c24881f127493cbb6826c3b70bafc0858654f7c7283e0a53c3fa097867ff4727

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe
Size

4.9MB
MD5

4d3ced6925dbce7d457b9375bcf92a15
SHA1

9d1de90356b0d5142d9f22d1405272896035a20f
SHA256

c24881f127493cbb6826c3b70bafc0858654f7c7283e0a53c3fa097867ff4727
SHA512

873ef13664dbd3ea2596113ff45d03d7ce1d42ae81a945cba6f14eb37467ae64adea6e261bd787a7676df1b7f302bb6cfdbce2012372cabd8b44a090eeb35ec6
SSDEEP

49152:B9mRDDmrw/zv9wKTLe/vLHZfFsHF59BTtjvV02/NhV9mRDDmrw/zv9wKTLe/vLHz:B93U/zRLmzpkBtD93U/zRLmzpkBt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
344	msedge.exe
344	msedge.exe
1768	identity_helper.exe
1768	identity_helper.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe
344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 344	4164	4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe	86
PID 4164 wrote to memory of 344	4164	4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe	86
PID 344 wrote to memory of 212	344	msedge.exe	87
PID 344 wrote to memory of 212	344	msedge.exe	87
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3196	344	msedge.exe	88
PID 344 wrote to memory of 3684	344	msedge.exe	89
PID 344 wrote to memory of 3684	344	msedge.exe	89
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90
PID 344 wrote to memory of 3656	344	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8e2646f8,0x7ffa8e264708,0x7ffa8e264718
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14637632646097963333,2075302136660919008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4d3ced6925dbce7d457b9375bcf92a15_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8e2646f8,0x7ffa8e264708,0x7ffa8e264718
    3⤵
    PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b8c7be1de52c6cb5b60870fb67564d80

SHA1
a64c84ab812ff738079308b821f88362f76b9438

SHA256
5fe057a456af10799a92c05926fc9cc94a4b34f917e0cb4d02b966c1e94dc283

SHA512
8137298cd0da43f622275425528640278e13543099466fe8b3354aae210ee1e5aa015d13565e0f739a2d337b5b0825ec9db5423ab9c29444e69129b71008debd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b44ce3f348f2e8ddbfc3c4c91f4383ec

SHA1
a0e99fd264c8326540ec7c3cd52404f4bc9cb93d

SHA256
f9f1d1a27140684f0c45f8cd32da9b761a785c6fef46f72293fe78e12710ab2d

SHA512
5b487659ee06b06d5822620381162b9e72d0a7b962ff954d19ff4a1819cf15ec6b5797a89bb5f9d13599601090c6a85f1bb8a2050291e397933cc3300e179789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3748f587c5484afe34baf1c0391959a7

SHA1
b904240c25ac39fbe10c182a58abf2501322b246

SHA256
5aae3a0f52388a5834f8817c3d72b886787d71788e317cffc6cfb75a29890623

SHA512
02313b47fb17240fdf966939fdfc78fb7d7e6adaf7870849456ee6bf08f6937e0b05fc73eb98fc3c52d94c2f82b7bee6d85819eb35f9626f0f0276014f632ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a6245a36bdbdbf31a4c8df52169aec3

SHA1
f269699151821c5713f8a3d2af24d69bb54f2241

SHA256
ac2d859a3b6f787bfee9a32822404e44d98304ee369a68334ca0f654a27ceffa

SHA512
9259ede54a940b020f11e6089cc7e5047fdd7573f86091b25a66be79d49a8f85ae8c97eea3c55f6669ec909f521d94eeaf4583ce4fe8f1e860c834147939403f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6748b23c2786357ead4019a4a3302096

SHA1
13282c589b71623d923de81233d5100dde7e79e1

SHA256
182c5a73d50ee9a4d2d75b16fd21d2ccb16075af80cca1cbd373409eaa8d795c

SHA512
4351f97d21f03fc977072c5abb43d9faa1e11c6bf890253a687636f6df6172ba4c451c6db9f7a67362e066e69f737601d8ab297d7fb8a785011001256cf271dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2eb442460f1db22d3a8c9252b2a42722

SHA1
6a6a88d73cdeac010abf283e42030780ad976d86

SHA256
f8beafd1b9b8f6b04e60232585881b322bbc2c84a08e2c32ec8f457d438f1b4c

SHA512
bf7b5e3f1a22280486ca91ebbfd489c1e415686f72bd5ba44e11de00c9cfc4f1052eb041a1ab063fe555c3612d63bda3a30882d3b328b4edfb64779b0e9e87e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
cf71f5b75d6eed4a08e431ae79644252

SHA1
90a851abdc2df64353c6e5fc7c7ea019b02521ca

SHA256
6d855a1040316daee0e8c1741f7c697e70948ef99b53fc0929b060daaed2354e

SHA512
6357d13c990c8cf525889bfc4706c72d283f128cb180600309f81d6e56ab890af22d18219cc3c92ab22256091071f79621de6872f3e2d77e626b37cfdc88c555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585b79.TMP

Filesize
371B

MD5
47ad1ced027dd6dba8a559cc17f3d651

SHA1
a1061700b2485a2560d98756e03e39bb659cc34b

SHA256
1a450694197c97831d0b71db85ef088a772abb9e6fbedc7442c7df16a375186a

SHA512
d59c11a12467bf88ce5eb0d484c55ed693595b093427220967e92bdc7e2334e5138e05471a04caeb6104c7dad139eb80909ddf24428ff35b8d9af05e7cb8e5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5bd7d8630f6337285bd066db443118a1

SHA1
b979b8f9132fb15ad4439dccb450083bd1082233

SHA256
f3f0e2847c64b762eb160d5850bb8adfb40904f4fe31ef016c169c30a5019db9

SHA512
7682ec30809a49c2ced4901a3a76cd3736f82d89cc66031eccfead7af539ed39951da96ea1e1cba1b1c84677dee145808f4242b941f198a1dc713fcecab5dcc9

Download Submit