543f08e38ed16be3dbff8cd063

SHA1
d4d69ebee8d80a5a21e847f33298afa06946db44

SHA256
2f08a990579d42eb5b219195396ac9201851eca1779f4a72d4cfa7ecc6a627da

SHA512
f10eb191b05503411fb3030696090307a472ea53fc9670f2b9bd94bda63d4b8e10f795a6be29fcf6d64490bbf3866700292991b1d0afe7ffd0839483fedb4e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d3d1f8a67057f1f253e6ae5a083db0c6

SHA1
f03db19da2522dee5e9cee3b7a31367d2518b956

SHA256
878a9cf9b18b3271093a5bbe05605985a637584ca8aa32dd746875f3c0133e33

SHA512
995d0203d87a35cd62d3222f415f9069bf0de55c92e485968f89201008ea37d74f06ac94026d6323fd4b257514d7ecf5f0bc435162fd0119aff973f19fe34677

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca494E.tmp.exe

Filesize
2KB

MD5
69adc7e447fc670ff847b4e4a357d4b1

SHA1
1362fd5e23751bde02de70a6135954e5d88d3e14

SHA256
9fb9b1d96a76f91d0dfc54e7280f5b4b9a574c7e05cf02396694fbbdc60abf0f

SHA512
b1f3171356bc2279516747021ec8660d1ceeb34fb04edcd00f0305292c77641e25edd950de102a69219a40a36cdb28064cec291576f389cf3198c719e8bd7b08

Download Submit