d5fe1ea9689d98bf43bcdea616c67def05d915e61ef7075d36c8e873760f404e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe
Size

1.0MB
MD5

c9119f9815485fad74b183a36c2d1e2b
SHA1

2777cd101163e36f3804f36c7d8dc36226b9a45d
SHA256

d5fe1ea9689d98bf43bcdea616c67def05d915e61ef7075d36c8e873760f404e
SHA512

02d1e9ee6d53f82c63ce46fa576ca02d51966fd5b8bb5390b0e0f07dc0a07e4d75f94975bcf74ff4186ac36cf88fc042631fb025022f6bcc161813d99dc47d3b
SSDEEP

12288:hDEuLjSyR95Az27DEuLjSyR95Az2xmjbMPuR/i5ybKWeDgMC6rz10pKzX548zJYH:ugAgAbMPY7iD3AIXS8sLDavGtZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
2952	msedge.exe
2952	msedge.exe
920	identity_helper.exe
920	identity_helper.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2952	2120	c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe	91
PID 2120 wrote to memory of 2952	2120	c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe	91
PID 2952 wrote to memory of 1356	2952	msedge.exe	92
PID 2952 wrote to memory of 1356	2952	msedge.exe	92
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 3864	2952	msedge.exe	93
PID 2952 wrote to memory of 976	2952	msedge.exe	94
PID 2952 wrote to memory of 976	2952	msedge.exe	94
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95
PID 2952 wrote to memory of 1132	2952	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0edf46f8,0x7ffc0edf4708,0x7ffc0edf4718
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1169477244952578749,14589278891423933342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2796 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c9119f9815485fad74b183a36c2d1e2b_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0edf46f8,0x7ffc0edf4708,0x7ffc0edf4718
    3⤵
    PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8dfbba9dd02d6f331ad953b164812b5e

SHA1
1dd5acc51864766961319188f1ee1a6863bb59c8

SHA256
e37505df58d6104afac154621427cd5195b821ff4678a929de2bcf44fa66acd0

SHA512
f1cee4a23079924270f995c836ffe1d786dea51af0f5ccb903178a1cd38a5a4aa04e115d5cfabb6adcbaeb7e317388619c8b2f8a908fabedba2a00128bc43d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12c25c3989380a637a9fbf347afc847b

SHA1
7914d2f39eb2a61df2270d022b08edbdcbca0069

SHA256
a4e28ab47ba9745cc0a0e172b2f3a8f506793b13c550ed7fc33d7087d7ce52ab

SHA512
6277942f40a8aee0410cca0ea7f973ec281930264f1bd129e635282b3edd4182a14a5991d0b4c979c7586ed1741d54613ec819fd1f4b5e223ae83948a52a32de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4282de7fb172f42ada16a2de52fee328

SHA1
22b97c293443b89198cfd31247d23cf1c471d583

SHA256
ef3b68ba4c55c860bedf9eb4d97928c429cc735e7694e8afa8acdc51babc00d1

SHA512
d57006fea0b31911db238132d20f3539495110065ec1cb6da7ae57d7371bfd592d194b0f4488c36de88130c846806ae0fd1ba89a2f309f4568049e5693cf5f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4848d4fda2cf07e882675acf87beedb7

SHA1
1356a15eded7ed0c9b02075650dd4ec6c0bdacf6

SHA256
3e6c74cae8e133c6cb8eb51c63efa515d1b5e8929f37226ff2ab28a36e19ecc7

SHA512
fba785623a88449cc73c57eae60db719737e714b392471a847e8b9507fc99f5b4f6ebb16437fba94e4cefa5ad71629d5ae4e6b97a12f8c42014ee44c6ab341f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
9c598aa482ea8d6ac7061432f579bd05

SHA1
d036048bfa1d04f74b033d8b7548017de8617b37

SHA256
5e7cb426044b54ec28b2403a090c475a87c870ddb7b2c8cff5e4cd732872b77e

SHA512
0a57035cc6fddbd25d784c2d4834800eb85a5e8710041ef4d9d389abfc60426ff0ccedc2fff32621e78b33b7a5ac8f430295e99272a36dff629f982d08de70bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4edfd85009d34cb6c5a54661f8d4cf96

SHA1
617b4bb8bca3c3e0796cc4b1486f4844b3ca6130

SHA256
c6dc345213f56e93d66a85b842a0b47a7869541adc7fa9d74187e4f8565849d2

SHA512
9ba1c646735f8efe52a819a28798cdf8800872431c0efa1a063480ec0857ddcb90b572ca00c8f2badb5cb2c510d0529221db08576abe5f56dbe84483a40bbecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
049cffc186743d26388411c17b007f05

SHA1
a2daddfdcbcf1319cdbf454b89869848f165041c

SHA256
4a37dd2aa951aaf72b6a3fcc884179241081eb53165ca4d19e05da2ad38c68f5

SHA512
875441eeecb2b06a2dc2104f007a4d834055347c593012fe74b30a1eafee4898c07de17d06368ba1f3699a67be518c712c864b4f559e8d96c9a4d67dd7f30736

Download Submit