e67d6b85a313e6b15fdb85418e97828500fd64ddb5b6c1a8d4b21d2f4a270d40

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe
Size

69KB
MD5

82e06825d5f4a2d59699d4720795eb1d
SHA1

bc308256fa37fc855d734cc0b1b8f88f63c0c83e
SHA256

e67d6b85a313e6b15fdb85418e97828500fd64ddb5b6c1a8d4b21d2f4a270d40
SHA512

0c4f89dcb4e629ea9935dd1da3aed9e5ea34134fce1b6bb630540d0da941fcc0822477268565fc4c6cca55a4e606dcfbc59db8dc1dc31a924c36c7f79a498ed1
SSDEEP

768:d6WWiQ8gn1KrPmM2aiIZc0uBkX5rtvFnC219:d6WWifKCuMdiIZc0PXXdnC21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1628	msedge.exe
1628	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1628	3516	82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe	88
PID 3516 wrote to memory of 1628	3516	82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe	88
PID 1628 wrote to memory of 3396	1628	msedge.exe	89
PID 1628 wrote to memory of 3396	1628	msedge.exe	89
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1584	1628	msedge.exe	90
PID 1628 wrote to memory of 1296	1628	msedge.exe	91
PID 1628 wrote to memory of 1296	1628	msedge.exe	91
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92
PID 1628 wrote to memory of 5060	1628	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe551e46f8,0x7ffe551e4708,0x7ffe551e4718
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5738135112944250812,5832414271781145367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5580 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=82e06825d5f4a2d59699d4720795eb1d_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe551e46f8,0x7ffe551e4708,0x7ffe551e4718
    3⤵
    PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23b6e2531d39ba76e0604a4685249f2d

SHA1
5f396f68bd58b4141a3a0927d0a93d5ef2c8172f

SHA256
4a486d7be440ddf2909be2c2b41e55f0666b02670bbf077ac435e3cddc55a15e

SHA512
a1a7fef086526e65184f60b61d483848183ef7c98cf09f05ac9e5b11504696406120ab01da8ed7f35e3145aa5fc54307c9397770681e4d10feea64113e7a57cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6ffd468ded3255ce35ba13e5d87c985a

SHA1
09f11746553fd82f0a0ddef4994dc3605f39ccec

SHA256
33103b1e4da1933459575d2e0441b8693ba1ede4695a3d924e2d74e72becabd8

SHA512
5d5530c57faa4711f51e4baef0d1f556937a5db1e2a54ee376c3556c01db0ddf628856f346057d3849baa5db35603b96a0a9894f3c65a80c947085eb640348ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
9944f08a090a629a825303a9f64cb3c2

SHA1
71911c5245cf3a808dbe95c94ac4886ac4216e4c

SHA256
d4bc502e5b14596516f9cde447387902eea3c89c0c81175322b3130cdd046aba

SHA512
74cc7aa0d680e545bdeca25959b77f1450f1d12fb2f37aa7eab35d5ea4f50470fe36e643d9a9f43e9200be42dd5da6196a79051b5df6aa639bfcc59b39777d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a1e526e0e37e06a08879cffda5bb1e3

SHA1
a192d5c6370919643e99e7e2c0e8810160a6588e

SHA256
508c3847579c00266b995402937a01e9bf04577a274055d5f148ee94867dd54c

SHA512
a8ef7eff9cfa264eac186874abcf99dfd5b5d4e89bdcd3a683c7968e5a4f26c2f94dbb447c6309f399d1a3fab0af60085f8875e0809d5e32a99fcc58f96d11c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
70878d277377b84bd261d53f9c1c6722

SHA1
2c5713cc665888922caf7241aad2804809150ff1

SHA256
db173512c04f1e8510f830ad444c0892d70243c6e50a94d0f1bc48cdeb05bf93

SHA512
2808c57b5151b7b7a4536cefb27bf70ff91179880579ce2a86c4ee1c9dc791048984cda753ed0ebe00e4bb4ff3e994269882926b74077d9dfbecfa6671565c6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe33cfd12920cff24cfa3a83ec1dbba0

SHA1
27d8e2c766598aab29a78f4e7c568a9e6a71cc17

SHA256
212e45ef697ce9d92f52336f2469e6c03727e58fa412264130ef4dc3de6f19c7

SHA512
9ab1ea49d31615dbd0b2053ab8704f35aafacb48520cbef0de8585ccadc651310bde0c25b3ae480fb0cd50d4ae86343f46ea624b5107e9714e76d1ada658ea26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e1d17388d6fdde61986b88e0bb3f293d

SHA1
ebf42e86e7cffcd679def2da034cb1959ec9380d

SHA256
1d478f85daac17d37dd2d383d4b7dfad7681403dba49a6bfe48592c65365b3cf

SHA512
265a96b734140d6823e17468d55248e5694ebfbba91f583fab8437bd23f003cecb53261589ad3d969b26e4ecd6f8a23f8e682c672b034192936217a41db0bfa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813f0.TMP

Filesize
369B

MD5
b44c79847051598f0f0af28e4906891b

SHA1
d371f70ae4fe5cedc611988c97dfc7c47868438b

SHA256
ff94166d443f77f4d2172539dfbdeb5c0cf6343249d11afbd21210dd8688d3ae

SHA512
1696dcf32ab8d8611c2c65ae4a64246c4946990a6239fc7fb9056df728b07820817c617bfa81928d3d1d1f5c03a81aeddb90a1661dbae18bf854fc48ed5af4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d51c31677bc23945d8ca00c0f081bcd0

SHA1
d65625ae3d8a93354c07696b6553bf8e94383172

SHA256
5e123c6bb51dccb099e6c2a53028eee47fe0233d3ee195dc414f9c16212000fe

SHA512
b4f83fe8b34a6d81d5ddbb8244087a31374f8aa6c996b42e1ee8e8b25f39f085d7f55498b26127250bc649711708aa47c8446e68813a547e16a11f0779a8e27e

Download Submit