e2b7788ceaf152f3987ddfacf300570c5faee156b944b89cacfe1f292e8325d5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe
Size 78KB
Sample240331-pwq79acb28
SHA256 e2b7788ceaf152f3987ddfacf300570c5faee156b944b89cacfe1f292e8325d5
MD5 5497e7b1572a757751423cbb0c778e7f
SHA1 de2b9463eddabe2ae1c8e1c35c72dfa2af392257
SHA512 243201ef12912295572f6f5b5fcf054f03d14cd7fbab495de92751d3164085780ca01b02dce675d6e6a7876b219df687ce20d8bd9cc2c19a4943d5a8c1ae57e9
SSDEEP 1536:NRWtHHrdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLc9/419e:NRWtHLdSE2EwR4uY41HyvYLc9/Z
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
1184	msedge.exe
1184	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1184	1468	5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe	95
PID 1468 wrote to memory of 1184	1468	5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe	95
PID 1184 wrote to memory of 4652	1184	msedge.exe	96
PID 1184 wrote to memory of 4652	1184	msedge.exe	96
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 2768	1184	msedge.exe	97
PID 1184 wrote to memory of 3176	1184	msedge.exe	98
PID 1184 wrote to memory of 3176	1184	msedge.exe	98
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99
PID 1184 wrote to memory of 4232	1184	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd307b46f8,0x7ffd307b4708,0x7ffd307b4718
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1788081934785991725,8511005582025295313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5497e7b1572a757751423cbb0c778e7f_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd307b46f8,0x7ffd307b4708,0x7ffd307b4718
    3⤵
    PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
MD5 cbec32729772aa6c576e97df4fef48f5
SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
MD5 279e783b0129b64a8529800a88fbf1ee
SHA1 204c62ec8cef8467e5729cad52adae293178744f
SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 76c174163f66e36ec0098b6f9380ce0c2f407f152c2cb76210bbf2f1f12fdb44
MD5 606bf55e0761454f498939d8894f5929
SHA1 ed22dccb417861c92bcdd30386cb386b0b2a3735
SHA512 639c698525f03838412cbd5de3fe77cfa5c03fff5c238550f8469eab60751fc8809fa27cead11f9c4a004e46e742826d630af04e661e39ceb1cd0ae13c051144
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 19ee3c5d94ff6ea840f713cf6e65bc7277c5392a7f023c783646aab7be831bc9
MD5 a7298050d44e00f8433c1a4ac093c979
SHA1 689d12fe3d43cda7ed79cb6e8eb41916126b4035
SHA512 a231c6e6880992e135f63524a85715c4ad594e1f2349a00fd8c5dd90786cad8af8461e2b26a9843623cd737005095d3c32ac5aae0ec63e501656834bacaa5c79
SSDEEP 96:nHkogr1TUrwpvWMoiVmde1RYaMkdfipb/zUWQyV+VD7AiEwb:nHkLtUrGWMLYaBaNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9a4baf6f26f5eb7d68a6f0bb7cd57323c1955e4f6ddfbed3ddd6fec686233097
MD5 14b439e1baa988c9afb022e55b52ff5d
SHA1 f7ff6a081125ff741dece9e644f874fee2476e5a
SHA512 c57856f13773057fcc9f0a8b5c138fb773872a87007751dc2a1888500b07ef8cc3517b0edbabfdd000f334b8a786900d13dd072b84045af500e09b4f50124f65
SSDEEP 96:nHktgr1TgmwpvWMoiVmdeHcm4UWQyV+VD7ziEwb:nHkctgmGWMX4rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0dced56ace9357a6cc28ae9e4b849cf8fe9486f3e4a3bdaa5293fe4aa5ee3a88
MD5 2d5a7cadbb467fe6a406cc362530e616
SHA1 f83e02abcc992eda788e974a1dbec9ced3829bb1
SHA512 ea5ad331855956dbb11f7e4c1451ba55f5f32eecdf97f7c200f9792a98bf5a8c4169dd14e2af4c874fb83956a7012a1139e66036552d9a720bb71357431ef0c5
SSDEEP 96:nHkogr1TgWwpvWMoiVmde1Cu/1jccF4UWQyV+VD7AiEwb:nHkLtgWGWM8u/hArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 7e33766622f2f561c3be93bd9866b5ddc4fec421daebb424af4640e28835898f
MD5 1ec48810d258c859652c5b4217410fb8
SHA1 0e8805c003ea5098ba9bf670e21ad779538631c6
SHA512 aa653833d3b41b467810215f00c917d2a0c2962e93bf2d5ee5b24a2ae248b9071fd7334d5580592890c34c0c2c43c7cfbb9d19a2c2a1b0e845e9c729b65a474e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a865.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a865.TMP
Size 371B
SHA256 b192e51e96d86347600003e906b47a270380e25472035f04d34241f2ff13c493
MD5 9fd0d2e4c6238b6d280fd125040c1487
SHA1 68fa0709aa370cebc2e8da55cbc4f30ca0a2ba40
SHA512 ccf4d549b1ed8aa11c9bfa3bbd2cc6dbfae6386d823bc6bb7457ab41ae28b6a97f1730dfffb4bff2e8e71f5683eaa728bb605ed530a711ea94e0634a85fcdaf2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f7f6e7e0ffae44e587d4e140724304f494b77b8bc44d83d9deb600c11cdc1b2c
MD5 c4c7ba3c8f8d38bbd4382b9e90524c1c
SHA1 9868fc95635992a61afb1e1cccb92537087c5a02
SHA512 836230f84d171060bc40affc5963f6d387d06ab74c1564f1fa0a83f0cb3e147e57fec7793631d817536d5a15c45f096c05969cd65974f95be0bd28a5cba4718e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoe2RUAx5b9nznIYWLSDgSx:A9iIxuERzA83h09RZxYGjnzIDG8C
MD5 SHA1 SHA512 SSDEEP

Submit Download