43a9bda5cf4c7525c13f2c2d6c4e099a1ecd49535dbed737c52c981c2b75c8f5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe
Size 78KB
Sample240407-v5dleaac74
SHA256 43a9bda5cf4c7525c13f2c2d6c4e099a1ecd49535dbed737c52c981c2b75c8f5
MD5 e57b07111519fab17cfcc680e364be6e
SHA1 cd4916e4739067d727ab6cfb6957a02d14dd0a11
SHA512 d0a1e05e0310c9118308a67de9f1be54ad4636f866c547945ff3b00bec6c77e77be02193043d129920057cf9a1fa624d02adb53c753801b00b6aa9205d49487b
SSDEEP 1536:OHFo6JIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtZ9/kPz13F:OHFoOINSyRxvHF5vCbxwpI6WZ9/4z
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
2388	msedge.exe
2388	msedge.exe
2744	identity_helper.exe
2744	identity_helper.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2388	2292	e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe	94
PID 2292 wrote to memory of 2388	2292	e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe	94
PID 2388 wrote to memory of 3696	2388	msedge.exe	95
PID 2388 wrote to memory of 3696	2388	msedge.exe	95
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 1284	2388	msedge.exe	96
PID 2388 wrote to memory of 4900	2388	msedge.exe	97
PID 2388 wrote to memory of 4900	2388	msedge.exe	97
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98
PID 2388 wrote to memory of 964	2388	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd411146f8,0x7ffd41114708,0x7ffd41114718
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3473729726209064154,2744262088826983802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e57b07111519fab17cfcc680e364be6e_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffd411146f8,0x7ffd41114708,0x7ffd41114718
    3⤵
    PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5f310ddc93a71cad4513c100284c199fde754ffa14cd68870a7773840850946f
MD5 cf1240aac1587697c041f0e87f812a5a
SHA1 2982d140025aa16f36b9ec6cf075f1fb4d4952e4
SHA512 88b65d705abb5f08197c4eb03589756f692c9648546a8b23dcc2aacdf957a15d9df8bc558241a3dbc907e1ff9d99c985d7ba70dccf674d4ab51178ba819ac395
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6d59ba09030a545cb0c11c37814498ebdf31129f5d6912e4366fa8ed0fc28223
MD5 8bdba1aa62038b89602199efed3ef4d1
SHA1 d704ca425918c6e542cb5000b26d3004bc4d4b45
SHA512 a4fc2d0c5556f8810f6930a67aa81469772fb17723736a0cecd51fcfbc5e2b704eeacdb33eef5e00e31fd07c9fa631766ab6dacbc53688474592361a8da4ab16
SSDEEP 96:nWkQO1PUwpvWMoiVmdeH0QNvUWQyV+VD7ziEwb:nWkDhUGWMXDvrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ff3b9b0c1ee0c73af2cbe8f4ca6a87d6ee6a80aedb8e6a9d08a778d330d60315
MD5 80a311130945bc737e7d784366d5142f
SHA1 6198bd32b45b6707416500a5f3f4a9383f1bdfd2
SHA512 0c46c49ae4e0e6169af6abe820425c34d671ae051de5bb6212b46bb4e9a34b7071510fb6b9cd08f0ac3004e5e644b735a886da8aaa9602cdbb65f3cb245d87cf
SSDEEP 96:nWknO1jRwpvWMoiVmde1BYGMkdfepbJNAUWQyV+VD7AiEwb:nWkOBRGWM/YGB2RArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 970e7fa82d063afe555d01588a0efb402991f15c54b2b94bfc3e1f683681b469
MD5 a00af5511c6384b62b4804bb622c6801
SHA1 7f07ac6b6cb1374f9e95871ff78f54b7364ee938
SHA512 961e9e680d0938bbfa6d6f7087f86d7f17311180d1f6e33709dbcaedd6423bd291520cc301d8e526588dc5e188614cebfb564ece5eaa2b9dac5c34a9c0a33e43
SSDEEP 96:nWknO1PkwpvWMoiVmde1Xu8S1j0nNvUWQyV+VD7AiEwb:nWkOhkGWMxujhivrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 e65d628b56b79b8e32a80d12290ac5df180e6810ac2963a9ed422c8ba81d4028
MD5 9ce6c7e95c10b48a7454b1a67b4e071b
SHA1 736fdedff64daf4516a4a2a2140f7ec09dff6ae3
SHA512 33a75a48f4cef0d3218ac3bc1b90c729a3f49eaf201a7be5e39f1412f5fbe45f2ac1af98522c44611fba1ff6fcddfa8874df23045f1daefd8a839b1a934d914c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ca74.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca74.TMP
Size 371B
SHA256 adf827b912883dea2bbebf9544dae1e840b9e807e760b082e6f30631b8ef8148
MD5 6c34e723c433788f1e829ce03370def1
SHA1 0e9995a71728b85d6aae21c8cab1103feb8fa42c
SHA512 8732f95cf23d40d3f6e18a60ed67eeee7e9388d6d230d76e03f2bb7b4f57417eae12dbe84c42032c803bf5a3324aba7d333dbae59c458d52452644a276eb4ea3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 790c1cae080998001eeb192b53f00493910bb4beb43a8a1ef3af3c23fd3ba336
MD5 63f9f946fba9756638da5e0f1d4e89b6
SHA1 c19c5e5fa5e35eef29dd958c6117c8c4019bf1c9
SHA512 328ba6dbbd72818ccbeddcf549d13f4f50ef3947551becdd4938f6c8fc3cabca09cb344976f7dffe0a9ccacd6a2c66b1c68eee69de48eb361695f266f0dc0e4f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphYZe2RU1xbXuxvFt2pTEEZ:A9iIxuERzA83h09RZxY2guTt2h3CoV
MD5 SHA1 SHA512 SSDEEP

Submit Download