cc62022d24c59607f4e9cc6d1f22fa247617a9b191de2397ded7f2155c273f7e

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe
Size

216KB
MD5

ec26d06808b44a7314d59ceeccc0ad76
SHA1

9a8a2c138834f2c487704b187c751d6dcfa7db29
SHA256

cc62022d24c59607f4e9cc6d1f22fa247617a9b191de2397ded7f2155c273f7e
SHA512

ebcf9330174a664f9a1544d77b5530c13d4bef90cbed6a52887b0494cbede3325b9bbea4252be2216a36e55d42dd9658d77ba2b69a85456971a4134d0ff75076
SSDEEP

3072:xURig3D6G8BNd8JRvtpGdKApSX2uWKppGjswSnMuGc/CfZDap6COU45EIPtm+:83qVIGdKApSX2uNj1wSnMuGc2EjObm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
1060	msedge.exe
1060	msedge.exe
4784	identity_helper.exe
4784	identity_helper.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1060	3568	ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe	87
PID 3568 wrote to memory of 1060	3568	ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe	87
PID 1060 wrote to memory of 2024	1060	msedge.exe	88
PID 1060 wrote to memory of 2024	1060	msedge.exe	88
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 3160	1060	msedge.exe	89
PID 1060 wrote to memory of 4112	1060	msedge.exe	90
PID 1060 wrote to memory of 4112	1060	msedge.exe	90
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91
PID 1060 wrote to memory of 552	1060	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc4cc46f8,0x7ffbc4cc4708,0x7ffbc4cc4718
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14805283730422285682,9227710529037646070,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3968 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ec26d06808b44a7314d59ceeccc0ad76_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc4cc46f8,0x7ffbc4cc4708,0x7ffbc4cc4718
    3⤵
    PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ae95944e7ac1c9531b3633c1e47c7d09

SHA1
3ebafed0f3c0e0e41f3a630c0012e7b68d639f51

SHA256
ac4b567279e8cfbccf120c28be524101f489e0a0fe16159a86bbd92bc02b4b56

SHA512
278ded6d9dd41d3be40399f1cce13b99d41b15306e96d63f0d951e0708e0788303dff8b3ee8e436187d083934ca896db856db9a9d6857316bb8b7da86bd15005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cdc9fd4270eb4ed5f2e041ce6ba2eb6f

SHA1
2911cbbaf14620b18c4deca111794f9368fae328

SHA256
b320621af750c4606448310dd6e888b280fad74573883c9b2cad3444be84ebf6

SHA512
93158f6b2309d05e41d6b9a0b2162553ac31919914426c9d8ef7080dfa1ce02067a2567210e2918e01a0b288624376e75210adba8066487ecfe726d8b1f025fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a659ca7c15b6dc5a94dd53317c4918f9

SHA1
20c499db6f418a018373ef757f0cf3762d7e2b57

SHA256
4afea719d08fb2b3741c913cf8f1d4f8bda0fdb9670cfa8a195b5e38377e6ece

SHA512
c70748474b7578393007ed91cd35aae8661df51f73d25fc9b2316a9a3c36ed04002d4e00d70b330bb398ae2e453d6dc9cb3d85ccb47453e0f3739459f6b82983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
222d33749f3dbeb124f642a5804ba46f

SHA1
0d3399c6cd24b34897c3f0498589da9ffab96749

SHA256
4e10ad067487931503082f4c2098ce7bae0f527e42661562e54bfa1418e7b3e2

SHA512
6c12bff5e118d44e466159709a8bdcd0f4f86a9537c598d17e5171dc85718bb3fa6ed8f535bca6ed1930f99c150542c172709a1e6c7bbfa6309a1053dc0a429c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
73c5ecb15ac9f6081a3efacc9e42407d

SHA1
1d6a4e3e14d14864039c08d79be0963977039c9a

SHA256
3cb885757d63291fb72159b2a1684a1699689b7fbe8fee79a4349b55c2e8836c

SHA512
c3e2b96a8b0cfa6db1274c15b5e170f8b408a99acc3af87ed478b534a1bdc7f0279582fc76092d32d234268fa455de163c0aae90dc60200f0116a05cf96b8e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5807ea.TMP

Filesize
371B

MD5
f31177fbbdbc186d285c2e3e0445b084

SHA1
3a97f6b7bf891fdf718ff6db1b78fd1c2b79d193

SHA256
d903001a8e63ecbea4b02e274a84d7d96385539f10fd2eee7ca1f81f18ce5a30

SHA512
a98dc44923095177be00131686907906ac82862ac52bc81e1dfeee9ca7490a0ec96d984d0f77f6460147929ae6b0e5d9d1535ed6b2023e223c756accf8bedb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f749acf5e43cc787785eaf9e30925ddd

SHA1
37cf982e76db314fc9a2efdf656cdbe9d85896c9

SHA256
023ffedfa959d60a717b075b0fbacddc29e4b09eb9a9571a8cbf9b8e9365bc83

SHA512
e2c501ce936ab47c137667475173340151f885e10c008d720a90115ade265cef8ae5fd20ac1e1f95534c6f62fcf7fabf22ec9a901f9f431a9b49afc8115e1d73

Download Submit