258f50453eb2da205b18b9d7c514b6ce9e59cfe596b444ab7b7a5cd746b625f7

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe
Size 78KB
Sample240408-cdc7fsdd9v
SHA256 258f50453eb2da205b18b9d7c514b6ce9e59cfe596b444ab7b7a5cd746b625f7
MD5 e65e43c354ac646835c66d9845e7420b
SHA1 13ba8d7d61b01e57de1ebeb63a99e23273e7a8c6
SHA512 0d7f0a3a00d8054def052f8fee2288f747b56d8cadd6413400587ede55555ce3baba867932776fd53b9dad53d2d369652a0c46cb3cc2c9891c5f791de790937c
SSDEEP 1536:Vy586dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6q9/T1cg:Vy581n7N041QqhgS9/j
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3884	msedge.exe
3884	msedge.exe
1052	identity_helper.exe
1052	identity_helper.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 3884	1496	e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe	93
PID 1496 wrote to memory of 3884	1496	e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe	93
PID 3884 wrote to memory of 4980	3884	msedge.exe	94
PID 3884 wrote to memory of 4980	3884	msedge.exe	94
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3188	3884	msedge.exe	95
PID 3884 wrote to memory of 3904	3884	msedge.exe	96
PID 3884 wrote to memory of 3904	3884	msedge.exe	96
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97
PID 3884 wrote to memory of 2912	3884	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a02346f8,0x7ff9a0234708,0x7ff9a0234718
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10112157608129364748,2453263699629935521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4084 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e65e43c354ac646835c66d9845e7420b_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a02346f8,0x7ff9a0234708,0x7ff9a0234718
    3⤵
    PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
MD5 fd7944a4ff1be37517983ffaf5700b11
SHA1 c4287796d78e00969af85b7e16a2d04230961240
SHA512 28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
MD5 a774512b00820b61a51258335097b2c9
SHA1 38c28d1ea3907a1af6c0443255ab610dd9285095
SHA512 ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5e866157c55e8cd10964329fc3d04c12cb9ab92471dff8f3e2350f73d4245610
MD5 52c06f99bbcb97c21360b7ab6806552b
SHA1 6d2d3909ce09ad44d1a1bc463032a5bc774c643b
SHA512 a0e68a8126caf36817ca32cfa5229d6d268f573d500f75eadb228d472ed77723b7c8ee48f3072de07738a6f9577c44fe63750368225adc2aab153e34b097ad06
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7122625e75f5eea7cbcdbfa6ced5337b1695b726714cc83f604066941d03a7ac
MD5 7a5049a4d4561de5f5101acde89ee9ca
SHA1 aa7336c65be73d6651ee3e2ad2d99fd07ee751b6
SHA512 fd09555df4d9caa00df3a3476e649deed0979e9dab9d34ceff0a8a792833cceb4f949414b6a4744c37393759ba10a1d97d7ca03962537f55183ddc6e3f841703
SSDEEP 96:nsfkJQ1rXD50wpvWMoiVmde1IY1MkdffpnnFIUWQyV+VD7AiEwb:nsfkCJXD50GWMeY1BnErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ed15088982816b440fdf060c5092af941aab3ee42c9fe97c9c3dc9c780cf0cbe
MD5 616d920a268ef0dca9f891a279b7fd82
SHA1 8d6b634ea77dbd8893e18f683417262b369e6183
SHA512 573180083512d926d00609cb37b49b98ad520ebee6bb19da17b003573b5bedb2a9b24d3aacebeec5d563a45946862d3192ff23989d33a5287203f0f2dcb4ff2e
SSDEEP 96:nsfkJQ1rXD00wpvWMoiVmde1IY1MkdffpnnFIUWQyV+VD7AiEwb:nsfkCJXD00GWMeY1BnErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 725793f0068fc5d2b67d74696432fb8167ad09587b221e0ec62d7eca0484a571
MD5 294780fdd833a70ca5ea03ef25776206
SHA1 345eda7cc680aeae59d97674dfb75f194e976f94
SHA512 aefe0f511ffc8b6b28179159b8bde1611273066a0046a1f6f3c1cfab0a72ff0f5e524c5a9e03a7bfec9ace2ebbce2bc317c90ed2c9768fba8cb4f72c7db4d1f2
SSDEEP 96:nsfkyQ1rfp0wpvWMoiVmdeHI/HUWQyV+VD7ziEwb:nsfk7Jfp0GWMXQrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 35ddc752ebde80b912d9c6a15dd4a8e8bfb29e6adbc8ade0a5e37beca9a62cb2
MD5 7d6098796f8522426925543096ac245b
SHA1 1056d3d16af16fd656a3f85a18676c7099e74b13
SHA512 49a58fc0b903fb5844da8a0a167d7f9e9e2806890ad1adf28b3d2b3c5c8e18d1571c3a38a0fa86c293bd44a5edcae09badfa4a20a167a282c40c89210b432368
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57df44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df44.TMP
Size 367B
SHA256 46b295b624cd2dc13c132efb5110c03c4893156ee47889781f50c4823e02e2be
MD5 3810839a6983e7e8b4ae2620a02eb660
SHA1 6814516df8d88a410fd39e643493e1532f1b70c0
SHA512 0cd71a828163dcb47c430e94f44bc095b335981f217a12a78cf328b89b9ee0bcfc9e5a2ec27ff87d096e41d604665fbb0cdc0216558907472f8ab6fabb51d602
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f9fe729f0dba6b259d4cd4d2216f328f581e12fbaa04f0e867672c0e5540a761
MD5 aaf32628fc3253f4b64edbb5dd741e4e
SHA1 d7cc0fd75a61f91e1279fe9ca47733605b9ae0bd
SHA512 d544873a895956b2034012bdcb0f7fa822e2b8fd3d62673b8168241f7eb1a79b7440347a470f3f59d9cdfefeaeaf91ca9027d271f4f8a130ff84e76bd0eb87e2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYLe2RUjmPSRw+NyblXxvFX:A9iIxuERzA83h09RZxYwimPU9iXTt2hk
MD5 SHA1 SHA512 SSDEEP

Submit Download