397bbbbbcf5c97a5c9ce31ae4f13a485457f4391cb2c5a827ae614c17555b18e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe
Size

228KB
MD5

ef949568805205d59956f6f00dfef2a8
SHA1

927a976e4cff2a920d69d405846c51a22be0d57b
SHA256

397bbbbbcf5c97a5c9ce31ae4f13a485457f4391cb2c5a827ae614c17555b18e
SHA512

143642266a3b249a56317ad26f681324e303ab9bdaf032a3e4e682c879279dbe34ddf6b0dec9d111d674372a09ffb63d7941cb44f440d62924534e2ae6f16b30
SSDEEP

6144:NaCJya3zHD3pglzwTevRCcd6bUfFdXThU:NaCJy+z9glzq3wPXK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
3020	msedge.exe
3020	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3020	3628	ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe	86
PID 3628 wrote to memory of 3020	3628	ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe	86
PID 3020 wrote to memory of 1524	3020	msedge.exe	87
PID 3020 wrote to memory of 1524	3020	msedge.exe	87
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 5096	3020	msedge.exe	89
PID 3020 wrote to memory of 5096	3020	msedge.exe	89
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7fff6cf346f8,0x7fff6cf34708,0x7fff6cf34718
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6cf346f8,0x7fff6cf34708,0x7fff6cf34718
    3⤵
    PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
90b7ecc7ca3f8e7e5602834db2516804

SHA1
3136f3e93419f1bf0b56a47ad9a8417586aeffb9

SHA256
7e7ee0297d45940c481f7b1a862431d80ef80917a2f446183348f78eab3468a5

SHA512
03b1a10cd9570edfe7d63fd92fbab9e2661907019289db1ebf2d89636fa54620088c9fc1a6bf6292f090c2c39197034fa7c15fe06afdc3fd45eb8c7d3bcdc931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a567ba9a3625312881e8f4e55349fb2

SHA1
bd13ba86122322f692145cde964ba2cfa2fe8489

SHA256
e17cf9803582febf11cd5c748d618d8d2692e564d06a567a00102a8ab9976598

SHA512
9d7961d3d8f4608de40d633f913a14191d135a504d1b2d26f2ad8429fb2616aee89a5b66facb3c1bbff48826ac68665bd3f6059b6ddbe9396ee4e4079da79734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3490071b2b4903ad55fdc70a644eb9fc

SHA1
56b20ace99c51670e2f644def89f255801f8483d

SHA256
c3e0da001ed382a79e8585ca0097a0888128af82cd878a09fa59c0f5153f30b1

SHA512
6507113cc3b150f7056632d37d6f4f77f85ed6b5c9d4b4b23a36768e285fa2f2cceb2e452bb36a9115fd7f8c1102624f827abbb33b1c0e7e22fb552aa9e9c496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
653a6a1c6d566127552762e7f5efec40

SHA1
45d72a59262b4c331c89c888c955ff3b4284d757

SHA256
0dede13f40338d734a046a74811f933479970f0b534e5151a60cf745d86a4aa1

SHA512
0f259781aa2ea430784b1bcbef99d5a5905d0d91733a2d828862344c710fd090e58694d0afb5ada66a91b19ced53b5aee9bf2d856f0b7944298b0445cea26482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9d0e3b8f5029fd1d81b923e0d8d70713

SHA1
b9ebd4a722e8c84dd8d292a2f5ba5c681348a0bd

SHA256
d54fc259d9276cc7405ed3d8129d0aecf040618d03240d3adde2a0e9ed1914a9

SHA512
78172ca97a47d71bb7701078a3fffc809cceef03faa3f3d97020501dd5eec8eb1b95e1a262f135ce662f1e080ad25879ad0fc4a21b38369a13148ab1791bca07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5843bb.TMP

Filesize
371B

MD5
39a59c6e5bd29c6e7310362649536fe0

SHA1
d7f83f7117a063241ce70c4a97a14a817638bb70

SHA256
8160040dd1156a9deaddea9f1f3a02a270d5420fe0a9f6d03e3c2b2626bd504f

SHA512
32cdf21ae6f18c8c6877099f35e84fda8fe53ec4f5e9ddd6d6a13f5135b0938ba3ce7d067609179d005e961ebb6bafcea20c4cd4875489969820a6149d2c5ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02cb9e617424ad6c80947ffe1d4bb6b9

SHA1
79ab09f7944d65f692d2e1843072962d2ea22132

SHA256
5489f7ef71bd2b38ca6633f612c6af46c189656458bdf150db095dd9ac350fd9

SHA512
9a11661f867b12cf1bf298cb384bc7eb8d642a940fb9fe3b59b77486f5e73a5b66595685b8f1193bf6e3c523f83e0049d28607715f37b888f79c4182a92f693e

Download Submit