4ec50d542244c398cd770cddd55f155ad1efd8122ca240341e1495ce52612ce2

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe
Size

78KB
MD5

724642b6b6f823ddce9a77cf91c9e9de
SHA1

f7dc9f8090db3c4d66e6b2d4143f38c277f051ce
SHA256

4ec50d542244c398cd770cddd55f155ad1efd8122ca240341e1495ce52612ce2
SHA512

9b3c420c154886a59e6699e88e76213e35111ffe3315205a974ea14b433b447eafab9a165946bf5c58bae34e5ecf49fb4d4d1c258f8f5a716cbb48ecb075acf9
SSDEEP

1536:FnRWV58YXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96Z9/V1aX:ZRWV58gSyRxvY3md+dWWZyi9/A

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3864	identity_helper.exe
3864	identity_helper.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3896	3308	724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe	93
PID 3308 wrote to memory of 3896	3308	724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe	93
PID 3896 wrote to memory of 4964	3896	msedge.exe	94
PID 3896 wrote to memory of 4964	3896	msedge.exe	94
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1720	3896	msedge.exe	95
PID 3896 wrote to memory of 1456	3896	msedge.exe	96
PID 3896 wrote to memory of 1456	3896	msedge.exe	96
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97
PID 3896 wrote to memory of 2192	3896	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffe4f5646f8,0x7ffe4f564708,0x7ffe4f564718
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3468966708278460255,447855345176374234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5932 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=724642b6b6f823ddce9a77cf91c9e9de_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4f5646f8,0x7ffe4f564708,0x7ffe4f564718
    3⤵
    PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
15314d8fd40f748f9e5088ed8cd44e83

SHA1
703b877773a9d9887cc2b0946b01bf37ee394dd8

SHA256
9120cf896eb23fb5da7b92aeb72bb4e68b91d6532907b8d44b90546d56f3c479

SHA512
fcc7c6467a5cd088fbd5d903c11497b6a96134c23489860f1ff842ac7ee14d1b2bb2162a50a847160beca2cd32fe3217227e44832d6416c4166b740d7681e43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b4e582dc054dae1d3fd4cba3a337c9f

SHA1
9cad4da4e7eea562bacd76a136e899be862278c1

SHA256
e2a8dfdb58558bf0ec5f084ff6c8b0b5aa4ac148790dc3f50e9b935d4fdd2bbc

SHA512
0e6ecea5d5291b13f46bff5831deec57736cf84e93a6ddc1dd047ecc02b204cbf0a49a64ab4cef7be2bc24793086d823ca908017093c871684d4a2fd20c83efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b33fdfd8930bd11735e7b5cbb4293052

SHA1
a92bbf9ba22eed9a0692d13ffa780387fafe207e

SHA256
39f407d0efd7430f56adfd08542ec6bc6312dfb9e94967690dd4079b465293e2

SHA512
bc3720417489861c6f964ed0aedc4873bd7404cd46a0b9125415a1bac37e6c1e8881ee19828ea5acfc108261f3295b97b23aeba06ea9d58e11ae40b3400ef50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
160f096009ea51be90691b77010cf50d

SHA1
22a486bc8fef7058a8a30f49d069106ea167e4ff

SHA256
e2cefd68f7afcd73075dc123f397978d3cc1822496ca8494f90572bb4a818d71

SHA512
c8646bda6d4657efac45d54c2ed545d5f0c1f25ae6a6cea17707d2a3d44e8b7776c20788d95472657690743ef349ba1dd6fe174529992e320994525c55380890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0ff166ed8657a1d20c3e621c337525df

SHA1
94750f123248b008bac4bde7edf735db39cc752c

SHA256
74cc6ad16f6591909821c0f1f5f7bfef231dd83f302f43790df15ca3b208e9ae

SHA512
221001c1273494f2e1b6aef2a7854a2c4a7a55589474d7bb14fce4154bc26f0d60d88d07595d6baa3b951e9522a50dc5bdc01fcdc13d6b2cd5da201e701ec662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e975.TMP

Filesize
371B

MD5
2cc2bb2ad5c50ac4d134b2fd0b101d87

SHA1
41e6b67eadbe17db545351c4ef887f73ea79091e

SHA256
a3b43ba361d0593dab60835c2e3d83d43022ef41f3b1ee204b43c5ffcff6e114

SHA512
338b37a56eeba5d407f110d1819aef7f174dc711041220ac8e61dbe1f52c1a6a8a435c8448b7fecd25d7e61261175b2b23e44ded5b10c505bc1a92f90d9f89b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5a43204bc281d6ec1da10e6f2c2918ac

SHA1
2aa01e65491edb0b613118308724448ba5a21acf

SHA256
9b3415c7f75c323a4106928134888ae6d04e0494a626890a7ebfc69d79e19230

SHA512
8802690e92e64c8a484317672c201733a1aaa03894b3ffc6d6672faf8767f254cf8c8a19f8d4aaa71e8d86f2cf7ef345595d20f609740b3c3ed06cc4b962b750

Download Submit