c941a68979f9bf59c45fb50317560301d3a0ff41f392c18a67a6311dce83ee6c

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe
Size 78KB
Sample240401-2kbdwahf58
SHA256 c941a68979f9bf59c45fb50317560301d3a0ff41f392c18a67a6311dce83ee6c
MD5 7c44c0a18f7d3a9f0dc57d51907e8139
SHA1 bff039cd95b164de1373d52899ca197c62dacf54
SHA512 b055fb60be5897635fb2b5e04eddebe1d91bacc3aec90daefa3b6e9b3a36beee88c3b1c9300f6c5a33afb4d8c741f0d8274f77988fc7528d007609981d02ba90
SSDEEP 1536:hRWtHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLo9/W18:hRWtHY8dSE2EwR4uY41HyvYLo9/3
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
2788	msedge.exe
2788	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2788	556	7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe	91
PID 556 wrote to memory of 2788	556	7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe	91
PID 2788 wrote to memory of 4116	2788	msedge.exe	92
PID 2788 wrote to memory of 4116	2788	msedge.exe	92
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 3652	2788	msedge.exe	94
PID 2788 wrote to memory of 4192	2788	msedge.exe	95
PID 2788 wrote to memory of 4192	2788	msedge.exe	95
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96
PID 2788 wrote to memory of 2920	2788	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe591646f8,0x7ffe59164708,0x7ffe59164718
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5038884470913738735,12307318397464529451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7c44c0a18f7d3a9f0dc57d51907e8139_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe591646f8,0x7ffe59164708,0x7ffe59164718
    3⤵
    PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
MD5 36bb45cb1262fcfcab1e3e7960784eaa
SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 d06b7ebe78cbe9460e022953e27640ffac4b60c0ae85a1af11158c201ce13ea3
MD5 d9d05389585baad41004d9977f37d22c
SHA1 7b1b59a0979984cb0b5f3435be63ce4cfc635a05
SHA512 731205d1401298c2590a47e76ad59bdc972f125dbf9c915938393c0d22f8eaf4cfb661edacbee5cd8ecb030400f04cf5dabbb4dc10f3ba3368e17e32b32f755e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8f631873b761cea28114b02d733828058df0873bdb438a9f65117eecfbaac4ac
MD5 c34729e6acd44a4f106346db75853a73
SHA1 295028b216a0d154ec40b0bbacbe77ae80459484
SHA512 0b76a082ef1af6318ce88badf725846df080b1afeedb382ce3934fbc33865713bd56fc44e161e6447535a5326db2849747cc3e36fe1b7464c8692963b95ee422
SSDEEP 96:nEkoaBY10jUsV8wpvWMoiVmde1BYyMkdfKp1/nUWQyV+VD7AiEwb:nEk4oUsV8GWMjYyBCPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1f1722146a50b73369e30962ad2082c9b28d41ee802da5207e2f2aa0ed2642a3
MD5 aec377a19383d46748844325e9f5851e
SHA1 620cf16ad668207c87795e5526fbef44479e8370
SHA512 67cc8464d0c0f9fc7595536c423cc7e0bf9ae249b8f3118da93ed26ab53a2a48a7e220931ee61404818523944e99cb61abccc86602493690f2410bd1b26452a7
SSDEEP 96:nEkoaBY10jpsV8wpvWMoiVmde1BYyMkdfKp1/nUWQyV+VD7AiEwb:nEk4opsV8GWMjYyBCPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 042bcaf3ddb9d59da6da611f9954f8dd0f18bb5b16645881f91a0c661a9a8f3e
MD5 aabee7fc447a10b4c37ae537cddf4b0b
SHA1 6577687f5d3c917f6f9dc92bf89645ea25a9aaf8
SHA512 ea2699c590b85f30b7bdf76492091cc1735e51fe524eceabdc3d19c7b001ac9a8dbe1c3ca9b3cc863ab8768994bb670ffdbce7a3db8af0943259f99a156ed2c9
SSDEEP 96:nEktaBY1G5sV8wpvWMoiVmdeHCu4UWQyV+VD7ziEwb:nEkn85sV8GWMX2rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 e5a761e7b5af4be24bd2908b63a9f838d3e24bdb637d9b6a32ac78a1f24ff2bb
MD5 1251e1dcb650bd8ad46207d95c05c5e7
SHA1 d61f3ac9ec5b894e6dd38670f6e988b5567f8b68
SHA512 d7d5c74c1680e16161efd71557c01123cbfac66fc996ef0d644ed2039e5c4137057c66e5b08a523a36020ec3cb57790c5f8183f3094179422d781e175aaace21
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d513.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d513.TMP
Size 367B
SHA256 ae7843ed12ecf3362b0954b33a2be61494d85eea14b9cbf9b956265417daa46c
MD5 e56aea18b1fb5ee0ce1542820be017e8
SHA1 261d55f6d8d81f08720896531948bba8b04323e3
SHA512 ba86fe8b761edb1d41340a8894987ce53cf96a58994d57b52288fd2f5c7cd3f7720d79798b934020f3fcb3b77989a17b055fbe0322cb8e01959813ddd7ddee9a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 74a2d07411b9bcd32d922d634b81818cf20c23fbccb3bd57b026966fd3a7d110
MD5 0a7a73f641036f0ce820c51778d5c454
SHA1 69f0ade747f63acecf54eaad5725a8489368acf5
SHA512 9698ae09dba44f471699b2adc15ac288da6e45203c64855c243958c7e579b86d2d6029cb86ad924f6bc57401ec15d5733832e24cf8882790f4f210c291d25c89
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4e2RUwpSKvbqFznIYWLSD6:A9iIxuERzA83h09RZxY23B+FzIDG8h
MD5 SHA1 SHA512 SSDEEP

Submit Download