524a6ad3419f2f18f609257b298bf1d6dd5bd01e7efe622bff75115cd92f59cf

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe
Size

448KB
MD5

c09616002f0469de779f1bae96ff6aa1
SHA1

cc40b98ff7bf6189c1b0ef50e6f51a5201562777
SHA256

524a6ad3419f2f18f609257b298bf1d6dd5bd01e7efe622bff75115cd92f59cf
SHA512

b1d628b0d119b1627b9bd8edade21a9eb515b483b488a4aafaf2f45d9fc6f3398113b8ce02f5320a8680e7996667b4c5d91d1a39772bfc592a3073cb405ac939
SSDEEP

12288:voJ0mTtfJRYNwPXK0dmt5nC4i/07WNWl:rwXK0dYnxi8SNWl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
440	identity_helper.exe
440	identity_helper.exe
5712	msedge.exe
5712	msedge.exe
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2228	1648	c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe	93
PID 1648 wrote to memory of 2228	1648	c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe	93
PID 2228 wrote to memory of 4900	2228	msedge.exe	94
PID 2228 wrote to memory of 4900	2228	msedge.exe	94
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 2252	2228	msedge.exe	95
PID 2228 wrote to memory of 744	2228	msedge.exe	96
PID 2228 wrote to memory of 744	2228	msedge.exe	96
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97
PID 2228 wrote to memory of 4368	2228	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99e0346f8,0x7ff99e034708,0x7ff99e034718
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13076779324763760861,10788698094896781699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c09616002f0469de779f1bae96ff6aa1_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99e0346f8,0x7ff99e034708,0x7ff99e034718
    3⤵
    PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
9ac0d2f828bab3b5d55e565af668c278

SHA1
b95b8e59527451a41bb23e5ac0ef321370a75244

SHA256
5f6459f0e12bf30bef8adae9e3660909f3a2b795e29c2b810c7773789edf4b63

SHA512
26d2297812af207e8d013fd7e987abb5aeb409a686ca1cbf8806f250210f21c0d705921e1db38c281e5d6567f1a17e7c10827985c64bcf9039c4a88cf05298ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7276b9b2c28e47b29d8e7faddf4ce3e5

SHA1
bb65d1d7c3d1b5a74c6dd16871d88b9501455c97

SHA256
33ca60ba0f2d94a2f047487625cc369b6547e8c6d3cb88b5448d47f3d278c03f

SHA512
05fcbc7f6d33e04f898c32e7c4e224bc8c26033394934d130c35482f2044ba6217cb6395b19325393a118499ae24cd04eaacc9dd7e6e4392b7c18a7caf3af16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e888e656d979e8b45cd27a3e22b28c2

SHA1
143cc8cc07081b0683f30c14e6c2c72e1c505694

SHA256
c85d3a31ce63143c07bc7ec292201795991fececa76a03a0d142e8eefc36b339

SHA512
61549edb0777625ef6c35dd661b1b9b368bb9ca46b15fa7b47b5fbca53d0881a65abcce7b22d0b9aac14207d7b7aabb95138c6dd86ced41e7096a372c018b54d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a22203a379999d210bba14ed7debaa0

SHA1
1ff456506491f628f806b1e81dccdb5b16f0d23e

SHA256
616f4ba1c7f0430b34030588a7a8b83744bd2479fca0799bb5c64f89fa429ea1

SHA512
1acaf02cba7d4c79cda033cfb87a34b9c29cb3aac7f2921df31e8591b096f6e8406e96a6328a07ce9c75597d96966f557c27cbb24606216bd3cf120a37afd953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d0b63012a77f68e6ce226f10d5320b72

SHA1
02e9f57f33c2c317e36ece44c2521706c202b3e3

SHA256
e5c8d00fa8f62522be2c7a3b05452221a61d6b9948679d41fa63d768c04c7dec

SHA512
b8fa40ef937acb664f268b15a1acfa32af9664c0103f419b5fe2055459e4b0228b0287aefafd2fe9a57268f25cc8096b1c04b2b6a7cfbb5e817bfda083bbbee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee29.TMP

Filesize
371B

MD5
ab7598b20a96c8e0b391b2160f08ab06

SHA1
01afe800ff13070eb90b8c62c6f10ccfded5369a

SHA256
66b5ef6f49843ec61bed1b44aaa1f3f9ee1c74b456e65883167e6ec0b70035a3

SHA512
b4ebba1238d014c3f473f7c18ca4e3af15deaecdc6604489aef8f0d181f2268a45da677e693e8968703a6e5897bafd4747955eb26680543207cb3fa4bf60e099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86a7d86481221ca389094c0b41bca3b0

SHA1
df7bd5a106e9a3118538cdcdaa55024338a7ad15

SHA256
83751a5aa8ea3cdebc2e909a15a32f671679db286521094b49edc04bde89c77c

SHA512
b59d765f0a9892c8950561ed7b61b54616b56509a1be295bab2e1fa4d3dcf09ce713d834667441ec09f46f700e2dfbfb97276d6cfa0dc3b952e401db2d34f7f2

Download Submit