9bf850a0bd36003228ae0ebbc6756a7c9451ace500b5f5648c0c45c416a4299e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e647f62af856ba07672c96814b875f04_JaffaCakes118.exe
Size 78KB
Sample240408-bfrxysca7s
SHA256 9bf850a0bd36003228ae0ebbc6756a7c9451ace500b5f5648c0c45c416a4299e
MD5 e647f62af856ba07672c96814b875f04
SHA1 675161d09343ed9df064a573f8576ea97521822a
SHA512 b702b385dc3800d965243f314fecf38b04fe520f78cb714b6e7310dc5b27a32fab9812ccbb0c357eb24eb61b53aaf4dbb552f0ac1965b34bb5b709dcb7f142ee
SSDEEP 1536:Fy5jSZVdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQtC6o9/71no:Fy5jSZ/vqyA11XYUBxprBPjcg9/2
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1168	4976	e647f62af856ba07672c96814b875f04_JaffaCakes118.exe	94
PID 4976 wrote to memory of 1168	4976	e647f62af856ba07672c96814b875f04_JaffaCakes118.exe	94
PID 1168 wrote to memory of 4548	1168	msedge.exe	95
PID 1168 wrote to memory of 4548	1168	msedge.exe	95
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 1080	1168	msedge.exe	96
PID 1168 wrote to memory of 2404	1168	msedge.exe	97
PID 1168 wrote to memory of 2404	1168	msedge.exe	97
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99
PID 1168 wrote to memory of 4936	1168	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\e647f62af856ba07672c96814b875f04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e647f62af856ba07672c96814b875f04_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e647f62af856ba07672c96814b875f04_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcd4746f8,0x7ffbcd474708,0x7ffbcd474718
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7787394486570412199,7078532818688062487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e647f62af856ba07672c96814b875f04_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcd4746f8,0x7ffbcd474708,0x7ffbcd474718
    3⤵
    PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 047ae730f75d4a1fb5a26030ae8a0d18a5bddd62118574991510346dbcd8b2ef
MD5 12d3666848840a53039bd3d2ed50d4ea
SHA1 914a9166ac5236df8b3067ebce3bb360d5610618
SHA512 29255fad814264350530fa83895aba74b44d2e5c41b29c56fac60a3fb91789cb84fa4306f186fdaf696817f788ce68c7b3b96929b0642754c66ec886fb6dc158
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 61b49a42af4a24f741c4d7af7df2902dad5a81844fe7a6d192644d59c4eae43a
MD5 006a66420d8170253d5afd8de2317fbc
SHA1 dd7c87de67e06ee3366b232649aa7ec5c2f19136
SHA512 6d4ac1de60b9890ee3084b55f320088f62854fc57d2cee272bc9e46d9d2687fcf3c95333d3a4a4af68e3e052d502368114112b9baba39849519cdd4670ecdf2e
SSDEEP 96:nMRknm1LTwpvWMoiVmde1szYyJMkdf9zpFHTBIy+UWQyV+VD7AiEwb:n0kmdTGWM0YsBBPTt+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 265004a7ef46bf66c8735233454bf67ae959bf13b194e8364a9bface3d831ba4
MD5 d30252e3ce858a7f7f8f277dbb6128c6
SHA1 d2a056b86f78ab79aaaa15e27fe75aa0bcf9bbd9
SHA512 f39c5101e49790bbeebd32ace974e9efc8ab1799aa94211165908c89b02b920903e1e0643c1b053992e7fa504021803797fbb966d024708bdc2343c1dcba33a0
SSDEEP 96:nMRkQm1H2wpvWMoiVmdeHOHTsUUWQyV+VD7ziEwb:n0kH12GWMXETxrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 57815837cf8fd84b47e8e266989b19a19189029d5efeecdf70e90ca3beabf89b
MD5 511ae129dd4e25449fea60adc48ebf7d
SHA1 5c705c202adb9a186df442ecc5032cf0eaa6a120
SHA512 a16585e434ded2cbcf2cad7b6dcc96ee61e65b5da3e5a1dc018b6a4978813a1c7b1aabfcde89d5801af87ab45467ae9bb058fb0c6ab17e9e36c2922d5e20eac5
SSDEEP 96:nMRknm1HmwpvWMoiVmde1BuH1jOHTNUUWQyV+VD7AiEwb:n0km1mGWM3uHhETWrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 67dbcaeca7fc1f49573e7f892381519bd9e812026069d71dc789b2395a8ef458
MD5 8058f8f56359d6a895bde97d3f823411
SHA1 fc8e132b8e75bb068ad87e783346a39ecb0f2d64
SHA512 71fc535b4668c210e860270381a33a67a14bf6b20845596b107bacfc694374bac2e64f3356d0f8cb13b981acbae9827fdab97ca84c1eb7059ea4754f28ea321e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b5f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b5f2.TMP
Size 369B
SHA256 71201418a4dd46720607b0a50178768c8c0d77e9a2a7e5c444dd38ec92e970eb
MD5 031e10a9d7eb5a0febbc787629253429
SHA1 b87b607d461448931a9c2b2df304a20dac618c62
SHA512 83abea4575867f89ce1eee6014f50c0cf29cc815077cfca43b3a124abf90cda2e9d83b35c81a811db7c659c3906c37591c018ccc65fa7775e8ada276cbc7819f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9c129beaad7a3a64440d361fcbbc535f5461212229e473b5fdf8cea80fa0c28e
MD5 aa8c3efed5a605c26952bd3bc7f33036
SHA1 6540753961285a836ceb3d0c1c470d9d8f3c4d10
SHA512 54c102b18409842a39a4b51f2b7576219c0aeb7b90dcd1baa4fbdeed5d65306301438099a9d4dbef45b32e1fbd8b3c98c4183bdabd8f9255fa1ef8e45959f29a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKie2RUFDxI4bR/pxvFt2px:A9iIxuERzA83h09RZxYlpo/pTt2h3CoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download